Meta removed more than 3.7 million Facebook and Instagram accounts, Pages, and Groups during an international crackdown on West African scam networks that resulted in 28 arrests and the rescue of 117 trafficking victims.
Announced October 13, the operation combined platform enforcement, financial tracing, and physical raids against fraud infrastructure targeting victims worldwide.
Meta and 14 other technology companies joined law enforcement counterparts from ten countries to exchange actionable intelligence across platforms, jurisdictions, and financial systems.
Authorities described it as the first coordinated disruption broadly targeting scam centers in West Africa.
In Sasaabi, an Accra suburb, Ghanaian authorities arrested 19 individuals and seized 303 electronic devices.
Investigators identified 117 trafficking victims awaiting repatriation to Nigeria, alongside 89 fraud victims whose reported losses totaled approximately $8.3 million. Nigerian authorities separately arrested nine suspects and seized 53 devices.
Meta said the trafficking victims had been imprisoned in a residential compound, forced to conduct scams, and subjected to physical and psychological abuse.
Their rescue highlights the dual victimization underlying these operations: financial exploitation of remote targets and coercion of workers compelled to execute the fraud.
Participating agencies included the FBI, U.S. Secret Service, Homeland Security Investigations, Ghanaian and Nigerian authorities, and INTERPOL.
Investigators received leads on more than 30 suspected scam centers, connecting online activity with locations where authorities could pursue operators and preserve evidence.
Justice.gov said that, UK National Crime Agency hosted “Joint Disruption Week” at its London headquarters beginning October 6.
The technical effort extended beyond deleting fraudulent profiles. Silent Push reported mapping more than 35,000 malicious domains, dedicated internet infrastructure, and nearly 700 communication channels associated with African scam centers.
The company said attribution analysis helped investigators connect digital infrastructure to physical locations and operators.
Microsoft suspended accounts suspected of supporting scam activity. TRM Labs traced suspected proceeds, mapped infrastructure behind dozens of fraudulent websites, and reported exposing a peer-to-peer laundering network.
Together, these contributions targeted several operational layers rather than treating individual accounts as isolated abuse incidents.
Meta said most removed assets appeared to target Americans and Britons through profiles impersonating users from those countries.
Meta Researchers said that, the 3.7 million figure covers accounts, Pages, and Groups collectively; it does not represent 3.7 million individual scammers.
Disrupted schemes included cryptocurrency investment fraud, romance scams, fake employment and task offers, military impersonation, non-delivery fraud, and recovery scams.
Authorities also identified law enforcement impersonation and digital “arrest” extortion, where criminals use fabricated official authority to pressure victims into payments.
Private-sector partners identified more than $11 million in potentially freezable funds, according to the Justice Department.
That designation does not establish that the entire amount was frozen, seized, or returned. Separately, Coinbase identified more than 65 active scam victims and prevented over $415,000 in potential losses.
The operation expands a public-private disruption model previously applied to Southeast Asian scam networks.
Meta described West African operations as generally more decentralized and less industrial, requiring investigators to correlate fragmented infrastructure, identities, and payment activity.
The Justice Department said sustained prosecutions remain necessary alongside platform takedowns.
Its Cyber-Enabled Scam Initiative and Scam Center Strike Force will continue pursuing criminal operators, proceeds, and enabling networks, turning intelligence gathered during the disruption into further investigations and accountability.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
A decade-old authentication bypass in OpenSSH on musl-based Linux lets attackers log into accounts that…
Bitdefender researchers have revealed a vulnerability called GhostMap that affects Android devices. This vulnerability can…
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious…
An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is…
Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen…
OpenAI has introduced GPT-6 Cyber, a security-focused model built to find and validate exploitable vulnerabilities…