Austria and Albania shut Tirana call centres behind €50M crypto investment fraud
Eurojust and Europol helped Austria and Albania raid 3 Tirana call centres on 17 April 2026: 10 arrests, €891,735 cash seized, €50M+ in alleged losses.
Austrian and Albanian authorities, supported by Eurojust and Europol, have shut down three call centres in Tirana that allegedly ran fake online investment schemes aimed at people across the EU, causing more than €50 million in losses. This isn't a software vulnerability story. It does show how industrialised investment fraud now works, and fintech, crypto and trading platforms are where victims' money moves.
What happened
Eurojust announced the results on 29 April 2026. The joint action day was 17 April 2026. Austrian investigators opened the case in mid-2023 after a cluster of victims reported losses in Vienna, and later traced the fraud to Albanian nationals. The two countries then ran a joint investigation team for about two years, with Eurojust funding and coordinating it and Europol providing data analysis and a virtual command post. Europol helped secure large volumes of data from the call centres, which will be shared with other countries whose citizens were targeted. More cases may follow outside Austria.
On the action day:
- 10 people were arrested in Tirana
- three call centres and nine homes were searched
- €891,735 in cash was seized, along with 443 computers, 238 mobile phones, 6 laptops and hard drives and DVRs for forensic examination
According to Eurojust, operators worked in teams of six to eight organised by language (German, English, Italian, Greek and Spanish) and targeted their home markets. Each centre had team leaders and a manager. Operators earned about €800 a month plus commission per successful scam. Victims were persuaded to hand money over for "managed" investments. The network also ran a recovery scam: people who had already lost money were contacted again, offered help getting it back, and told to open crypto accounts and deposit €500 to start.
Who is affected
- Retail investors in the EU, especially German-, English-, Italian-, Greek- and Spanish-speaking victims.
- People who have already been scammed, who are deliberately targeted a second time with "recovery" offers.
- Crypto exchanges, neobanks and payment providers that victims are directed to open accounts with and transfer money through.
What it means for developers and engineering teams
The direct technical impact is small, so this section is brief. The ecosystem signal is that investment fraud runs like a sales operation, with language teams, quotas and commissions, and it depends on legitimate financial apps to collect money. That matches the FBI's 2025 data, where investment fraud was the costliest crime category. Teams that build onboarding and payment features control some of the few points where a scam can be interrupted: a victim's first crypto purchase, a first transfer to a new wallet, or a remote-access tool running during a banking session.
The recovery-scam step is worth designing for specifically. Someone who has already lost money and is now opening a new crypto account to pay a €500 "recovery" deposit is in a recognisable situation: a new account, a small first deposit, and an immediate transfer out to a third party. Product teams can't stop every fraud, but they can make that sequence trigger a clear, specific warning.
What to do now
- For fintech and crypto apps, add risk-based friction such as warnings, holds or call-backs on a customer's first large outbound transfer to a new external wallet or IBAN.
- Detect screen-sharing or remote-access apps during sensitive sessions where your platform allows it. Scam "account managers" often guide victims this way.
- Show specific in-app warnings about "recovery" services that charge upfront fees. Real recovery doesn't work that way.
- Share fraud indicators (wallets, IBANs, phone numbers) with industry fraud-sharing groups and law enforcement.
- For your own staff and family: be suspicious of any unsolicited investment offer that comes with a personal "broker."
Related on TechLogHub
- Orisift: phone, email and IP risk checks for signup flows
- TransferIQ: compare remittance and crypto off-ramp routes