Meta, Google, Microsoft and OpenAI Join Global Crackdown on West African Scam Networks

Meta, Google, Microsoft and OpenAI joined an international crackdown on West African scam networks that removed more than 3.7 million Facebook and Instagram accounts, pages and groups.

Announced on October 13, 2026, the operation led to 28 arrests and the rescue of 117 people forced to work inside scam centers.

The United Kingdom’s National Crime Agency hosted the effort in London, bringing together technology companies and law enforcement partners from ten countries.

The Joint Disruption Week began on October 6, with investigators sharing intelligence on operations in Nigeria, Ghana and other African countries, according to the Department of Justice announcement.

Investigators from the Department of Justice and analysts at Meta identified scam networks and abusive online activity, not a named malware family.

Neither organization’s published account disclosed malware samples, file hashes or an infection chain. The findings instead describe coordinated social engineering, fake identities and payment fraud spread across online platforms.

Meta, Google, Microsoft and OpenAI Join Global Crackdown

Meta said most removed accounts appeared to target people in the United States and United Kingdom using profiles that posed as American and British users.

These removals extend the platform’s broader work on Meta’s latest anti-scam tools while taking away accounts that criminals used to reach potential victims.

Microsoft suspended accounts suspected of links to the scams. Google and OpenAI also participated, although the announcements did not provide separate takedown totals for either company.

OpenAI said it shared insights with partners and used AI to help identify scam networks across platforms. Authorities received leads on more than 30 suspected scam centers. In Sasaabi, near Accra, Ghanaian officers arrested 19 people and seized 303 electronic devices.

They also identified 117 trafficking victims awaiting return to Nigeria and 89 fraud victims whose losses totaled about $8.3 million.

Nigerian authorities arrested another nine people and seized 53 devices. The trafficking victims must be distinguished from suspects: Meta said people rescued in Ghana had been held against their will, lacked adequate food and suffered physical and psychological abuse.

The latest figures add detail to earlier reporting on the Ghana scam center raid and underline why arrest totals cannot be treated as counts of everyone found inside a compound. People forced to send scam messages can themselves be victims of the criminal operation.

How the Scam Networks Worked

The networks used several fraud models rather than one technical attack. Investment scams began with fake romantic or professional relationships before victims were directed toward false investment offers, including cryptocurrency schemes.

Other operations involved fake military identities, goods that never arrived and claims that criminals could recover previously stolen money.

Law enforcement impersonation and digital arrest schemes used threats to pressure victims into paying. Job and task scams offered simple work but demanded fees or transfers from applicants. These methods rely on trust, fear and false authority rather than a disclosed software vulnerability.

The technical response connected online accounts, web infrastructure, communication channels and financial activity.

Silent Push said it mapped more than 35,000 malicious domains and nearly 700 communication channels tied to African scam centers, helping investigators link online operations to physical locations and operators.

For readers assessing suspicious offers, earlier FBI warnings about fake work-from-home job scams explain why requests to pay cryptocurrency before receiving work deserve close scrutiny. The same payment pressure appeared among the fraud types identified during this operation.

Industry partners identified more than $11 million in potentially freezable funds. That figure does not mean the full amount was frozen, seized or returned. Separately, Coinbase identified more than 65 active scam victims and stopped over $415,000 in potential losses before payments occurred.

The operation shows why account removals alone are insufficient. Platforms can interrupt contact with victims, while financial tracing can expose payment routes and police can seize devices and arrest suspected organizers.

Investigators now have additional leads, but the announcements do not establish that every linked scam center has been closed.

Anyone targeted should preserve chats, payment records and transaction details to help investigators. Stop sending money, contact the payment provider and report the suspected online fraud. Avoid anyone promising to recover lost cryptocurrency in exchange for another upfront payment.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Meta, Google, Microsoft and OpenAI Join Global Crackdown on West African Scam Networks appeared first on Cyber Security News.