Cybercriminals Arrested Over €30 Million Commerzbank Fraud Scheme
Brazilian and German federal police announced the arrest of four suspects in Brazil and filed charges against three additional individuals in Europe over a scheme that exploited a vulnerability in a payment service provider’s systems to withdraw roughly €30 million ($34.6 million) from customer bank accounts. German authorities said the fraud, carried out over four days in November 2023, stemmed from a flaw introduced by a faulty software update to a financial institution’s transaction-processing system. Brazilian media identified the affected bank as Commerzbank, though neither country’s police force officially named the institution.
Investigators say the attackers initiated numerous unauthorized withdrawals from German online banking accounts and funneled the proceeds to Brazil and several European countries through a network of pass-through accounts, shell companies, payment institutions, cryptocurrency platforms, and payment cards issued without their holders’ consent. Commerzbank confirmed that customers were affected but said none suffered financial losses, adding that it cooperated closely with authorities throughout the investigation.
This week, Brazil’s Federal Police, working with Germany’s BKA, launched “Operation Klonen,” executing 21 search-and-seizure warrants across seven Brazilian cities and arresting four suspects in Rio de Janeiro, Guarulhos, Goiânia and Carapicuíba. A Brazilian court also ordered the seizure of assets worth roughly R$106 million ($22.4 million), including real estate and vehicles, and investigators noted that one suspect had used part of the stolen funds to finance a 2024 political campaign. The three suspects charged in Europe will be prosecuted in Spain and Bulgaria, facing charges that include aggravated theft through electronic fraud, participation in a criminal organization, and money laundering.