Jackal IV's arithmetic: three quarters of the suspects sat with the vendors, not the syndicate

Two things a romance or investment fraud crew cannot improvise are somewhere for the fake broker to live and a route that turns a victim's transfer into spendable money. INTERPOL describes that as procurement rather than tradecraft: some of the syndicates were observed buying money laundering and other critical operations from external providers, often through the dark web ^[7]. Argentina's share of Jackal IV puts a ratio on the arrangement. Its officers produced roughly eleven identifications of people tied to a single domains-and-laundering network for every arrest they made ^[13], and that one network accounted for about three quarters of the suspects the whole 22-country operation identified ^[12].

Read the other national results as customer accounts and they shrink. Romania's arrests came out of a call center that baited victims with promised returns on stocks and cryptocurrency ^[6], which is labour: staff, scripts, phone lines. Italy identified a single suspect inside a pan-European laundering network that moved money through shell companies, remittance services and cash withdrawals ^[8]. One person, an entire set of rails.

The accounting problem is that vendor work does not generate headline figures. INTERPOL's Operation First Light 2026, announced in July, reported 5,811 arrests and $293 million seized across 97 countries ^[11]. The only recovery disclosed for Jackal IV, South Africa's $2.67 million ^[5], comes to about nine tenths of one percent of that seizure total ^[16]. The gap is not a measure of effort. Sweeping operators is countable inside one reporting period; establishing which providers sat behind the domains and the accounts ran from November 2025 to June 2026 ^[2] and ends in a list of names rather than a docket.

Black Axe is the name in the release, credited with global-scale cyber-enabled fraud built on romance scams, crypto and investment fraud, and business email compromise ^[3]. On INTERPOL's own account, groups of that type are increasingly the buyers rather than the builders ^[7]. The single intervention here that took working capacity out of circulation was South Africa blocking 257 bank accounts ^[5], because a blocked account cannot be re-staffed and an arrested operator can. That puts the durable lever in the payment estate rather than the warrant. If the supplier keeps its domains and its laundering channels, the crew that replaces this one does not rebuild anything. It re-orders.