Summary: On September 10, the Office of Public Prosecutions of the Brazilian state of São Paulo launched Operation Frankmobile. The target: a vast criminal network engaged in theft of thousands of mobile phones, extraction of personal information from the devices for the purpose of defrauding their owners, technical alteration of the stolen goods, and their resale as new phones. The entire scheme allegedly stole and repurposed or cannibalized more than 800,000 devices — a staggering figure, even in São Paulo, where more than 150,000 smartphones were stolen just last year.
Two key network members Amine Jawad Awada and Mohamad Abdel Hassan Rkain, are Lebanese nationals with familial ties to Hezbollah members and sympathizers in Lebanon. Rkain also holds a Venezuelan passport issued during the Maduro era, when Venezuelan officials were accused of providing passports and citizenship documents to thousands of Middle Eastern nationals, including Hezbollah operatives. Given Hezbollah’s footprint in Brazil, particularly São Paulo, the possible Hezbollah associations of two key operatives in the scheme dismantled by Operation Frankmobile, raise questions about potential terror-finance ramifications.
Analysis: preliminary reports on the nature of the criminal network offer important clues to its sophistication. These clues are indicia of transnational organized crime, not the trademark of local street crime gangs.
The network had four different layers of operation, indicating a high level of coordination among different, large teams:
- Street theft of devices — including at gunpoint;
- Breach and data theft — once stolen, the devices would be delivered within the hour to a second team, which breached the phones, acquired personal data, accessed the victim’s bank accounts, and drained them by transferring funds to third parties;
- Tampering with data and reselling devices — a third team would then remove any proprietary software that could block the phones from being repurposed, install new, fake, unique identifiers (IMEI numbers) on the stolen devices, and resell them as new phones;
- Disassembly of phones and sale of parts — if phones could not be repurposed, a fourth team would disassemble them and use their components as spare parts.
The network also relied on people tasked with creating a paper trail of fraudulent invoices to spoof tax authorities into thinking the merchandise came from legitimate transactions, logistics infrastructure responsible for shipping stolen mobile phones overseas, and access to websites hosted abroad to alter phones IDs — a clear indication that this was no ordinary, local crime operation but had an international dimension.
Although at this stage there’s no evidence from the investigation that stolen personal data was sold to international criminal syndicates, such data could potentially be exploited by other criminal networks. Having these details allows not only the direct theft of money from fiat, fintech and crypto accounts, but also the generation of scams based on social networks and social engineering to create opportunities for theft and extortion from third parties.
Profits were apportioned based on preset percentages among the thieves, those involved in the theft of personal data and the bank fraud they enabled, those involved in the technical jailbreaks, those repurposing the phones and reselling them, and those producing the fake invoices required to cover up the true origin of the devices. This too is a trademark for a well-orchestrated, long-term, large operation.
The two Lebanese nationals, Awada and Rkain, were both arrested during the initial police sweep.
According to media reports, Awada played a central role in the technical manipulation phase of the stolen merchandise. He owned multiple commercial storefronts, which, according to investigators, served as hubs for unlocking stolen phones and altering their hardware data. His businesses utilized specialized hacking software, such as UnlockTool and SamFwTool, to reset cloud accounts and erase original device IDs. Prosecutors described his operation as part of a “technical washing” cycle.
Notably, his shops even offered illicit phone “upgrades” to customers — such as physically modifying the chassis of older iPhone models to resemble newer versions. When authorities raided locations linked to his businesses, they discovered large batches of stolen phones being held under fraudulent corporate labeling to feign legitimacy. in 2021, Awada altered the official spelling of his name in Brazil from Amine to Amin, an obfuscation technique also used by Hezbollah operatives abroad.
According to investigators, Rkain operated alongside the network’s commercialization tier to acquire and move illegal hardware. He also produced false invoices. His business, Alffa Eletrônicos, was one of the commercial electronics storefronts used to funnel devices. Rkain worked closely with the ring’s central logisticians to process, buy, and resell bulk batches of locked or blacklisted smartphones, acting as a crucial outlet for the ring to convert stolen property into liquid cash.
