On 13 October 2025, the UK’s National Crime Agency announced the results of Joint Disruption Week: 28 arrests across Ghana and Nigeria, 117 people rescued from suspected scam compounds, and 3.7 million fraudulent accounts removed by Meta. It sounds like a win—and for those rescued, it was. But for Gary, a 12-person building firm owner who opened an email from his plasterboard supplier asking him to pay a new bank account, none of those arrests stopped his Tuesday going wrong. This episode unpacks what actually happened during the NCA’s operation, who was in the room, and why invoice redirection and CEO fraud weren’t the scams being targeted. We walk through the new mandatory reimbursement rules (and why Gary probably isn’t covered), the per-head cost of recent retail data breaches, and why GDPR still matters even when ‘everyone’s data is already out there’. Plus: French supermarket freezers sabotaged via outdated refrigeration controllers, Microsoft’s largest-ever Patch Tuesday (over 1,400 fixes), and the OpenAI engineer allegedly caught planting a listening device wrapped in toilet roll. The solution isn’t waiting for more arrests. It’s a one-line rule, signed by the boss, that every bank detail change requires a phone call to a number you already hold. We cover what to report, where to report it, and why every scam you flag—even the ones you spotted—feeds the intelligence that takes down networks.
