A week of joint operations hosted by the National Crime Agency in London has led to 28 arrests across Ghana and Nigeria while technology firms took down upwards of 3.7 million fake accounts, Pages and Groups. For UK defenders, it shows how intelligence sharing between police and platforms can hit fraud infrastructure at scale, and where their own telemetry fits in.
What happened
From 6 October, the National Crime Agency (NCA) hosted what partners called “Joint Disruption Week” at its London headquarters, the first coordinated push of its kind aimed specifically at West African scam centres. The US Department of Justice announced the results on 13 October, having run the effort alongside the Scam Center Strike Force set up by the US Attorney’s Office for the District of Columbia.
In Ghana, police swept into a compound at Sasaabi on the outskirts of Accra, arresting 19 people and seizing 303 devices. They also found 117 people thought to have been trafficked and forced to work there, who are due to be returned to Nigeria. Another 89 fraud victims, with combined losses of roughly $8.3 million, were tied to the site. Nigerian officers added nine arrests and 53 devices, taking the total to 28.
Ghana’s Cyber Security Authority, police Criminal Investigation Department and National Security Service led the raid, backed by the NCA, the FBI and Nigeria’s Economic and Financial Crimes Commission. Ghana’s communications minister, Samuel Nartey George, said the haul included 136 phones, 130 laptops, four vehicles and ten Nigerian passports, according to Graphic Online. He also thanked the Ghana Air Force for helping repatriate 120 trafficked Nigerian nationals, a figure slightly higher than the DOJ’s 117.
About 15 police bodies took part, including forces from Australia, Canada, India and New Zealand plus INTERPOL, alongside a similar number of companies: Meta, Microsoft, Google, OpenAI, Adobe, Binance, Coinbase, Chainalysis, Elliptic, Flashpoint, Silent Push, Starlink, TRM Labs and Cyjax among them. Together the firms took down over 3.7 million accounts, Pages and Groups, handed police leads on more than 30 suspected scam centres and flagged upwards of $11 million that might be frozen. Officials credited Meta with a central coordinating role.
How it works
From a security operations perspective, the model matters more than the arrest count. Rather than one agency building a case for months and then acting, investigators and industry analysts worked side by side, trading intelligence almost live. A platform spotting a cluster of fake accounts could pass it to police, who could tie it to a building; a blockchain analytics firm could trace wallets to the same group; and hosting, connectivity and payment providers could pull infrastructure as the doors went in.
The schemes disrupted included impersonation of police and officials, “digital arrest” extortion (victims are persuaded they are under investigation and must pay to clear their name), cryptocurrency investment fraud known as pig butchering, and other online scams. The Department of Justice said UK victims were among those targeted.
US officials likened the compounds to the industrial scam centres of Southeast Asia: organised businesses that recruit or traffic staff, train them in social engineering and run campaigns across many platforms at once. Many of the people typing the messages are victims themselves.
The headline figures have limits. The $11 million is only “potentially freezable”, and nobody has said how much has actually been frozen. The FBI’s Matthew Floyd described identifying assets as “the easy part”, The Record reported. The NCA’s Nick Sharp said the number of British and American victims is still unknown while seized devices are examined.
Why it matters for UK organisations
Much of the fraud reaching UK inboxes and phones is run from overseas, which makes operations like this directly relevant to banks, retailers, telecoms providers and any organisation whose brand a scammer can borrow. Authority impersonation and investment fraud regularly use the names of real companies, regulators and police forces to build credibility.
The NCA’s role as host also signals where UK policing is heading. Sharp stressed partnership, saying the scale of fraud means it “takes partnership working across international boundaries”. The emphasis is on hitting fraudsters upstream and overseas through the infrastructure they rely on, not only prosecuting individuals afterwards. For UK businesses, the data they already hold, such as phishing reports, lookalike domains and mule account indicators, has real value if it reaches investigators quickly.
There is an awkward point about platforms, too. The Record notes that Meta has faced scrutiny over scam advertising, and the company says it aims for verified advertisers to supply 90% of its advertising income by the end of 2026, up from 70% today. Clearing millions of accounts in a week is welcome, but it also shows how much fraudulent presence existed in the first place.
Expert view
In my experience, most organisations treat fraud and cyber security as separate departments with separate tooling, and scammers exploit the gap. The phishing kit copying your login page, the fake profile using your logo and the WhatsApp message posing as your finance team are often run by the same operation. Disruption works best when signals are joined up, inside a company as much as between governments.
I would caution against calling this a turning point. Takedowns impose cost and buy time; they rarely end the business model. Compounds relocate, accounts are recreated and the trafficked workforce is replaced. When we look at brand abuse for clients, the same lures tend to reappear within weeks of a cleanup. The lasting value lies in the relationships and processes built during the operation, which make the next round faster. SOC teams already monitoring for impersonation should ask how their findings could feed such efforts rather than ending as an internal ticket.
What to do now
- Monitor for brand impersonation. Track lookalike domains, fake social profiles and fraudulent adverts using your name, report them to the platform and registrar, and keep records investigators can use.
- Brief staff and customers on authority scams. Make clear that genuine police or regulators will not demand payment or secrecy, and give people an easy way to check.
- Harden payment processes. Require out-of-band verification for new or changed payee details and any urgent transfer request.
- Protect accounts scammers want to hijack. Enforce multi-factor authentication on email, social media and advertising accounts, in line with the Cyber Essentials user access control requirements.
- Join up fraud and security telemetry. Put phishing reports, fraud cases and threat intelligence into a shared view so patterns surface early.
- Share and report. Forward suspicious emails to report@phishing.gov.uk and scam texts to 7726, report fraud through the national reporting service, and pass indicators to your sector sharing group.
Bottom line
Joint Disruption Week delivered real arrests, identified more than 100 suspected trafficking victims and stripped millions of accounts from West African scam operations, with the NCA at the centre. It will not stop fraud aimed at the UK, but it shows that intelligence-led disruption can work at scale. UK organisations can help by treating impersonation and fraud data as security intelligence and getting it to people who can act on it.
Sources
- US Department of Justice: Results of Law Enforcement and Private Industry Joint Disruption Week targeting West Africa
- The Record: West African scam compounds raided, more than 100 suspected trafficking victims rescued
- MyJoyOnline: Sasaabi scam centre busted, 19 arrested, 117 trafficking victims identified
- Graphic Online: 19 arrested, 303 devices seized in Sasaabi cybercrime raid
