€30M Stolen from Commerzbank Accounts: Arrests in Brazil and Europe

The Brazilian and German federal police have wrapped up an investigation into a major banking scam that drained around €30M ($34.6M) from the accounts of customers of a German bank. According to investigators, the theft took place over just four days in November 2023.

Neither Brazil's Federal Police nor Germany's BKA officially named the affected financial institution, but Brazilian media identified it as Commerzbank — one of Europe's largest banks, with annual revenue of more than €11.1B. The bank itself confirmed that its customers had encountered fraudulent activity, but stressed that none of them suffered any financial losses.

An error in an update

According to a Commerzbank representative, technical problems at a third-party provider led to unauthorized direct debits being taken from customer accounts. German authorities clarify that the vulnerability arose from a botched software update in the bank's payment and transaction system. Exploiting this gap, the perpetrators initiated numerous unauthorized withdrawals from online accounts and routed the stolen funds to Brazil through a sprawling network designed to conceal their origin.

Most of the money was cashed out in Brazil itself, with a smaller share in four European countries. The laundering relied on pass-through accounts, shell companies, payment institutions, crypto platforms, and even bank cards issued without the knowledge of their nominal owners.

Operation “Klonen”

Brazil's Federal Police, with support from the BKA, carried out Operation “Klonen,” executing 21 search and seizure warrants across seven cities. Four suspects were detained in Rio de Janeiro, Guarulhos, Goiânia, and Carapicuíba. Three more individuals were identified in Europe — they will be prosecuted in Spain and Bulgaria.

A curious detail surfaced during the investigation: one of those arrested had run for elected office in 2024 and, investigators believe, financed his political campaign with part of the stolen funds. A Brazilian court ordered the seizure of assets, vehicles, and real estate worth up to 106M reais ($22.4M).

The detainees are charged with aggravated theft involving electronic fraud, participation in a criminal organization, and money laundering.

Source: Bleeping Computer