- CybAfrique Newsletter
- Posts
- How to start a (West) African cybercrime ring/agency
How to start a (West) African cybercrime ring/agency
also ft Operation Serengati 2.0
CybAfriqué is a space for news and analysis on cyber, data, and information security on the African continent.
HIGHLIGHTS
How to start a (West) African cybercrime ring/agency

At CybAfrique, we’re constantly trying to understand how cybercrime works, which often means asking seemingly stupid questions like “How are cybercrime ring leaders voted into office?” and “Do these leaders bosses get stock options?”
Naturally, earlier this month, when three popular Ghanaians were extradited to the US to face cybercrime charges, we had to ask those questions again. Isaac Oduro Boateng (alias Kofi Boat), Inusah Ahmed (alias Pascal), and Derrick Van Yeboah (alias Van) were arrested in June during a joint operation by Interpol and Ghanaian law enforcement. The three, along with Patrick Kwame Asare (alias Borgar), who is still at large, are being accused of being administrators of a criminal enterprise responsible for over 100 million dollars in romance fraud and BEC scam proceeds.
This is derived from tens of conversations with both cybercriminals and law enforcement agencies, but is still definitely not a definitive guide to how (West) African cybercrime rings work. African cybercrime rings can range from the very loose social groups to tightly-knit cult-like groups. But, in the end, these groups are held together by the common goal to obtain illicit funds (with some add-ons), which means “leaders” (or better put, important members) are decided by how much control they have over these money routes.
You know how it goes. You're a "sakawa boy," as they say, kicking it in Accra. You've been working on a target, spinning a tale, and now they're ready to send you ten thousand dollars. The wire transfer is coming; you're about to get paid. Except you can’t receive that money to your local MoMo account.
There are only a handful of ways to turn that wire transfer into usable Ghanaian cedi in your pocket. The first is that you go to the bank, and due to the wonders of Know Your Customer (KYC), the nice teller asks you a few questions. "What's this money for? Who is it from?" You mumble something about a family loan, but the transaction gets flagged. The bank's risk department takes a closer look, the name on the account doesn't match the story, and suddenly, you're not a successful fraudster.
The most popular (definitely not the only) way to move illicit money, it turns out, is through a clean account, belonging to an unsuspecting member of society, which is obtained through another fraud process on its own. Another sakawa boy somewhere will have to scam another unsuspecting member of society to move your money as a gift or something. Then, from that account, the money has to be cashed out to end its digital trail. Because you, the scammer, are in Accra, that hard USD cash has no easy way to reach you. Someone has to put the money in an account again and initiate a clean transfer to your account, but that could be dangerous. If anyone in your ring is caught, their transfers can easily be traced to reach you. They could buy something fancy and have it sent to you to resell, like gold or a sports car. They can also launder the money into crypto and send you some bitcoin, which you can exchange for money.
At this point, you get the point; there’s enough decision and connection to be made that someone needs to be a leader. Someone has to connect the fraudster with a gullible sender to the one with a gullible receiver. Someone has to connect with the cash receiver, instruct them on the best route to re-insert that money into the global economy, and figure out the best mechanism to turn that money into clean usable cash so you, the sakawa boy in Accra, whose victim just sent some ten grand, have some money in your cedis account. That person also has to make sure everyone on the route gets their cut.
Usually, that person starts as a fraud themselves, could even be you, the game boy in Accra, playing a small part somewhere on that complicated route. Then you meet someone who can do this and another who can do that. Voila, you have a ring, complete with you as a leader. In the past, the world has enough fear and loyalty that this ring could be a tightly-knit occult group with a leader who plays an intentional role in how scams happen and how the money is moved — and this still happens in small spaces like pig butchering rings, violence-supported cybercrime gangs, and state-run actors — but all thanks to science and universal enforcement of human rights, you’d usually be less a leader of a cybercrime gang and more of the owner of a cybercrime agency that connects these dots and take a significant but market-influenced cut off the money. You also depend on good reviews and being socially active to ensure that clients keep coming. Soon, you will graduate from running ten grand romance scam transactions to 100-grand BEC scams. Lord knows how much you’ll charge for those.
The FBI does not care about your agency, however. When the police come knocking, they will name you as the leader of a cybercrime ring full of people you’ve probably never met and don’t know their first name.
Kofi Boat, known popularly as a “businessman,” philanthropist, and friend to Ghanaian music star Shatta Wale, is perhaps the most prominent of the extradited, followed by Pascal, also a “businessman” and owner of the football club PAC Academy.
In July, Joseph Badu Boateng, another popular Ghanaian, was arrested and extradited to face cybercrime charges in the US. Last year, three Ghanaians were sentenced for fraud in Florida. The parallel between this period and Nigeria’s post-pandemic high-profile arrests draws itself. At least 20 Ghanaians have been arrested and extradited to the US to face cybercrime charges since 2021, according to local media.
Share to prevent Interpol from finding out about your cybercrime agency??
FEATURES
African authorities, with coordination from INTERPOL, have successfully dismantled significant cybercrime and fraud networks in another Operation Serengeti (tagged2.0), resulting in the arrest of 1,209 cybercriminals and the recovery of approximately USD 97.4 million. Follow up here
This paper highlights how AI is used by both ethical hackers and malicious actors. Ethical hackers leverage AI to improve threat detection and vulnerability discovery, while malicious actors use it to create advanced malware and automate sophisticated attacks like phishing and ransomware. Read more
HEADLINES
Coalition urges NUC to crack down on social media ‘universities.
Egypt rounds up teenage TikTokers in a crackdown on social media.
Wike’s aide proposes mandatory NIN, ID for social media accounts.
Nigeria introduces a data exchange platform to end repeated data submissions by citizens.
T2 signs multi-million-dollar deal with Huawei to modernize core network across Nigeria
Cyber-threat surge across Africa drives focus to Nigerian summit.
Nigerian telcos push for tougher penalties as fibre vandalism surges.
Kaspersky highlights changes in the cyberthreat landscape across Africa.
FNB warns against fraudsters selling business accounts to non-residents
ANCY-Togo announces the official start of certified cybersecurity training courses.
Reply