Inside the $280m recovery gap in INTERPOL’s Operation Serengeti III 

For every dollar international police managed to claw back from cybercrime syndicates operating across Africa this summer, nearly three dollars had already vanished into the black hole. It is a seductive law-enforcement victory on paper, but beneath the surface, the math turns ugly fast.

When INTERPOL announced the results of Operation Serengeti III on 22 October 2026, the headline figures read like a decisive triumph for cross-border policing. Working across 20 African nations alongside US investigators between 29 June and 31 August 2026, authorities arrested 1,462 suspects, dismantled 10,909 malicious networks, and recovered over $105 million in illicit funds. Yet buried beneath that triumph is a far more sobering metric: financial investigators tied those same criminal networks to losses north of $385 million across 65,929 identified victims.

That $280 million deficit is the real story of Operation Serengeti III. The underlying message is blunt. African cybercrime has matured from solitary bedrooms into an industrialised supply chain built on initial access brokers, foreign-run call centres, stolen state power grids, and programmable crypto rails that clear stolen capital across borders long before police can secure a warrant.

To understand why that $280 million recovery gap matters, one only has to look at the three-year trajectory of the crackdown itself. Co-funded by the European Union and the Council of Europe’s Global Action on Cybercrime Enhanced (GLACY-e) project, Operation Serengeti III is the third annual wave of INTERPOL’s flagship African cyber enforcement sweep, following the inaugural late-2024 wave and Operation Serengeti 2.0 in mid-2025.

Comparing this year’s haul with Operation Serengeti 2.0, which ran during the same June-to-August window in 2025 across Angola, Benin, Cameroon, Republic of Congo, Côte d’Ivoire, Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, Zambia, and Zimbabwe, exposes a relentless game of cat and mouse. In 2025, investigators arrested 1,209 suspects, took down 11,432 malicious infrastructures, and seized $97.4 million. This year, arrests jumped by 20.9% and asset recoveries edged up by 7.8%, while the number of disrupted networks declined by 4.6%.

Policing capacity is clearly improving, aided heavily by private threat-intelligence telemetry. INTERPOL leaned on a deep roster of corporate and institutional partners, including Group-IB, Kaspersky, Fortinet, Team Cymru, Uppsala Security, Cybercrime Atlas, Meta, the Global Anti-Scam Alliance, and Zimbabwe’s Postal and Telecommunications Regulatory Authority (POTRAZ), to map command-and-control servers and hand local police actionable IP addresses and domain registries before the raids began.

Even with private-sector telemetry feeding police raids, the underlying economics favour the syndicates. According to INTERPOL’s own African Cyberthreat Assessment Report 2026, published in June 2026 with backing from the UK’s Foreign, Commonwealth and Development Office, cybercrime losses across the continent more than doubled between 2024 and 2025, surging from $192 million to $484 million. In Western and Southern Africa, cyber offences now account for more than 30 per cent of all recorded crime. Law enforcement is scaling linearly through seasonal task forces; criminal liquidity is compounding at software speed.

Access brokers and the stablecoin blind spot

Beyond the continental arrest tallies, the Nigerian enforcement highlights in Serengeti III speak directly to a structural bottleneck in how West Africa monitors digital value. Rather than sweeping up dozens of low-level street operators, investigators targeted high-volume enterprise infrastructure and cross-border laundering rails.

In one raid, Nigerian authorities arrested a single suspect allegedly running an industrial-scale phishing and Business Email Compromise (BEC) operation. The suspect had harvested software credentials and built a database of roughly 2.1 million email addresses. That detail aligns directly with findings from the June 2026 threat assessment, which flagged West Africa as the continent’s most active hub for BEC detections.

Instead of merely running isolated cons, top-tier local threat actors now operate like B2B wholesalers. Acting as initial access brokers, they harvest corporate credentials at scale to compromise cloud services, enterprise resource planning (ERP) workflows, and financial accounts. Once an attacker holds valid corporate credentials, industry data shows that traditional perimeter defences block only 37% of their downstream actions.

A second Nigerian investigation underscores why clawing back stolen capital has become so difficult. Authorities arrested the alleged organiser of an international investment fraud ring promoted through messaging apps. Forensic accounting showed more than $2.4 million in suspected criminal proceeds moving through the operation, with the bulk of the cash laundered through cryptocurrency transactions.

To understand why recovery rates sit at 27 per cent, one only has to look at the mismatch between settlement velocity and regulatory architecture. Across Sub-Saharan Africa, on-chain value reception has crossed $205 billion annually, with Nigeria driving the lion’s share of peer-to-peer (P2P) and stablecoin volume. Syndicates exploit the same instant USDT and USDC liquidity bridges that legitimate importers use to bypass foreign exchange scarcity. 

Operation Serengeti III exposes foreign scam factories in Africa

Outside West Africa, Operation Serengeti III exposed how international syndicates use African jurisdictions as physical hosting grounds for global fraud and illicit hardware.

In Uganda, police dismantled two transnational fraud rings and arrested 365 foreign nationals, a full quarter of all arrests across the 21 participating countries. Mirroring Southeast Asia’s scam compounds, these rotating call centres used fake trading terminals and spoofed websites to strip pension funds from victims across Asia. While an independent finding from INTERPOL’s June 2026 assessment revealed that 72% of surveyed African nations now report active scam centres operating within their borders, part of a global fraud economy where the US Financial Crimes Enforcement Network (FinCEN) recently linked $12.7 billion to overseas digital asset scam compounds, INTERPOL’s release leaves critical questions unanswered. It omits the detainees’ nationalities and whether those workers were willing operatives or trafficked labour coerced under debt bondage.

Meanwhile, in Angola, investigators shut down two illegal crypto mining centres, arresting nine suspects and seizing over 2,000 mining rigs alongside six illicit electrical transformation stations worth over $1 million. By tapping directly into public power grids to subsidise energy-intensive proof-of-work mining, these operations convert scarce state electricity into private criminal revenue. Elsewhere, raids dismantled predatory mobile loan extortion apps in Tanzania, a social media vehicle-import fraud ring in Gabon, and a 30-suspect cyber syndicate in the Republic of Congo.

Hovering over every arrest tally in Operation Serengeti III is the rapid weaponisation of AI. While INTERPOL’s recent report makes only a passing nod to emerging tech, the agency’s June 2026 assessment established a stark baseline: up to 55% of reported cybercrimes across 36 surveyed African countries now involve AI tools. Criminal groups are no longer constrained by human typing speed, grammar giveaways, or local language barriers. They are deploying generative models to automate spear-phishing at scale and, far more worryingly for Africa’s fintech sector, combining real leaked personal data from national ID and telecom breaches with AI-generated biometrics to construct synthetic identities.

These synthetic profiles are actively bypassing legacy Know Your Customer (KYC) and liveness checks across mobile money and digital banking platforms. Once onboarded, these “sleeper” accounts lie dormant for weeks to evade velocity triggers before executing synchronised, programmatic cash-outs.

INTERPOL Cybercrime Director Neal Jetton noted that while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks and recovering assets. That legislative foundation is slowly taking shape, with 17 African countries updating their cybercrime statutes in 2025 to streamline cross-border evidence sharing. Yet a two-month summer sprint is an episodic response to a continuous, automated threat. Until African regulators, telecoms, crypto exchanges, and police forces build real-time cross-border intelligence pipes and convert these 1,462 arrests into convictions, criminal syndicates will treat operations like Serengeti III simply as the cost of doing business.