Security1 publisher2 min readPublished
Germany's Operation Herakles has cut off 13,888 phone numbers used in investment fraud
German authorities led by Karlsruhe's Cybercrime Centre have cut off 13,888 phone numbers used in investment fraud, 9,304 of them in the last three months. They say the shutdowns now run as a standing process that combines criminal, police and telecom-regulatory powers.
The Watch · Security desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- The total splits into 13,397 German numbers and 491 Austrian ones, and details on the Austrian lines are shared with Austria's federal criminal police.
- BaFin, investigating unlicensed cyber-trading business on its own authority, supplied findings that identified many of the suspect numbers.
- The criminal measures target perpetrators who are still unidentified, on suspicion of conspiracy to commit commercial gang fraud.
- Earlier rounds of the campaign took more than 2,200 suspected fraud domains offline in June and October 2025.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Carriers now answer to the Bundesnetzagentur for the compliance of their dealers, so a reseller with weak checks becomes a regulatory problem for the carrier behind it.
- constraint Losing a German number now costs a fraud crew more than the line itself, because its next number has to come through registration steps the regulator ordered tightened.
- precedent With the procedure institutionalized and the agencies committed to further rounds, mass number shutdowns are set to recur in Germany, with Austria already taking part.
The pace has picked up [2]. The 9,304 German numbers cut in the latest three months are about two-thirds of every number switched off since Herakles began [1]. That one quarter is roughly 2.7 times the December 2025 round, when about 3,500 numbers were cut [2][12]. Before it, the German count stood at 4,093 [3].
For a fraud crew, the phone number is the asset that gets cut. The Bundesnetzagentur's orders also go after where the next one comes from [7]. The regulator told the responsible telecom companies to shut down numbers and change their registration processes. Its stated aim is to stop perpetrators registering and using numbers in the first place [7]. It also obliged the carriers to strengthen compliance controls on their sales partners and dealers and to review those resellers more closely [8].
The case for durability rests on what the agencies built [9]. In their joint release of 25 September 2026, they call Herakles the first time they have pursued a coordinated strategic goal: to weaken the criminal infrastructure systematically and push the perpetrators out of German territory [4][10]. Displacement is a different result from arrest. A crew moved off German numbers would meet that goal and could keep operating from elsewhere.
In the agencies' description, cyber-trading fraud has become an industrial-scale mass phenomenon, with case numbers and losses still rising [13]. The release does not give case counts, losses, arrests, or how fast crews replaced the numbers they lost. The Cybercrime Centre and the LKA say they will continue, working with the federal agencies and foreign partners [14].
What to watch
- Bundesnetzagentur enforcement naming specific carriers or dealers, or formal changes to how German numbers are registered.
- Case-count or loss figures from the LKA Baden-Wuerttemberg or BaFin showing whether reported cyber-trading fraud falls after the shutdowns.
- The size of the next shutdown round, and whether partners beyond Austria start contributing numbers.