Security
Brazil arrests suspects in €30 million bank fraud
Brazil arrested four suspects over an alleged €30 million Commerzbank fraud linked to a service provider vulnerability and unauthorized bank withdrawals.
Four people have been arrested in Brazil and three others charged in Europe over an alleged €30 million ($34.6 million) bank fraud that exploited a service provider’s software vulnerability, according to Itzine and BleepingComputer.
The attack lasted four days in November 2023, investigators say. Neither Brazil’s Federal Police nor Germany’s BKA formally named the affected institution, but Brazilian media identified it as Commerzbank. The bank confirmed that its customers were affected by fraudulent activity, while saying they did not suffer financial losses.
“The fraud case is known and dates back to 2023. Due to technical issues at a service provider, unauthorized direct debits were made from customer accounts. There was no financial loss to customers. We cooperated closely and extensively with the authorities.”
— Commerzbank spokesperson, quoted by BleepingComputer
How the alleged €30 million scheme worked
German authorities believe the suspects exploited a software vulnerability introduced by a faulty update to a financial organization’s payment and transaction-processing system. They then initiated numerous unauthorized withdrawals from German online-banking accounts.
The money was routed to Brazil through a network intended to conceal its origin. Investigators say the largest share was withdrawn in Brazil, while smaller amounts were cashed out in four European countries. The alleged laundering network used:
- Pass-through bank accounts and companies
- Payment institutions and virtual-asset platforms
- Payment cards issued without the recipients' consent
Three additional suspects in Europe are expected to face prosecution in Spain and Bulgaria, according to BleepingComputer.
Operation Klonen arrests and seizures
Brazil’s Federal Police launched Operation Klonen with support from the BKA and carried out 21 search-and-seizure warrants across seven Brazilian cities. Four suspects were placed in preventive detention in Rio de Janeiro, Guarulhos, Goiânia, and Carapicuíba.
Authorities allege that one suspect ran for elected office in 2024 and used part of the illicit proceeds to support their political campaign. A Brazilian federal court ordered the seizure of financial assets, vehicles, and real estate worth up to R$106 million ($22.4 million).
The suspects face charges including aggravated theft through electronic fraud, participation in a criminal organization, and money laundering. The reported €30 million refers to the estimated fraud-related damage, while Commerzbank says the unauthorized debits did not ultimately leave its customers with financial losses.