Between 1 July and 30 September 2026, police and prosecutors in thirty countries, two international organisations and thirteen technology, platform and payments companies ran a single coordinated operation against online fraud. Led by the UAE Ministry of Interior under the name Operation Confrontation Ghost, it ended with more than 960 arrests, more than 3,500 suspects identified, 4,126 bank accounts blocked, 29 fraud centres raided and more than US$39 billion in funds and digital assets traced to fraud, according to the results announced in Vienna on the margins of the conference of the parties to the UN Convention against Transnational Organised Crime. Over the same three months, the participants say, 123.71 million online fraud attempts were stopped before they reached a victim.
The figures are newsworthy on their own. The more useful story is how they were produced. None of the capabilities involved was new. What was new was that thirty governments, two international bodies and thirteen private companies used them together, against the same targets, and shared what each could see. For boards and compliance leaders, that is the lesson worth taking.
Fraud is built to cross borders
Modern scams are designed around the seams between jurisdictions. A victim in one country receives a message from an account registered in a second, is talked into a transfer by an operator in a compound in a third, and the money lands in an account in a fourth before moving into cryptocurrency and out of reach. Each actor sees only a fragment: the platform an account behaving oddly, the bank an unusual payment, the victim's police force a report with nowhere to send it, the country hosting the compound a business park.
The three crime types the operation targeted, AI-enabled fraud, financial fraud through digital platforms and online sextortion, all depend on those seams. They are run at industrial scale from centres that recruit and script their workers, buy advertising on legitimate platforms, and launder through mule accounts opened in the names of people who may themselves have been deceived. The FATF has recognised the shift: at its February 2026 plenary it made fraud a priority for the coming years, and in June it approved a global overview of public and private sector partnerships and the data protection arrangements that let them work.
Against a crime built this way, a control that stops at the border of one institution or one country has a hole in it. The question is not whether a bank, a platform or a police force does its own job well, but whether the pieces each holds can be put together quickly enough to matter.
Three things the operation got right
International cooperation with a single point of coordination. Thirty countries took part, from the UAE, Kuwait, Bahrain and Jordan to the Philippines, Myanmar, Indonesia, Kenya, Senegal, Brazil, Canada and much of Europe, alongside INTERPOL and the Global Anti-Scam Alliance. The list mirrors the geography of the crime: where victims live, where the money is received and where the centres operate. Coordination through one lead ministry, using INTERPOL's channels, meant a lead developed in one place could be acted on in another within the life of the operation rather than after it.
A public private partnership that included the people who see the activity first. The thirteen private participants span the places a scam touches: Meta and TikTok, where the approach is made; Bayut and dubizzle, the classifieds and property platforms whose listings are used as bait; Mastercard, Crypto.com and the anti-fraud specialists Feedzai, Outseer, Group-IB and Trend Micro, who see the payment, the device and the infrastructure; and technology providers such as Huawei. Between them they could close more than 570 social media accounts linked to fraud, block the bank accounts receiving the proceeds, and prevent millions of attempts from reaching anyone. Tokenisation alone, the participants report, now protects more than four billion payment transactions a month. No police force can see any of that on its own.
Information sharing that was fast, structured and two-way. More than 9,000 pieces of intelligence were exchanged. Colonel Dana Al Marzouqi, Director General of the International Affairs Bureau at the UAE Ministry of Interior, described real-time sharing as the mechanism that allowed suspicious activity to be detected and illicit flows traced. The phrase to notice is real-time. Intelligence about a mule account is worth a great deal in the hour after the victim's payment and almost nothing a month later, once the funds have passed through a dozen wallets. The exchange ran at the speed of the payment system rather than the speed of a mutual legal assistance request.
What effective and efficient sharing looks like
Every financial crime strategy of the last five years calls for better information sharing. Fewer explain what makes it effective. From this operation, and from arrangements that already work in the United Kingdom, Singapore, the Netherlands and the Gulf, five features stand out.
- Speed measured in hours. The useful metric is the time from a victim's report, or a platform's detection, to the freezing of the receiving account. Arrangements that route everything through formal requests and batch reporting cannot meet it. Those that work give trusted participants a direct channel and a duty to act on what they receive.
- A common language. Intelligence is usable when participants agree what a report contains: indicators, account and wallet identifiers, typology, confidence. Standard formats let a bank's monitoring consume a platform's alert without retyping, and let an analyst match reports across a hundred institutions.
- A legal basis that people trust. Sharing fails when a compliance officer is unsure whether passing a customer's details to a peer bank is lawful. FATF Recommendation 2, as revised in 2022, asks countries to make data protection and information sharing coexist, and the FATF's 2026 overview shows how jurisdictions have done it. Institutions should know in writing what they may share, with whom and under which gateway, so the decision is made once in policy rather than every time at the desk.
- Feedback in both directions. The private sector shares more, and better, when it learns what happened to what it shared. Reporting back which alerts led to arrests or frozen funds sharpens the next round. One-way reporting into a system that never answers produces volume rather than quality.
- Prevention counted alongside enforcement. The arrests will draw the headlines, but 123 million blocked attempts protected far more people than any prosecution will. Arrangements should be judged on what they prevent: advertisements removed, accounts closed before a payment arrived, mule accounts caught at onboarding.
What this means for institutions in the Gulf
The UAE's decision to lead an operation of this size, and to announce it at a United Nations forum, signals where supervisory expectations are heading. Dr Monica Kathina Juma, Executive Director of the UN Office on Drugs and Crime, called it a model of international cooperation and asked for continued improvement in countermeasures against fraud driven by AI and digital technology. Boards should assume that supervisors will ask how their institution takes part in that effort, and will expect a better answer than the suspicious transaction reports filed last year.
Four practical questions follow. First, can the institution act on external intelligence within hours? That needs a staffed intake point, a procedure that allows an account to be restricted on credible intelligence before an investigation is complete, and monitoring that can apply an outside indicator to its own customers the same day. Second, does the institution treat inbound funds as its problem? A bank receiving fraud proceeds into a mule account is part of the chain, and regulators in Qatar already require banks to share data with the police where fraudulent funds have been received, whether or not the bank was the victim. Mule detection is now a core fraud control, not an AML afterthought. Third, do fraud, AML and cyber work from one picture? Intelligence that lands in one of three separate teams is often too late by the time it reaches the one that can stop the payment. Fourth, is the institution in the room? Partnerships in the region are developing quickly, and those who join early shape how they work and receive intelligence first.
Where the limits are
A three-month operation is a demonstration, not a system. Sustaining its results needs standing arrangements, with funding, governance and legal cover, that outlast a single campaign. Sharing between private companies across borders is still constrained by data protection and banking secrecy rules, and recovering the US$39 billion identified will take years and will test the mutual legal assistance machinery the operation largely bypassed. None of this undermines the lesson. It defines the work still to do.
Questions for the board
- How long does it take us to restrict an account once we receive credible intelligence from a peer, a platform or the police, and who can authorise it out of hours?
- Which public private partnerships and intelligence-sharing arrangements are we part of, what have we contributed in the last year, and what have we received?
- Do our policies state clearly what customer information we may share with other institutions and authorities to prevent fraud, and under which legal gateway?
- How many mule accounts did we detect at onboarding and through monitoring in the last twelve months, and how many did we learn about only from another institution?
- What do we measure: alerts reviewed and reports filed, or attempts prevented, funds recovered and victims protected?
Operation Confrontation Ghost showed what thirty countries and thirteen companies can do in ninety days when they decide to act as one. The institutions that benefit most from the next operation will be those that built the connections, the procedures and the habits before it began.