The UAE Traced US$39 Billion in Fraud-Linked Assets. That Is Not Money Recovered

The UAE says its three-month international fraud operation identified more than US$39 billion in assets linked to scams. That is not the amount investigators have recovered.

Operation Confrontation Ghost, led by the UAE Ministry of Interior, ran from 1 July to 30 September 2026 across a coalition of 30 countries, INTERPOL, the Global Anti-Scam Alliance and 13 private-sector partners. Authorities reported more than 960 arrests, more than 3,500 suspects identified and 15,500 victims identified. They also reported 123.71 million online fraud attempts thwarted worldwide.

The scale deserves attention. But four different things appear in these figures: assets traced, attempts stopped, people identified and enforcement actions taken. Mixing them creates a more dramatic headline and a less accurate understanding of what the operation achieved.

The US$39 billion was identified, not recovered

The official account describes more than US$39 billion in funds and digital assets linked to fraudulent activity. It says participating authorities and private-sector partners are working toward recovery. It does not say the entire amount was seized, returned to victims or held in court-controlled accounts.

That distinction is the centre of the story. Financial tracing can identify suspected flows, wallets and accounts long before a court can freeze assets or a victim can recover money. Some assets may move through multiple addresses or accounts. The gross value of linked transactions is also not necessarily the same as net criminal proceeds.

Until a recovery schedule and audited asset breakdown are published, Robius will not treat US$39 billion as cash recovered or losses reimbursed.

123.71 million attempts are not 123.71 million people

The Ministry said the operation thwarted more than 123.71 million online fraud attempts. It did not publish the event-counting method or state that every attempt represented a separate person, scam campaign or would-be loss.

Modern fraud systems generate enormous numbers of contacts, redirects, bot requests, malicious messages and payment attempts. One network can produce many events aimed at the same individual. Blocking an attempt is useful, but that total cannot safely be converted into a number of unique victims saved.

The independently meaningful count is narrower: authorities reported identifying more than 15,500 victims. Even that number is not a measure of all worldwide fraud victims during the period, only those associated with the reported operation.

What the operation actually did

The public results contain several concrete enforcement measures:

• more than 960 defendants arrested;
• more than 3,500 suspects identified;
• 4,126 bank accounts blocked;
• more than 570 social-media accounts closed;
• 29 fraud centres raided;
• more than 9,000 pieces of intelligence exchanged.

Those measures show why the operation was multinational rather than a single police campaign. An online scam can originate in one country, use an account in another, target someone elsewhere and convert proceeds through additional jurisdictions.

Officials say the operation focused on AI-enabled fraud, financial fraud via digital platforms and online sextortion. Those categories overlap in practice, but they require different interventions: platform disruption, bank-account action, victim support and criminal investigation.

Why the private partners matter

The official partner list includes Meta, TikTok, Mastercard, Crypto.com, Group-IB, Feedzai, Trend Micro, Huawei, Outseer, Bayut, dubizzle and others.

That mix is revealing. Fraud no longer lives solely inside a banking or police database. It can begin on a marketplace, migrate into messaging, use identity or phone-number compromise, trigger a card payment and end in a virtual-asset transfer.

Robius examined a similar chain in the GCC government-bill discount scam, where criminals used stolen cards to pay genuine bills and then collected discounted payments from customers. An official government portal was one stage in the criminal process, not proof the funding source was legitimate.

Likewise, Sharjah Police’s investigation of connected cybercrime networks demonstrated why wallet movement, identity theft, compromised data and cross-border coordination must be analysed together.

The unproven part is the recovery chain

The headline figures leave unanswered questions that matter to victims and policymakers:

• What portion of the US$39 billion has been frozen, seized or returned?
• How many victims have actually received restitution?
• How were attempted fraud events counted and deduplicated?
• How many arrests have resulted in charges, convictions or asset-recovery orders?
• What happens when assets are traced but remain outside the enforcing jurisdiction?

A successful disruption does not automatically mean the money comes back. The recovery process may involve competing claims, cross-border court orders, proof of ownership and years of litigation.

A victim still needs to act locally

This global operation does not replace individual reporting. Someone who has transferred money to a scammer should contact their bank or payment provider promptly, preserve transaction references and report through the applicable police channel. Delay can reduce the chance of freezing funds before they move again.

Robius maintains a practical UAE guide to contacting banks, police and Sanadak after a scam. Our roundup of repeating UAE scam mechanics also explains how to recognise the same pressure tactics when the brands and message formats change.

For people facing online sextortion, preserving evidence and reporting coercion is more important than negotiating with the person making threats. Victim identification should lead to support as well as enforcement.

What better reporting would look like

Future updates would be more useful if they separated suspected asset flows, amounts under freezing orders, recovered sums and completed victim reimbursement. They should also distinguish malicious events blocked by platforms from unique targets protected and disclose how overlapping partner counts were reconciled.

The operation’s scale is impressive enough without collapsing those different categories into one number.

The Robius Read

Confrontation Ghost demonstrates the advantage of connecting banks, platforms, threat-intelligence firms and law enforcement across borders. Scammers exploit the gaps between those systems. The operation tried to close them.

But the headline should be read precisely. US$39 billion is the value of assets identified as linked to fraud; 123.71 million represents reported attempts thwarted; 960-plus refers to arrests. None of these alone tells us how much victims got back.

The next milestone should not be a bigger detection counter. It should be a transparent recovery report showing what happened to the money.

Sources

• Emirates News Agency: Official Operation Confrontation Ghost results, 21 October 2026
• UAE Ministry of Interior: International operation release, 22 October 2026
• The National: Enforcement-operation reporting, 22 October 2026

Checked 23 October 2026. Asset identification is not asset recovery. Counts of blocked fraud attempts are not counts of unique victims.

Robius.news | Dubai, UAE | 2026 | Built to be first. Built to be trusted.