INTERPOL Operation First Light Nets 5,800 Arrests, $293M Seized

Law enforcement agencies across 97 countries arrested over 5,800 suspects and intercepted nearly $293 million in illicit assets during INTERPOL's Operation First Light 2026, the agency announced this week. The coordinated crackdown targeted social engineering fraud networks running business email compromise, sextortion, romance scams, and cryptocurrency-based money laundering operations.

The operation ran from January 15 through April 30, 2026, making it one of the largest anti-fraud enforcement actions in INTERPOL history.

Operation Results by the Numbers

According to INTERPOL's official announcement:

• 5,811 individuals arrested worldwide
• $293 million in illicit assets intercepted
• 152,808 cases analyzed
• 31,014 bank accounts blocked
• 23,715 cases solved during the operation
• 15,606 suspects identified for further investigation
• 142,000 victims identified globally

INTERPOL issued 99 Notices and Diffusions to facilitate international cooperation and apprehension of fugitives connected to fraud networks.

Notable Cases

Several high-profile takedowns emerged from Operation First Light 2026.

Eswatini: Fake Police Station

In Eswatini, authorities arrested 82 individuals and dismantled a criminal network running illegal online gambling, money laundering, and impersonation scams. Investigators seized 240 electronic devices, foreign currency, and—in a surreal twist—a realistic replica of a Brazilian police station complete with fake uniforms, signage, and equipment.

The replica station was allegedly used to produce convincing impersonation content for scams targeting Portuguese-speaking victims.

Thailand: Crypto Romance Scam Laundering

Thai police made two arrests and uncovered a sophisticated money laundering scheme that funneled proceeds from romance scams through various cryptocurrencies. The operation used cross-chain token swaps to obscure the financial trail.

One suspect, just 20 years old, had processed more than $122.5 million through a single digital wallet in just 10 months.

Singapore-Oman: BEC Interception

Authorities in Singapore and Oman utilized INTERPOL's Global Rapid Intervention of Payments (I-GRIP) system to block a $6.6 million wire transfer linked to a business email compromise attack. The scam targeted a Singapore-based commodity trading firm, with criminals impersonating one of the company's suppliers.

Palau: Crypto Scam Center Shutdown

In Palau, authorities deported 22 individuals who had been operating cryptocurrency-based scam centers from hotel rooms. The operation represented part of a broader pattern of threat actors using legitimate infrastructure to mask criminal activity.

Why This Matters

Social engineering remains the most reliable attack vector because it targets human psychology rather than technical defenses. The $293 million seized represents only a fraction of global fraud losses—the FBI's Internet Crime Complaint Center documented over $10 billion in reported losses for 2023 alone.

The 142,000 victims identified during Operation First Light 2026 underscore the human cost of these schemes. Business email compromise in particular has evolved into a sophisticated threat, with criminals conducting extensive reconnaissance before impersonating executives or suppliers. We covered similar social engineering tactics in recent vishing campaigns targeting Microsoft 365 accounts.

The Thailand case highlights an increasingly common pattern: young suspects handling enormous sums through cryptocurrency infrastructure that didn't exist a decade ago. Cross-chain swaps and privacy coins make tracing stolen funds exponentially harder, turning a $122 million laundering operation into something one person can run from a laptop.

For organizations looking to protect against social engineering attacks, understanding real-world phishing examples and implementing strong verification procedures for financial transfers remains the best defense.

Ongoing Enforcement

Operation First Light builds on previous iterations, with INTERPOL running similar coordinated actions annually. The 2026 operation notably included cryptocurrency-focused enforcement activities that weren't as prominent in earlier years, reflecting law enforcement's growing capability to trace and seize digital assets.

The 15,606 suspects identified but not yet arrested suggests additional enforcement actions will follow as investigators work through the evidence collected during the operation window.

Organizations can protect themselves by:

1. Training employees on social engineering recognition, especially finance teams
2. Implementing callback verification for any wire transfer requests, even from known contacts
3. Monitoring for impersonation of executives and suppliers in communication channels
4. Reviewing cryptocurrency payment policies given the growing use of crypto in fraud schemes
5. Reporting incidents to local law enforcement and national cybercrime units to support operations like First Light

The full scope of Operation First Light 2026 demonstrates that international coordination against cybercrime is possible—but also reveals the scale of the problem law enforcement continues to face.