Eurojust coordinated a large, multi-country operation this week that led to the arrest of 18 suspects linked to a sprawling credit card fraud scheme worth at least €300 million. Investigators say three interconnected networks set up fake online subscriptions for dating, pornography and streaming platforms, charging millions of cardholders small monthly amounts designed to go unnoticed. The total attempted fraud is put at more than €750 million.
How the scheme worked
Between 2016 and 2021, the perpetrators allegedly stole card data, created bogus accounts, authorised and concealed payments, and laundered the proceeds. Individual debits were typically kept below €50 to avoid alarms. Transactions carried opaque descriptors and were routed to websites hidden from search engines and accessible only via direct links. Shell companies, mainly registered in Cyprus and the United Kingdom, were used to distribute the charges and frustrate chargebacks. Authorities say some of these entities were sourced through Crime-as-a-Service providers.
Inside help at payment firms
The infrastructure of four payment service providers was exploited to process and launder illicit funds. Five people employed by these firms, including executives and compliance officers, were arrested on suspicion of colluding with the networks in exchange for fees. Those detained include German, British, Latvian, Dutch, Austrian, Danish, American and Canadian nationals.
The case in Luxembourg began with a judicial probe into money laundering and misuse of company assets, based on financial intelligence reports. Police searched company offices, questioned suspects and seized assets worth several million euro. Given the German focus of the alleged scheme, Luxembourg transferred its case to the General Public Prosecutor’s Office in Koblenz and the files were merged. In parallel, mutual legal assistance from a related US investigation led by the United States Attorney’s Office for the Southern District of New York proved pivotal in mapping the networks and identifying further suspects.
Cyprus’s role
Cyprus featured both operationally and corporately. According to Eurojust, shell companies registered in Cyprus channelled fraudulent payments, and on the action day Cypriot authorities, the Attorney General’s Office, the Unit for Combating Money Laundering (MOKAS) and Cyprus Police, executed requests alongside partners abroad.
Eurojust held four coordination meetings and enabled cross-border judicial cooperation with the United Kingdom and the United States via its Liaison Prosecutors, and with Canada and Singapore through its Contact Points network. The Agency supported the execution of 90 European Investigation Orders and mutual legal assistance requests to 30 countries. Europol provided analytical backing from May 2023, deployed a cryptocurrency expert in Luxembourg, and staffed the coordination centre.
What was seized
On the action day, several hundred officers searched more than 60 locations across Germany, Italy, Luxembourg, Spain, Cyprus, the Netherlands, the United States, the United Kingdom, Canada and Singapore. Seizures included cryptocurrencies, luxury vehicles, mobile phones, laptops and other communications devices.
The merged German-led proceedings will assess the full criminal liability of suspects, including alleged collusion by payment-service insiders and the use of corporate fronts in Cyprus and the UK. With millions of victims spread across 193 countries, authorities say further investigative and asset-recovery actions are expected as evidence from the coordinated searches is analysed.