Brazilian police have arrested four suspected cybercriminals over an alleged €30 million bank fraud involving unauthorised direct debits from Commerzbank customer accounts.
German and Brazilian authorities say the group exploited a vulnerability at a financial service provider. The fraud took place over four days in November 2023 and triggered a major cross-border investigation.
Service provider flaw enabled unauthorised withdrawals
Authorities have not publicly named the affected financial institution. However, Brazilian media identified Commerzbank as the bank involved.
Commerzbank confirmed that customers were affected by fraudulent direct debits but said they did not suffer financial losses.
The bank said technical issues at a service provider allowed unauthorised withdrawals from customer accounts. It also stated that it cooperated closely with investigators.
German authorities said a faulty software update introduced the vulnerability into a payment and transaction-processing system used by the financial institution.
The attackers then initiated numerous withdrawals from German online banking accounts and transferred the money through a network designed to hide its origin.
Funds moved through Brazil and Europe
Investigators believe the group routed most of the stolen money to Brazil. A smaller portion was withdrawn in four European countries.
The suspects allegedly used pass-through accounts, companies, payment institutions, virtual-asset platforms and payment cards issued without the beneficiaries’ consent to move and conceal the funds.
Police also identified three further suspects in Europe. Authorities in Spain and Bulgaria will prosecute those individuals.
Operation Klonen leads to four arrests
Brazil’s Federal Police launched Operation Klonen on Wednesday with support from Germany’s Federal Criminal Police Office, known as the BKA.
Officers carried out 21 search-and-seizure warrants across seven Brazilian cities. They arrested four suspects in Rio de Janeiro, Guarulhos, Goiânia and Carapicuíba under preventive detention warrants.
Brazilian authorities said one suspect ran for elected office in 2024 and allegedly used part of the illicit funds to support their political campaign.
A federal court also ordered the seizure of assets worth up to R$106 million, or around $22.4 million. The order covers financial assets, vehicles and real estate.
Cross-border fraud investigation continues
The Commerzbank bank fraud case highlights how technical weaknesses at third-party providers can expose financial institutions and their customers to large-scale abuse.
Even when banks reimburse affected customers, attackers can still exploit gaps in payment systems to move large sums before authorities detect the activity.
German and Brazilian police continue to investigate the wider network behind the fraud and the methods used to transfer and launder the proceeds.
0 responses to “Hackers Arrested Over €30M Commerzbank Bank Fraud”