Case study: platform used 87 email addresses, 4 URLs to cause 50,000 disruptions and a large scale criminal referral in West Africa – far exceeding usual one signal, one takedown model
The Global Signal Exchange (GSE) has published a case study showing how 87 email addresses and four web addresses shared by the UK’s National Crime Agency (NCA) led to the identification and disruption of nearly 50,000 fraudulent accounts. The information was also used to identify more than 5,000 fake websites. GSE says this is “the latest evidence of what its founders describe as the platform’s multiplier effect”.
GSE is owned and managed by Oxford Information Labs (OXIL) which is a not-for-profit research organisation specialising in cybersecurity, digital governance and internet technologies.
Out of West Africa
Working through the AI-powered GSE, Google’s Trust & Safety team analysed the batch of URLs and email addresses submitted by the NCA in the UK and identified a cluster of Gmail accounts linked to an organised criminal network operating from West Africa.
The accounts were running multiple fraud types simultaneously, from advanced payment fraud, extortion, invoice fraud and government impersonation. Google’s Cybercrime Investigation Group has since submitted a criminal referral to the NCA, which is working with local law enforcement in West Africa to pursue suspects.
More powerful than one signal, one takedown
The GSE says the case study illustrates the “step-change” the GSE delivers compared to usual content reporting that relies on the one-signal, one-takedown model. The GSE allows signals to be shared across multiple organisations at once, enabling parallel investigations and deeper analysis.
In this instance, four URLs and 87 email addresses unlocked a network of close to 50,000 accounts and 5,000 cloned bank websites, making connections that had not been made before.
The publication of the case study coincides with the release of GSE Platform 2.5.0, which introduces GSE Compass – an AI-native, chat-based interface that allows analysts to interrogate the platform’s open DNS signal data in natural language. The new tool is designed for a wider range of partners to interrogate the GSE’s data set, with more than 1 billion entries, and derive immediate insights, without specialist technical knowledge.
Widespread support
Momentum for the GSE has been building internationally. The United Nations Office on Drugs and Crime (UNODC) held a Global Fraud Summit in Vienna in March where the GSE was formally named in the summit’s Industry Accord. The Accord was signed by Google, Meta, Amazon and Microsoft, recognising the GSE as a designated platform for real-time threat intelligence sharing across borders.
Separately, the UK government’s Online Advertising Taskforce Progress Report, published the same week, included a written ministerial response from Creative Industries Minister Ian Murray. He reportedly praised the GSE malvertising pilot’s “significant progress in removing barriers to cross-platform information sharing,” according to this LinkedIn post by Emily Taylor, CEO of OXIL (pictured).
Operational impact
Commenting on the case study and new iteration of the GSE, Talylor said, “What the NCA case study shows is that the GSE is no longer a concept – it is operational infrastructure. We are seeing real enforcement outcomes: accounts disabled, criminal referrals made and supply chain weaknesses being designed-out.”
She added, “The next stage is extending that into the financial sector, where GSE can make a significant difference in encouraging a progressive approach to data sharing in the collective fight back against the scammers and bad actors. To this end, we are currently in positive discussions with a number of major banks and global payments brands.”
Lucien Taylor, Co-founder of OXIL, stated, “The Vienna summit also made clear that the old model of bilateral notice-and-takedown is not equal to the scale of the problem. What we need – and what the GSE is building – is a proactive, ecosystem-wide response. That means more regions, more sectors and more partners sharing signals in close to real time. We are in Asia this month to advance exactly that conversation on a global scale.”
OXIL Research is the research arm of OXIL.
