INTERPOL has published the results of Operation Serengeti III, one of Africa’s largest cybercrime enforcement operations. Law enforcement agencies from 21 countries arrested 1,462 suspects, disrupted 10,909 malicious networks and recovered more than USD 105 million in illicit funds between 29 June and 31 August 2026. The operation targeted cyber-enabled fraud, ransomware, business email compromise, online scams and digital extortion. Investigators identified 65,929 victims, and financial investigations linked criminal activity to losses exceeding USD 385 million.
The email thread running through the operation
The most relevant case for anyone who runs email is in Nigeria. Authorities there arrested a suspect behind a large-scale phishing and business email compromise operation that harvested software credentials and amassed approximately 2.1 million email addresses. A stolen address list like that is raw material for future campaigns, because a verified list of real inboxes is the first thing a fraudster needs before selecting targets, impersonating a supplier or crafting a payment-diversion story.
Business email compromise did not appear in a single headline statistic, but it was one of the operation’s named target categories, alongside ransomware and online scams. BEC lives and dies by impersonation. The attacker either takes over a real mailbox or spoofs a domain that the victim already trusts, then inserts a plausible request at exactly the right moment. That is precisely the attack that domain-level email authentication exists to stop.
What the report says about AI
INTERPOL paired the announcement with its African Cyber Threat Assessment Report 2026, which points to artificial intelligence increasingly enabling cybercrime activity across the continent and cyber-enabled financial losses continuing to rise. That matters for email defense because AI lowers the cost of writing convincing fraud messages in any language. When the writing is flawless and the timing is right, the technical origin of the message becomes the last trustworthy signal.
Why DMARC is the control that fits this threat
A DMARC policy at enforcement stops the domain spoofing that BEC depends on. When your domain publishes SPF and DKIM and a DMARC policy at quarantine or reject, a criminal cannot send a message that claims to be from your domain and expect it to reach an inbox. INTERPOL’s intelligence sharing around suspicious domains and infrastructure helps dismantle criminal networks after the fact, but DMARC prevents the impersonation from working in the first place.
For legitimate senders the same control protects deliverability. Mailbox providers increasingly require authentication, and a domain that never moves past p=none gives attackers an open lane while giving its own marketing and transactional mail nothing to prove it is genuine.
Criminal networks harvested millions of addresses because unauthenticated email makes impersonation cheap. Excello Mail maps every legitimate sending source for your domains and takes you to full DMARC enforcement without breaking real mail. Sign up for free to Excello Mail and make sure your domain is never the mask for someone else’s fraud.