Operation Seraphim disrupts major online fraud network

Funded as part of Henhouse 5, which heralds a national intensification on fraud, Operation Seraphim forms part of a co-ordinated national effort to identify and disrupt those criminals using online platforms and enabling technologies in order to commit fraud.

Operation Seraphim has brought together policing teams across the UK, including Regional Organised Crime Units, to take targeted enforcement action against suspects within a short time period.

At the heart of Operation Seraphim is a proactive and intelligence-led approach designed to identify offenders earlier, build a clearer picture of the threat and prevent further harm to victims.

Large volumes of data

Working closely with the Cyber Defence Alliance, the City of London Police analysed large volumes of data linked to online environments associated with fraudulent activity. Using enhanced automation alongside expert analytical assessment, the partnership identified hundreds of online accounts believed to be involved in facilitating fraud, with many assessed as having links to the UK.

The fraud identified through the operation centred on individuals using online platforms and private messaging groups to facilitate and enable large-scale fraud. These groups were used to share tools, techniques and services linked to criminal activity, including methods to deceive victims and move illicit funds.

Offenders operated under anonymous online identities, often collaborating within these groups to support scams such as impersonation fraud, account takeover and money laundering. In some cases, they provided access to compromised data, spoofing tools or ‘Fraud-as-a-Service’ offerings to others, thereby enabling wider offending.

The operation also extended internationally. Working with law enforcement partners in Nigeria, activity was undertaken to identify devices believed to be used in fraudulent activity, including the tracing and analysis of handsets linked to suspected offenders. This collaboration reflects the increasingly global nature of fraud and the importance of working across borders to tackle it effectively.

In total, the operation resulted in 31 arrests, with further investigative opportunities continuing both in the UK and overseas.

Shared purpose 

Detective Inspector Joel Gregory from the Intelligence Development team at the City of London Police, said: “This operation highlights what can be achieved when law enforcement, industry and international partners join forces with a shared purpose. The scale and complexity of online fraud means that no single organisation can tackle it alone, but through this joint effort we’ve been able to identify offenders, build intelligence and take co-ordinated action.”

Gregory added: “This has been a significant team effort across multiple agencies. Operation Seraphim sends a clear message to those involved in fraud that we are actively monitoring these spaces and will take action to disrupt and pursue them.”

Craig Rice, CEO of the Cyber Defence Alliance, explained: “Operation Seraphim represents a significant evolution in collaborative intelligence-led law enforcement support. For the first time, investigators from the Cyber Defence Alliance and detectives from the City of London Police worked side-by-side in a fully integrated operational environment to identify, analyse and target high-harm individuals responsible for exploiting victims across the UK and Europe.”

Further, Rice observed: “Engaging with additional law enforcement partners, the reach of this operation extended across the UK and to high-threat criminals targeting the UK operating from West Africa. This demonstrates both the capability and determination of this public–private operational partnership. It also establishes a new benchmark for ambition, integration and impact in joint operations between law enforcement and industry in tackling serious organised cyber-enabled fraud and financial crime.”

Focus on prevention 

Alongside enforcement, prevention has been a key focus throughout the operation. As part of innovative disruption activity, Artificial Intelligence-generated videos were shared across social media. These videos were designed to act as a deterrent, delivering a clear message that involvement in criminal activity has far reaching consequences and that law enforcement is aware of those involved. The approach is aimed at interrupting offending behaviour at source and preventing individuals from continuing to engage in fraud.

Collaboration with the banking sector has also been central to Operation Seraphim. Financial institutions play a critical role in identifying suspicious transactions, preventing fraudulent payments and supporting the wider effort to protect customers from financial harm.

The City of London Police continues to work closely with policing partners, industry and international agencies to tackle fraud at scale, disrupt criminal networks and protect the public from increasingly sophisticated threats.

*Further information is available online at www.reportfraud.police.uk