Interpol announced on 22 October that Operation Serengeti III led to 1,462 arrests, against losses it puts above $385 million.
Authorities recovered more than $105 million. That is real money back in real accounts, and the investigators deserve credit. It is also a measure of what the criminals lost, not of what your business is protected from.
Recovery is not resilience
The operation ran from 29 June to 31 August. Interpol reports 10,909 networks dismantled and 65,929 victims identified.
Those are large numbers. They describe the work of police after the money has moved. A board cannot rely on that sequence.
The $105 million recovered sits beside losses above $385 million. Recovery is partial, slow and outside your control. A company that waits for an arrest to get its money back is making a bet it does not control.
Where the risk sits in your own business
Per the reporting from The Record and BleepingComputer, one Nigerian suspect allegedly ran phishing and business email compromise campaigns and collected about 2.1 million email addresses.
Consider what that list is. It is a catalogue of inboxes, and some of them sit inside finance teams and supplier desks. One stolen credential is enough to start a payment-diversion fraud.
Uganda recorded 365 arrests, the largest single arrest figure Interpol highlighted, tied to investment and pension fraud. The fraud types differ. The common thread is that attackers go after people who can move money or approve it.
This is the micro layer of the risk. One person, one credential, one payment instruction. The meso layer is the supplier and finance workflow around that person. A fraudulent invoice from a hijacked supplier mailbox travels through your approval chain looking legitimate.
Detection is not protection. Containment is. The question is what stops a stolen credential from becoming a completed payment.
What boards should ask
Ask management four plain questions.
First, how many people can change supplier bank details, and what second check applies when they do?
Second, how quickly can the business revoke a compromised mailbox session, and has anyone tested it?
Third, what is the agreed route for calling a bank to recall a payment, and who holds the authority to start it at night or on a weekend?
Fourth, how do you know your people can spot a convincing request? Behaviour measurement beats an annual training attendance figure.
None of these needs new technology to ask. All of them expose whether controls exist in practice or only on paper.
A caution on reading the headlines
South Africa is listed among the 21 participating countries, according to Sahara Reporters, citing Interpol. The sources do not break down South African arrests, so do not read the result as local reassurance. The picture the reporting gives is regional, not specific to us.
The macro layer is the lesson here. Organised fraud operates across borders at scale, and enforcement follows slowly. Even a successful operation leaves most losses unrecovered.
Treat the arrests as good news about the criminals' risk, and nothing more. They do not change your exposure on Monday morning.
The action
Pick one payment route this quarter. Trace it from supplier email to bank release. Mark every point where a single stolen login could redirect funds, then add a check that does not rely on that same inbox.
Report the result to the audit and risk committee in plain terms: where the money could leave, and what stops it. That is a resilience measure. An arrest count is not.
Gap flagged: the sources list South Africa as a participant but give no South African arrest figures, so this piece makes no claim on its share of the results.