Hawks led a major global law enforcement raid on multiple syndicate premises in Bryanston and Joburg's northern suburbs
A multi-agency, global law enforcement task team, led by the Directorate for Priority Crime Investigation (Hawks), took down a multi-billion-dollar cybercrime syndicate in Bryanston and Johannesburg’s northern suburbs on Tuesday morning.
It was one of the largest take-downs of its kind in the world.
The seven locations raided simultaneously included a major call centre operation and the homes of senior members of the syndicate.
It is the culmination of a five-year-long investigation into an Israeli-based syndicate that operates a massive global investment and money laundering scam across several markets.
The South African call centre targeted citizens of English-speaking countries such as the United States, Australia, Canada, the United Kingdom and New Zealand.
During the estimated decade of the syndicate’s operations in South Africa, an estimated 20 000 victims of the scam were documented in the United States alone. Sources said the investigation identified thousands more victims across multiple jurisdictions.
Global law enforcement operation
Several suspects, including senior figures and multiple call centre agents, were arrested during the operation.
The investigation initiated in 2022 by the Hawks’ Gauteng Serious Commercial Crime Investigation unit involved a wide-ranging, prosecutorial-guided probe.
The investigation and multi-agency task team was led by the provincial head of the Hawks, Major General Ebrahim Kadwa.
It involved an extensive multidisciplinary team drawn from both local and international law-enforcement agencies, including Crime Intelligence, the Financial Intelligence Centre, the National Prosecuting Authority, Interpol, the United States Department of Homeland Security and its Secret Service, the Australian Federal Police and the United Kingdom’s National Crime Agency. This also formed part of Interpol’s Project Jackal.
The investigation was further supported by private forensic investigators from IRS Forensic Investigations, alongside Australian investigative firms IFW Global and CyberTrace.
Investigators allege that the syndicate operated sophisticated scam call centres from South Africa, staffed primarily by local citizens who assumed aliases when engaging with victims.
The operation relied heavily on social media click-bait advertising promoting fraudulent investment opportunities.
How the operation worked
Chad Thomas of IRS Forensic Investigations said the call centres differed vastly from the Southeast Asian model of luring unsuspecting English speakers into a compound, later trafficking them into forced labour.
“This is not a similar case to Myanmar,” he said. “In South Africa, the call centre operators were complicit, assumed aliases and participated in the whole scam, knowingly.”
Victims were typically targeted as they approached retirement age and were groomed over time. Call centre agents allegedly persuaded victims to make small initial investments that appeared to generate high returns on paper.
Communication then continued across platforms such as WhatsApp, Zoom, Skype and Messenger until victims were convinced to invest substantially larger sums.
ALSO READ: SA prime target for cybercrime
The syndicate is further alleged to have registered multiple companies to lease premises for call centre operations and to open banking facilities.
To evade detection, operations were regularly relocated and company entities frequently changed. Investigators said the operation used professional-looking branding, fabricated press releases, fictitious marketing materials, false testimonials and client login portals to create the appearance of legitimacy.
Global money laundering
Thomas said the syndicate then employed layered money-laundering structures across several jurisdictions.
In one year alone, investigators believe foreign victims were defrauded of more than R1 billion, with hundreds of millions flowing into South Africa to fund the scam operations. International estimates suggest the total value of the fraud may exceed R10 billion.
In one documented case, an elderly medical professional in the United States was defrauded of more than $1 million. The victim was later contacted by a purported recovery company, convinced to pay additional fees and lured to South Africa.
IRS Forensic Investigations identified the situation and alerted authorities, allowing law enforcement agencies to intervene and ensure the victim’s safe return home.
The recovery operation was later established to be an extension of the original scam, a practice commonly referred to as “pig-butchering”.
Major General Kadwa commended the cooperation in a media statement between local and international law enforcement agencies and private-sector partners, describing the takedown as a significant disruption of an entrenched international cybercrime network.
The investigation remains ongoing, with further arrests not ruled out. The suspects are expected to appear before a Gauteng magistrate’s court on Wednesday.
NOW READ: Call centre scams threaten SA
