1,247+ victims identified
INTERPOL has announced the successful conclusion of "Operation Red Card 2.0," a large-scale, coordinated law enforcement action targeting online financial fraud across Africa. The eight-week operation, which ran from December 2025 to January 2026, involved police forces from 16 African countries. It resulted in 651 arrests and the seizure of over $4.3 million in stolen funds. The operation highlights a growing international effort to dismantle the organized criminal networks that leverage digital platforms to defraud victims across the continent and globally.
"Operation Red Card 2.0" was a coordinated effort involving multiple national law enforcement agencies, facilitated by INTERPOL's financial crime and anti-corruption units. The key actions taken were:
The operation targeted a range of common and effective online fraud types prevalent in the region:
Investigators have linked the dismantled networks to over 1,247 victims and estimate the total losses from these schemes to be over $45 million.
The success of Operation Red Card 2.0 demonstrates several key points in the fight against global cybercrime:
For individuals and businesses to protect themselves from such fraud:
Public awareness and user education are the primary defenses against falling victim to investment and loan scams.
INTERPOL's "Operation Red Card 2.0" commences.
The eight-week operation concludes, with results announced later.

Cybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Help others stay informed about cybersecurity threats
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.