Rkain also had prior involvement with the Brazilian justice system, including cases involving smuggling and receiving stolen goods. His application for Brazilian naturalization was denied in 2020, after he failed to provide required documentation, including a clean criminal record from Lebanon, requested by authorities.
Possible Hezbollah connection
Both Lebanese nationals implicated have potential Hezbollah connections.
According to data accessed through the risk intelligence platform, 240 Analytics LTD — the author is a senior advisor to the platform — Awada and a brother, Bilal Jawad Awada, are both Brazilian residents. Their father, Jawad Awada, is a member of Hezbollah and held two bank accounts with the U.S. sanctioned Hezbollah lending institution, Al Qard Al Hassan. The bank account details obtained through the 240 Analytics platform were leaked in the public domain in December 2020.
Awada’s brother, Jihad died in the recent conflict between Israel and Hezbollah. Though social media reports identify the late Jihad as a municipal council member of the family’s hometown, Hezbollah’s Telegram channel, Balagh Media, published photos of his funeral on August 8, 2026, confirming his combat role within the terror group.
Rkain’s three sisters, according to data accessed through 240 Analytics LTD, had accounts with Al Qard Hassan as of December 2020.
More importantly, Rkain holds a Venezuelan passport. His name, patronymic and date of birth — key identifiers for disambiguation purposes — appear in a list of approximately 10,500 names. According to an analysis by 240 Analytics, the list contains approximately 5,200 unique entries. Details from the list were leaked by Venezuelan opposition in 2019 amid longstanding allegations concerning the issuance of Venezuelan passports and identification documents to Middle Eastern nationals during the Maduro era.
A 2017 CNN investigation had previously reported allegations concerning a corrupt Venezuelan passport scheme. During testimony to the U.S. Congress in October 2025, former Assistant Secretary for Terrorist Financing at the U.S. Department of Treasury Marshall Billingslea singled out two senior Maduro-era officials, Tareck Al Aissami and Ghazi Nassereddine, as conduits for the scheme and said Hezbollah operatives and other Middle Eastern nationals were among its beneficiaries.
According to Billingslea, Nassereddine, “worked at the Venezuelan embassy in Damascus where he arranged meetings with Hizballah officials. He also used his position to distribute Venezuelan passports to Hizballah operatives to conceal their identities.”
As for El Aissami, Billingslea noted that “As head of ONIDEX, Venezuela’s passport and naturalization agency, he was instrumental in furnishing passports and citizenship documents to Hizballah operatives as well as a large number of people from Lebanon, Syria, and Iran. Between 2010-2019, regime officials provided Venezuelan passports to more than 10,400 people from these three countries.”
Rkain was one of the beneficiaries of this largesse.
Allegations that Venezuelan passports issued during the Maduro went to Hezbollah operatives received further attention in January 2026, shortly after U.S. forces captured Venezuela’s dictator, Nicolás Maduro in Caracas. Brigadier General Wehbe Katicha, a senior Lebanese military official, alleged that Venezuelan authorities had supplied almost 200 Venezuelan identities to Hezbollah operatives, between 2008 and 2012.
Rkain’s case also raises questions about how Venezuelan passports issued to Middle Eastern nationals during the Maduro era may have been used beyond Venezuela. If his case is indicative of a broader pattern such documents may have facilitated travel or residence in third countries rather than simply allowing their holders to operate from Venezuelan territory.
Awada’s familial ties to Hezbollah and Mr. Rkain’s possession of a Venezuelan passport issued during the Maduro era may be coincidental and do not conclusively link either man — or a complex criminal scheme they allegedly participated in — to Hezbollah. Their roles in the network, however, suggest that Brazilian authorities should give due consideration to those connections in the ongoing investigation.
Dr. Emanuele Ottolenghi is a Senior Research Fellow at the Center for Research of Terrorist Financing (CENTEF) and a Senior Advisor to 240 Analytics LTD. Opinions expressed in this article are his own.
Disclaimer: The views and opinions expressed in this article are those of the author. They do not necessarily reflect the official policy or position of any agency of the U.S. government, Diálogo magazine, or its members.
