Operation Mirage: the investment scam has an org chart, a quota and a call center

On 15 July, the Civil Police of Pernambuco launched Operation Mirage and arrested 13 people who, according to investigators, were running fake investment scams out of a call center set up in a commercial building in Recife. The arrests in flagrante were converted into pretrial detention, and the case was presented to the press on 21 July.

What makes the case worth reading closely isn't the amount. It's the format.

This wasn't a scammer. It was an office

According to the Civil Police, the group operated out of a fixed commercial address, with a call center setup and a division of roles. The investigation began in 2024, after one victim reported losses exceeding R$ 1.5 million, and identified other injured parties as it progressed. Also according to police, the group worked toward a monthly target for illicit proceeds, in the region of R$ 800,000.

The monthly target is the most telling detail. A target presupposes predictability, and predictability presupposes method — an approach script, tested arguments, known stages. Nobody sets a quota for something that depends on luck.

Investigators also found documents indicating an intent to relocate part of the operation to Mexico, with flights and accommodation already booked. An operation that plans to change countries is an operation that sees itself as a going concern, not as a one-off scam.

The central trick, as described by police

The most instructive part of the case is the mechanism. According to the investigation, the platform mimicked stock market and cryptocurrency trading, and the group allowed small withdrawals by victims — presented as profit, but paid out of the money the victim had deposited in the first place. After that, contributions were progressively increased.

This is precisely the stage we described in the anatomy of the crypto fake investment scam: the withdrawal that works. It is the cheapest investment the operator makes and the one that unlocks everything that follows, because it changes the nature of the victim's decision — she stops evaluating a promise and starts evaluating an experience of her own.

One point that coverage of cases like this almost always leaves out is worth stressing: the victim who puts in more after a successful withdrawal isn't being naive. She is responding to evidence she produced herself — evidence that was manufactured in order to exist.

Why the structure matters more than the amount

When a case like this makes the news, the headline usually leads with the sum. The figure is striking and tells you little.

What tells you something is the structure, and in practice it changes three things:

Scale is the objective, not an accident. A call center with a quota works dozens of victims in parallel. Whoever received the approach wasn't chosen — they were reached by a process designed to reach a great many people.

Rotating front brands is part of the model. A structure like this doesn't depend on the brand it uses today. Shut down one platform and another goes up — which explains why fighting these schemes name by name has limited effect.

Mobility is planned. When a group already has tickets booked to another country, the window to reach the funds is short. That reinforces something we keep insisting on here: in digital fraud, what you preserve in the first hours is worth more than any measure taken weeks later.

For the reader who recognized the description

If the sequence above sounded familiar — the platform showing a balance that keeps growing, the first withdrawal that actually lands in your account, the pressure to increase your stake, and then a fee to release the payout — the most useful next step isn't trying to recover the money on your own. It's preserving evidence: receipts showing the destination account, transaction hashes where crypto is involved, full exports of conversations, and the platform's URLs before they go offline.

And paying nothing in order to get paid. No legitimate charge comes before a withdrawal.

All information on Operation Mirage is attributed to the Civil Police of Pernambuco. Those under investigation are responding to proceedings and are presumed innocent until a final judicial decision.

---

CyberX works in digital intelligence applied to investigation — OSINT, on-chain tracing and anti-fraud. This content is informational and does not constitute legal advice.