INTERPOL's African cybercrime crackdown: lessons for SA businesses

23 October 2026 · Orlik IT

This week INTERPOL announced the results of Operation Serengeti III, a cybercrime crackdown across 21 countries, including South Africa. Between 29 June and 31 August 2026, police arrested 1,462 suspects and recovered more than USD 105 million. The arrests are good news, but the operation also shows how much fraud is aimed at ordinary businesses and their staff.

What happened

INTERPOL says the operation targeted cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion. Across the participating countries, investigators disrupted 10,909 malicious networks and identified 65,929 victims, with linked losses of more than USD 385 million.

Two cases stand out for business owners:

• In Nigeria, one suspect was arrested over a phishing and BEC operation that harvested software logins and built up a list of about 2.1 million email addresses.
• A separate investment fraud scheme promoted through messaging apps was linked to more than USD 2.4 million in suspected proceeds, much of it allegedly laundered through cryptocurrency.

INTERPOL lists South Africa as a participant but has not published South Africa-specific figures. It also notes that investigations are continuing and that its 2026 African Cyber Threat Assessment found AI is increasingly enabling cybercrime on the continent.

Why it matters to your business

Business email compromise is the scam most likely to reach a small or medium business. Criminals get into a mailbox, or set up a look-alike address, and send a convincing email asking you to pay an invoice into a "new" bank account. They often wait until a real deal or payment run is happening, so the request looks routine. One fraudulent payment can wipe out a month's profit. Arrests like these take some criminals out of play, but the methods and the stolen email lists stay in circulation.

Practical steps to take this week

1. Lock down bank detail changes

• Never accept a change in a supplier's banking details by email alone. Phone the supplier on a number you already have on file, not one in the email.
• Use your bank's account verification service before paying a new or changed account.
• Make a rule that a second person approves any first payment to a new account.

2. Protect your mailboxes

• Turn on multi-factor authentication (MFA) for every Microsoft 365 or Google Workspace account, including shared and admin accounts.
• Check for mailbox rules you didn't create, especially rules that forward email outside the company or hide messages. Attackers often add these to stay hidden.
• Make sure SPF, DKIM and DMARC are set up on your domain so it is harder for criminals to send email pretending to be you.

3. Brief your staff

• Remind finance and admin staff that urgency, secrecy and "new banking details" together are a warning sign.
• Treat requests on WhatsApp or other messaging apps with the same care as email, especially messages that claim to be from a director.
• Be wary of investment "opportunities" pushed through messaging groups. If it promises unusually high returns, walk away.

4. Know what to do if it happens

• Phone your bank immediately. The faster a fraudulent payment is reported, the better the chance of stopping it.
• Change the passwords on any affected accounts, sign out all sessions and check for new mailbox rules.
• Report the incident to SAPS. If personal information may have been exposed, consider your obligations under POPIA to notify the Information Regulator and affected people.

The bottom line

Operations like Serengeti III show that police across Africa are working together and having real success. Your best defence is still simple: verify payment changes by phone, use MFA on every account, and make sure staff feel comfortable stopping to ask before they pay.