Brazil arrests four in €30M Commerzbank fraud tied to service provider flaw
This digest was compiled by AI from multiple sources — links to the originals are below.
Brazilian Federal Police arrested four suspects and executed 21 search warrants across seven Brazilian cities in Operation Klonen, targeting a €30 million fraud that exploited a service provider flaw to withdraw funds from Commerzbank customer accounts. German Federal Criminal Police and Brazilian authorities identified three further suspects in Europe, who face prosecution in Spain and Bulgaria. Commerzbank said clients suffered no financial losses from the unauthorized direct debits.
The Service Provider Flaw
The attackers exploited a software vulnerability introduced by a faulty update at a payment and transaction-processing system linked to a financial institution, according to German authorities. In November 2023, they initiated unauthorized withdrawals from German online banking accounts and moved the funds to Brazil through a concealment network. Commerzbank's spokesperson said unauthorized direct debits were made from customer accounts because of technical issues at a service provider, and that there was no financial loss to customers.
Operation Klonen
Brazil's Federal Police launched Operation Klonen with support from Germany's BKA, executing 21 search-and-seizure warrants across seven cities. Four suspects were arrested under preventive detention warrants in Rio de Janeiro, Guarulhos, Goiânia, and Carapicuíba. One suspect ran for elected office in 2024 and used illicit funds to support that campaign, according to Brazilian authorities. A federal court ordered the seizure of financial assets, vehicles, and real estate worth up to R$106 million ($22.4 million).
European Prosecutions
Three additional suspects were identified in Europe and will be prosecuted by law enforcement authorities in Spain and Bulgaria. The attackers moved and concealed proceeds through pass-through accounts, companies, payment institutions, virtual-asset platforms, and payment cards issued without beneficiaries' consent. Most of the stolen funds were withdrawn in Brazil, while a smaller share was cashed out in four European countries. Charges against the arrested suspects include aggravated theft through electronic fraud, participation in a criminal organization, and money laundering.
What's Next
Spanish and Bulgarian prosecutors are set to pursue charges against the three suspects in Europe, while Brazilian courts continue asset seizure proceedings. It remains unclear whether the unnamed service provider will face legal or regulatory scrutiny over the faulty software update that enabled the withdrawals.
1 source
Brazil arrests four in €30M Commerzbank fraud tied to service provider flaw
