Between 2016 and 2021, the suspects were allegedly involved in stealing credit card data, setting up fake accounts, authorising and concealing payments, and money laundering. The perpetrators deliberately kept monthly credit card payments to their accounts below the maximum of EUR 50 to avoid arousing suspicion among victims about high transfer amounts.

The payments had obscure descriptions, making it difficult for victims to trace them. Also, the transfers were made to websites, which were developed in such a way that they could not be indexed via search engines and were only accessible via direct links or URLs.

The infrastructure of four payment providers was exploited to process and launder the illicit proceeds of the fraud. The five arrested suspects, who were employed by the payment services and included executives and compliance officers, allegedly colluded with the fraud networks to use the financial infrastructure against fees.

The suspects used a series of shell companies, mainly registered in Cyprus and the United Kingdom, to conceal their activities and distribute the fraudulent transactions. This also made it very difficult for victims to charge back the fraudulent payments to their credit cards. These companies were obtained via so-called Crime-as-a-Service providers, who assist criminals with their illegal activities against a fee.

Investigations in Luxembourg and the United States of America

The Luxembourg authorities initiated a judicial investigation on the grounds of money laundering and the misuse of company assets. This judicial investigation was based on detailed financial data analysis reports prepared by the Luxembourg Financial Intelligence Unit.

The Luxembourg Criminal Police (Service de police judiciaire, section anti-blanchiment) conducted searches at the offices of the Luxembourg companies. Several suspects were interrogated and assets worth several million euros were seized. Furthermore, requests for Mutual Legal Assistance were submitted to several EU and non-EU jurisdictions, and the resulting evidence became part of the Luxembourg investigation.

As the main focus of the Luxembourg investigation were German citizens and payment service providers, the Luxembourg authorities handed over their case to the General Public Prosecutor’s Office of Koblenz, and the two investigations were merged.

By uncovering this international fraud network, the Luxembourg law enforcement authorities have not only provided active legal assistance to Germany but have also made a significant contribution to the investigation in the German criminal proceedings.

At the same time, the German authorities received crucial information, obtained by Mutual Legal Assistance, from a related U.S. investigation lead by the United States Attorney’s Office for the Southern District of New York. Based on the assistance provided by the United States, the General Public Prosecutor’s Office of Koblenz was able to proceed with their investigations and uncover the overall fraud scheme and determine further suspects. Further close cooperation with the U.S. authorities enabled the actions taken this week.

Eurojust support

Eurojust organised four coordination meetings to prepare for this week’s action day in Germany, Italy, Luxembourg, Spain, Cyprus, the Netherlands, the United States, the United Kingdom, Canada and Singapore. The Agency also enabled cross-border judicial cooperation with the United Kingdom and the United States via their Liaison Prosecutors at Eurojust and with the authorities in Canada and Singapore via its network of Contact Points.

Furthermore, Eurojust provided infrastructure and support for multiple bilateral meetings. The Agency also assisted with the execution of 90 European Investigation Orders and requests for Mutual Legal Assistance to 30 countries.

Europol provided analytical support to this investigation since May 2023. On the action day, a crypto expert was deployed in Luxembourg, while another Europol expert participated in the coordination centre.

During the action day, several hundred law enforcement officers searched over 60 places, resulting in the seizure of cryptocurrencies, luxury vehicles, mobile phones, laptops and various other communication tools.

The operations on the ground were carried out at the request of and by the following authorities:

• Germany: General Public Prosecutor’s Office (PPO) Koblenz; Federal Criminal Police (Bundeskriminalamt) – Financial Intelligence Unit; Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht – BaFin)
• Cyprus: Attorney General’s Office; Unit for Combating Money Laundering (MOKAS); Cyprus Police
• Italy: State Police, Mobile Squad Novara
• Luxembourg: PPO Luxembourg; Investigative Judge Luxembourg; Luxembourg Financial Intelligence Unit; Judicial Police (Service de Police Judiciaire)
• Spain: PPO at Audiencia Nacional and PPO Balearic Islands; Central Investigative Court no. 1 at Audiencia Nacional and Investigative Court no. 2 in Palma de Mallorca; National Police – Fiscal and Economic Crime Unit (UDEF)
• Netherlands: PPO Noord-Holland; National Police, department Noord-Holland
• Canada: Department of Justice – International Assistance Group and British Columbia Regional Office; Royal Canadian Mounted Police; Toronto Police Service
• Singapore: Singapore Police Force
• United Kingdom: Metropolitan Police Service; Essex Police; Eastern Region Special Operations Unit
• United States: Department of Justice’s Office of International Affairs, Washington, DC; United States Attorney’s Office for the Central District of California; United States Marshals for the Central District of California