Operation PANDORA shuts down 12 phone fraud call centres

39 fraudsters organised flood of unsettling telephone scams, shocking and cheating thousands of victims

In the early hours of 18 April 2024, German, Albanian, Bosnian-Herzegovinian, Kosovar* and Lebanese police forces raided 12 call centres identified as the source of thousands of daily scam calls. 21 persons were taken into custody during this Europol-supported action day, which took down a criminal network responsible for defrauding thousands of victims through the use of various modus operandi. The callers’ playbooks would range from shocking fake police calls, persuasive investment fraud or heart-wrenching romance scams. In an unprecedented law enforcement effort, a large-scale German investigation evolved into Operation PANDORA, which identified 39 suspects.

Operation PANDORA started with a bank teller in Freiburg, Germany. When in December 2023 a customer asked to withdraw over EUR 100 000 in cash, the bank teller grew suspicious and quickly learned the customer had fallen victim to a ‘fake police officer scam’. He informed the real police, which prevented the victim from handing the money over to the fraudsters.

Instead receiving the massive sum of cash, the collectors were arrested by Freiburg Police (Polizeipräsidium Freiburg) officers. Subsequently, surveillance was placed on the victim's phone line. Looking into this individual case, investigators soon realised that the telephone numbers used by the perpetrators could be linked to over 28 000 scam calls in only 48 hours.

From fake investment opportunities to shock calls

As the investigation expanded, it was handed over to the Baden-Württemberg State Criminal Police Office (Landeskriminalamt Baden-Württemberg), which was supported by the Federal Criminal Police Office (Bundeskriminalamt) throughout the operation. Early findings showed that the perpetrators, located in a variety of countries, conducted all kinds of telephone fraud. Scam callers would pose as close relatives, bank employees, customer service agents, or police officers. Using a variety of manipulation tactics, they would shock and cheat their victims out of their savings. Ranging from fake promises of lottery pay-outs, investment opportunities, debt collection demands, prepaid card fraud, or shock-calls, scammers relentlessly targeted their next potential victims.

As the investigation grew in size and complexity, law enforcement experts were closing in on call centres located in Albania, Bosnia-Herzegovina, Kosovo* and Lebanon. The criminal network responsible for the fraudulent calls set up its operation in a coordinated manner, focusing on a different priority in each country. While debt collection fraud was predominantly conducted from Bosnia-Herzegovina, online banking fraud calls were made from Kosovo. Investment fraudsters called mostly from Albania and the criminals specialised in prepaid card fraud sat at desks in Lebanon.

Countering call centres with a call centre

German investigators managed to track the actual conversations coming from the many call centres in real time. From December 2023 on, over a hundred officers were deployed around the clock in the Baden-Württemberg State Criminal Police Office and subsequently secured the content of over 1.3 million nefarious conversations. In consultation with the Freiburg Public Prosecutor's Office (Staatsanwaltschaft Freiburg) and later the Karlsruhe Public Prosecutor's Office (Generalstaatsanwaltschaft Karlsruhe), the aim was to prevent this crime throughout Germany.
The posted officers monitored up to 30 conversations of varying lengths at the same time. The State Criminal Police Office had set up its own call centre to counter the international criminal activities. Investigators worked in shifts and had one primary goal: to prevent fraud from happening. As soon as it materialised that anyone who had received a call could fall victim to the scams, the police reached out to warn potential victims.

In just four months, over 7 500 calls surpassed the threshold that warrants authorities to initiate criminal proceedings. In total, the deployed officers managed to prevent financial losses for the victims in over eighty percent of these indicted crimes. In total, the potential damages would have amounted to over EUR 10 million.

Swooping down on call centres

Apart from preventing crime, investigators mapped the locations where the calls were coming from. Obtaining information about the phone numbers, the owners, and the technical infrastructure such as servers, the plan was to eventually take down the perpetrators' entire call centre infrastructure. Europol supported this investigation by providing tailored analytical support, thus contributing to the overall intelligence picture.

Leading up to the action day, Europol hosted several operational meetings, providing operational coordination and financial support in preparation of the planned raids. When the time came to shut down the criminals’ operation across several countries, Europol hosted the operational coordination centre in its headquarters. Apart from providing operational support on the action day, Europol also deployed officers with mobile offices to locations abroad, thus facilitating the collection and analysis of forensic evidence.

Over 60 German law enforcement officers, supported by hundreds of their colleagues in Albania, Bosnia and Herzegovina, Kosovo* and Lebanon, as well as Europol specialists, swarmed dozens of residential and business premises. Apart from arresting 21 persons, officers were able to secure extensive evidence such as data carriers, documents, cash and assets amounting to EUR 1 million. A large number of electronic evidence was also seized, which should enable the investigating authorities to obtain information about possible further call centres and more fraudsters.

Participating countries:

Germany, Albania, Bosnia and Herzegovina, Kosovo*, Lebanon.

*This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.

https://www.europol.europa.eu

The Special Investigation Commission (SIC) is a multi-function financial intelligence unit (FIU) with judicial status. It is the center piece of Lebanon’s AML/CFT regime, a platform for international cooperation and plays a vital role in safeguarding concerned sectors from illicit proceeds.
The SIC’s tasks include receiving and analyzing suspicious transaction reports (STRs), conducting financial investigations, lifting banking secrecy, freezing accounts and/or transactions and forwarding them to concerned judicial authorities. 
With respect to terrorism and the financing of terrorism, the SIC is also empowered to prevent the use of movable or immovable assets. In addition to sharing ML/TF intelligence with counterparts and coordinating with foreign/local competent authorities on requests of assistance (ROAs), the SIC also proposes AML/CFT regulations and issues regulations and recommendations to concerned parties. 
AML/CFT supervision via risk based compliance examinations that cover banks and other reporting entities to ensure proper implementation of prevailing regulations is also among its tasks.

Law No. 44 criminalizes illicit proceeds that are derived from the following offences:

1. The growing, manufacturing, or illicit trafficking of narcotic drugs and/or psychotropic substances according to the Lebanese laws. 
2. The participation in illegal associations with the intention of committing crimes and misdemeanors. 
3. Terrorism, according to the provisions of Lebanese laws. 
4. The financing of terrorism or terrorist acts and any other related activities (travel, organizing, training, recruiting…) or the financing of individuals or terrorist organizations, according to the provisions of Lebanese laws. 
5. Illicit arms trafficking. 
6. Kidnapping, using weapons or any other means. 
7. Insider trading, breach of confidentiality, hindering of auctions, and illegal speculation. 
8. Incitation to debauchery and offence against ethics and public decency by way of organized gangs. 
9. Corruption, including bribery, trading in influence, embezzlement, abuse of functions, abuse of power, and illicit enrichment. 
10. Theft, breach of trust, and embezzlement. 
11. Fraud, including fraudulent bankruptcy. 
12. The counterfeiting of public and private documents and instruments, including checks and credit cards of all types and the counterfeiting of money, stamps and stamped papers. 
13. Smuggling, according to the provisions of the Customs Law. 
14. The counterfeiting of goods and fraudulent trading in counterfeit goods. 
15. Air and maritime piracy. 
16. Trafficking in human beings and smuggling of migrants. 
17. Sexual exploitation, including sexual exploitation of children. 
18. Environmental crimes. 
19. Extortion. 
20. Murder. 
21. Tax evasion, in accordance with the Lebanese laws

Money-laundering operations may occur in any business especially:  
· Banks  
· Other financial institutions (insurance, mutual funds, etc.)  
· Money exchange firms  
· Antique dealers  
· Real estate concerns  
· Jewelry dealers