Brazilian police arrest four over €30 million bank fraud linked to service-provider flaw

Brazilian authorities have arrested four people and identified three additional suspects in Europe in connection with a bank fraud operation that allegedly diverted about €30 million ($34.6 million) from German customer accounts in November 2023.

The investigation was conducted jointly by Brazil’s Federal Police and Germany’s Federal Criminal Police Office, known as the BKA. Authorities said the attackers exploited a vulnerability created by a defective software update at a service provider involved in payment and transaction processing. The flaw allegedly enabled the criminals to initiate large numbers of unauthorized direct debits from online banking accounts.

Brazilian media identified the affected institution as Commerzbank, although the German and Brazilian authorities did not publicly name it. In a statement, Commerzbank confirmed that customers were affected by unauthorized transactions but said they did not suffer financial losses. The bank attributed the incident to technical problems at a service provider and said it cooperated with investigators.

Investigators believe the stolen funds were transferred to Brazil through a network intended to obscure their origin. Most of the money was withdrawn there, while additional cash-outs took place in four European countries. Authorities said the proceeds were moved through intermediary accounts, companies, payment institutions, cryptocurrency platforms and payment cards allegedly issued without the account holders’ authorization.

Operation Klonen

Brazil’s Federal Police announced “Operation Klonen” and carried out 21 search-and-seizure warrants in seven cities. Four suspects were placed in preventive detention in Rio de Janeiro, Guarulhos, Goiânia and Carapicuíba. Police also reported that one detainee, who ran for elected office in 2024, allegedly used some of the funds to support a political campaign.

A Brazilian federal court authorized the seizure of financial assets, vehicles and property valued at up to 106 million reais, or approximately $22.4 million. The suspects face allegations including aggravated theft using electronic fraud, participation in a criminal organization and money laundering.

Three other suspects were located in Europe and are expected to face proceedings in Spain and Bulgaria. The investigation remains ongoing, and the allegations have not been resolved in court.