City of London Police disrupt online fraud groups as part of international crackdown with 31 arrested

The City of London Police, working alongside the Cyber Defence Alliance (CDA), National Crime Agency (NCA), the banking sector and The National Cybercrime Centre (NPF-NCCC) of the Nigeria Police Force has led a major intelligence-led fraud operation.

Funded as part of Henhouse 5, a national intensification on fraud, Operation Seraphim forms part of a coordinated national effort to identify and disrupt criminals using online platforms and enabling technologies to commit fraud. The operation has brought together policing teams across the UK, including Regional Organised Crime Units (ROCUs), to take targeted enforcement action against suspects within a short time period.

At the heart of the operation is a proactive, intelligence-led approach designed to identify offenders earlier, build a clearer picture of the threat, and prevent further harm to victims.

Detective Inspector Joel Gregory, from the Intelligence Development Team at the City of London Police, said:

“This operation highlights what can be achieved when law enforcement, industry and international partners come together with a shared purpose. The scale and complexity of online fraud means no single organisation can tackle it alone, but through this joint effort we’ve been able to identify offenders, build intelligence and take coordinated action.

“This has been a significant team effort across multiple agencies, and it sends a clear message to those involved in fraud that we are actively monitoring these spaces and will take action to disrupt and pursue them.”

Craig Rice, CEO of the Cyber Defence Alliance, said:

“Operation Seraphim represents a significant evolution in collaborative intelligence-led law enforcement support. For the first time, investigators from the Cyber Defence Alliance and detectives from the City of London Police worked side-by-side in a fully integrated operational environment to identify, analyse and target high-harm individuals responsible for exploiting victims across the UK and Europe.

“Engaging with additional law enforcement partners, the reach of this operation extended across the UK and to high-threat criminals targeting the UK operating from West Africa. This demonstrates both the capability and determination of this public–private operational partnership. It also establishes a new benchmark for ambition, integration and impact in joint operations between law enforcement and industry in tackling serious organised cyber-enabled fraud and financial crime.”

Working closely with the CDA, the City of London Police analysed large volumes of data linked to online environments associated with fraudulent activity. Using enhanced automation alongside expert analytical assessment, the partnership identified hundreds of online accounts believed to be involved in facilitating fraud, with many assessed as having links to the UK.

The fraud identified through the operation centred on individuals using online platforms and private messaging groups to facilitate and enable large-scale fraud. These groups were used to share tools, techniques and services linked to criminal activity, including methods to deceive victims and move illicit funds.

Offenders operated under anonymous online identities, often collaborating within these groups to support scams such as impersonation fraud, account takeover and money laundering. In some cases, they provided access to compromised data, spoofing tools or “fraud-as-a-service” offerings to others, enabling wider offending.

The operation also extended internationally. Working with law enforcement partners in Nigeria, activity was undertaken to identify devices believed to be used in fraudulent activity, including the tracing and analysis of handsets linked to suspected offenders. This collaboration reflects the increasingly global nature of fraud and the importance of working across borders to tackle it effectively.

In total, the operation resulted in 31 arrests, with further investigative opportunities continuing both in the UK and overseas.

Alongside enforcement, prevention has been a key focus throughout the operation. As part of innovative disruption activity, AI-generated videos were shared across social media. These videos were designed to act as a deterrent, delivering a clear message that involvement in criminal activity has far reaching consequences and that law enforcement is aware of those involved. The approach is aimed to interrupt offending behaviour at source and prevent individuals from continuing to engage in fraud.

Collaboration with the banking sector has also been central to the operation. Financial institutions play a critical role in identifying suspicious transactions, preventing fraudulent payments and supporting the wider effort to protect customers from financial harm.

The City of London Police continue to work closely with policing partners, industry and international agencies to tackle fraud at scale, disrupt criminal networks and protect the public from increasingly sophisticated threats.

Screenshot of one of the AI videos posted on social media