Following law enforcement agencies taking action across three continents against fraud and money laundering networks, the Federal Criminal Police Office BKA (Bundeskriminalamt) published details on Wednesday about the so-called “Operation Chargeback.” According to reports, more than 60 locations in Germany, Italy, Canada, Luxembourg, the Netherlands, Singapore, Spain, the United States, and Cyprus were searched, and 18 people were arrested. This also includes the founder and employees of an unnamed e-commerce company, which the Wirtschaftswoche has made public and revealed to be Unzer. The payment service provider was long called Heidelpay.

Immense Effort

As the BKA explains, the accused allegedly misused approximately 4.3 million data records of credit card holders from 193 countries between 2016 and 2021. They are said to have used this to complete over 19 million fictitious online subscriptions on professional-looking fake websites. Ostensibly, streaming, dating, and entertainment services were offered, but the subscriptions “served exclusively the purpose of charging the credit cards of the victims with corresponding fees.” The monthly debits were deliberately small and had incomprehensible purposes of use. Therefore, those affected could hardly recognize the fraud.

Visualization of the procedure

(Image: BKA)

For the fraud campaign, the accused also “compromised four major German payment service providers,” the BKA further writes, without naming them. In one case, they installed software for this purpose. According to Süddeutsche Zeitung, these are Nexi (formerly Concardis), Payone, and Unzer; one name is still missing. Payone reportedly has no knowledge of investigations. According to Wirtschaftswoche, a founder of Unzer was arrested. In response to an inquiry from heise online, the company stated that they had parted ways with the man back in early 2021. A subsequent review by BaFin was successfully completed. According to the current status, the suspicion of a crime is not directed against any individuals currently working for the company.

The actual damage incurred amounts to over 300 million euros, according to the Federal Criminal Police Office, meaning the credit cards were actually charged. Attempts were even made to debit a total of 750 million euros. However, in some cases, this failed, for example, because the card data was outdated. In total, 2,000 fake websites were created for the fraud, and investigators are aware of 500 shell companies. The investigation is directed against 36 men and eight women, including six former employees of German payment service providers. The responsible General Public Prosecutor’s Office Koblenz has reportedly already secured assets that may be used for compensation.

According to the statement, the investigations are based on analysis results from the Central Office for Financial Transaction Investigations (Financial Intelligence Unit – FIU Germany). After individual suspicious reports, it recognized a pattern and informed law enforcement agencies and BaFin. The latter informs about such schemes and possible protective measures. The BKA also points out that all credit institutions have been required to perform a beneficiary check for transfers for a month now. This is also intended to prevent fraud. Further information, including for people who may have been victims themselves, can be found on a dedicated page at the BKA.

(mho)

Don’t miss any news – follow us on Facebook, LinkedIn or Mastodon.

This article was originally published in German. It was translated with technical assistance and editorially reviewed before publication.