The fraudster knows he has only minutes, so he does not leave the money where it is. He immediately begins moving it from one account to another. That is exactly what happened in the two cases announced by the Financial Cybercrime Control Department—and the difference was that the victims reported them quickly.
According to the department’s account, the first story began with a complaint filed by a citizen who explained that he had dealt with a fake page impersonating a commercial bank, resulting in LYD 71,000 being withdrawn from his account. In a second statement concerning another case, almost the same description was repeated by another citizen, who lost LYD 46,000 in the same way. The two men did not know each other, but the story was the same.
The department says its members began the technical examination and tracked the movement of the transfers as soon as each report was received. The investigation showed that the money had not remained in a single account; rather, it had been deliberately moved among multiple bank accounts to obscure its trail and conceal its final destination. In financial crime, this stage is known as concealment and dispersal of the trail, or layering. The idea is that each new transfer adds a layer over the original transaction, while each intermediary account increases the number of threads investigators must follow. The aim is not so much to move the money geographically as to consume the time of those pursuing it.
But the speed on which the fraudster relies is precisely what exposes him, because every transfer is recorded with its timing, amount, and parties. With the correct technical analysis, the maze becomes a chronological sequence that can be followed to the last account to have handled the money. That is what happened in both cases: the two amounts were recovered in full—LYD 71,000 in the first case and LYD 46,000 in the second—for a total of LYD 117,000 returned to their owners.
The result is worth pausing over. Tracking can begin only after a report is received, and every minute before that works in the fraudster’s favor, giving him another layer in the chain. The manhunt succeeded here because it began while the money was still inside the banking system.
The department confirmed that search and investigation operations are continuing to identify the owners of the fake pages and apprehend the suspects, in preparation for taking legal action in coordination with the competent prosecutor’s office.
The method itself also deserves attention, because neither victim’s device was hacked, nor was either man’s password cracked. Each saw his bank’s logo and official language, and acted as any customer would, providing his details when asked. This is institutional impersonation: the fraudster takes the name and logo of an existing bank, sparing himself the hardest part of the operation—convincing you within seconds that he is worthy of trust—by using the trust the bank built over years.
In our monitoring at Tahaqaq, these pages rarely wait for you to find them. Many reach victims through a sponsored advertisement, meaning someone paid to place the bait directly in front of you. Then comes the step repeated in most cases: moving the victim from the public post to a private conversation on WhatsApp or Messenger. In the comments, someone might warn them; in the private conversation, there is no one but the victim and the person addressing them.
What happened to the two men is not an exception. In Tahaqaq’s first monthly report, the monitoring team documented 107 digital cases in July 2026 alone in which the identities of 14 Libyan banks were used. This means that more than half of the banks licensed by the Central Bank of Libya found their names being used against their customers. Tahaqaq’s monitoring team also estimates that these advertisements reached at least 300,000 people—a very large number reflecting the scale of the spending fraudsters undertake to reach their victims.
There is another angle in the story that passes quickly in the statement but deserves more attention. The phrase “the money moved between multiple bank accounts” means that there were accounts receiving the money along the way. Those accounts are not empty spaces; each has an owner, a name, and a national identification number. Most may belong to real people who did not steal from anyone, but merely agreed to what appeared to be a simple request: receiving and transferring a sum of money, usually in exchange for the lure of a small commission or being persuaded to provide the service for free as a favor and in good faith.
Although someone who accepts such a request may think he is doing a favor, his account may have become a link in a chain transferring stolen money. When the trail reaches his account, investigators find his name—not the fraudster’s. Good faith is something the investigative authorities and the prosecutor’s office will consider, but it does not prevent the account holder from finding himself a party to the case and implicated in a major financial-fraud investigation, nor does it prevent his account from being frozen until the procedures are completed. Therefore, the practical rule recommended by the Tahaqaq team is simple:
If you receive a transfer from an entity you do not know, do not touch it. Do not withdraw it, transfer it, or otherwise dispose of it. Instead, notify your bank immediately, ask for the incident to be officially recorded, and keep proof that you reported it. Do not allow anyone to use your account to receive or pass on money, regardless of your relationship with them.
Before dealing with any banking page, remember that a sponsored advertisement does not mean it is trustworthy, and that a request to move to WhatsApp or Messenger to complete the process is itself a warning sign. A bank will not give you 24 hours before suspending your account through a post, nor will it ask for your password, verification code, or card details through a link, message, or call. A logo can be copied in a second and a verification badge can be purchased, so verify the page itself through official channels. Do not use a number or link included in the message; instead, contact your bank using the number printed on your card or listed on its official website.
- Suspect a link or advertisement? Paste it into the Tahaqaq tool and get an instant verdict → tahaqaq.ly
- Directory of official pages and customer-service numbers for 23 licensed Libyan banks → tahaqaq.ly/banks
- Digital protection guide for citizens → tahaqaq.ly/guide
- To report → tahaqaq.ly/report
Sources:
The two statements issued by the Financial Cybercrime Control Department concerning the cases.
Tahaqaq’s first monthly report, July 2026.
