German Prosecutors Charge Nine in €260 Million Credit Card Fraud and Money Laundering Case

German prosecutors have brought charges against nine people accused of participating in an international fraud network that allegedly obtained and misused the payment card details of more than three million people across 193 countries. The investigation, known as “Operation Chargeback”, uncovered an extensive scheme involving fraudulent subscription websites, unauthorised credit card charges, money laundering and the alleged infiltration of Germany’s payment infrastructure.

The charges were filed by the Cybercrime Centre of the Koblenz Public Prosecutor General’s Office following a lengthy investigation into activities that allegedly took place between 2016 and 2021. Investigators believe the defendants formed part of an internationally organised network that obtained credit card information through phishing operations and deceptive subscription traps before using the stolen data to generate fraudulent payments.

According to the investigation, the network operated more than 18 million supposed subscriptions through websites designed to appear legitimate. Many of the websites reportedly presented themselves as offering dating or adult-oriented services, but investigators believe they primarily existed to provide a technical and commercial façade for charging victims’ credit cards.

The websites were reportedly not readily discoverable through ordinary internet searches. Instead, they allegedly served as a formal basis for processing recurring payments from cards whose details had been obtained without the cardholders' genuine consent. The structure allowed the operators to create the appearance of legitimate subscription transactions even though the affected customers had not knowingly entered into the corresponding agreements.

Investigators believe the operators deliberately kept the recurring charges relatively small. The amounts were allegedly accompanied by cryptic or difficult-to-identify transaction descriptions, making it less likely that cardholders would immediately recognise the payments as fraudulent.

This approach allegedly allowed unauthorised charges to continue for extended periods. Some customers reportedly did not challenge the transactions for a considerable time, while others may never have noticed them at all. The cumulative effect of thousands or millions of relatively small payments was nevertheless substantial.

Authorities currently estimate the damage caused by the alleged scheme at more than €260 million. Investigators also believe the network attempted to initiate an additional €750 million or more in unauthorised card charges. Those transactions were ultimately unsuccessful for various reasons, including the expiry of some of the affected cards.

The scale of the alleged activity makes the case particularly significant. Rather than targeting a limited number of individuals through isolated fraudulent transactions, the operation allegedly relied on an industrialised model capable of processing huge numbers of payment cards across multiple jurisdictions.

The criminal structure allegedly depended on access to legitimate payment infrastructure. This became a central part of the investigation because prosecutors believe some participants helped fraudulent businesses obtain access to payment service providers despite the true nature of their activities.

Three of the defendants are accused of acting as intermediaries between the fraudulent networks and payment service providers. Their alleged role was to help companies controlled by the networks obtain contractual relationships with payment providers that they would not have been able to secure if their actual business activities and background had been disclosed.

These intermediaries allegedly acted as a bridge between the criminal networks and the formal financial system. By helping shell or front companies obtain access to card-processing services, they allegedly enabled the fraudulent operators to process large volumes of transactions through legitimate payment infrastructure.

The investigation also identified an individual who allegedly worked as an independent risk manager and provided services to the fraudulent networks. Prosecutors accuse him of supplying manipulated risk reports and advising participants on what they needed to demonstrate in order to establish successful commercial relationships with payment service providers.

He is also accused of providing compliance and risk-management software to intermediaries and one of the criminal networks. According to prosecutors, this allowed the operators to better understand and navigate the controls used by payment companies when assessing prospective customers.

The allegations involving payment-sector professionals are particularly significant because they raise questions about the potential abuse of compliance and risk-management processes. Financial institutions and payment providers rely on due diligence and risk assessments to determine whether prospective merchants present unacceptable levels of fraud, money laundering or other financial crime risk.

If those controls are deliberately manipulated, the result can be that businesses that should have been rejected gain access to the financial system.

The remaining five defendants allegedly held positions within payment service providers themselves. Prosecutors say that some were former managing directors, while others held senior or departmental positions in areas including risk management, sales and compliance.

They are accused of knowing about the fraudulent subscription models and the structures behind the networks while nevertheless allowing the businesses to obtain and maintain unrestricted access to German payment infrastructure.

The allegations therefore extend beyond the people who allegedly carried out the original payment fraud. Prosecutors are examining whether individuals within legitimate financial businesses knowingly enabled the networks to operate by allowing them continued access to payment services.

From an AML and financial crime perspective, this is one of the most significant aspects of the case. Criminal networks often require legitimate financial infrastructure to monetise fraudulent activity. Banks, payment institutions, card processors and other financial intermediaries can consequently become critical points of vulnerability.

The case demonstrates how fraudsters can attempt to disguise their activities as ordinary commercial transactions. Rather than simply stealing money directly from bank accounts, the alleged network created recurring payment arrangements that were designed to resemble legitimate subscriptions.

This type of activity can be particularly difficult to identify when individual transactions are relatively small. A single monthly payment may not appear unusual, particularly if the merchant's name is unfamiliar or the transaction description is ambiguous. The risk becomes much more apparent when millions of similar transactions are analysed collectively.

Transaction monitoring and merchant-risk systems therefore need to identify patterns rather than focusing solely on the value of individual payments. High volumes of low-value recurring transactions, unusually high chargeback rates, inconsistent customer complaints or merchant activity that does not correspond with a company's stated business model can all provide important warning signals.

The name “Operation Chargeback” reflects the payment mechanism involved. A chargeback occurs when a cardholder disputes a transaction and seeks to have the payment reversed, commonly because the transaction was fraudulent or unauthorised.

The large number of alleged fraudulent subscriptions meant that the payment system itself could become an important source of evidence. Patterns of disputed transactions, customer complaints and payment reversals can help identify merchants whose activities are inconsistent with legitimate subscription businesses.

The investigation also highlights the international nature of modern payment fraud. The alleged victims were located in 193 countries, while the network itself operated through multiple entities and jurisdictions.

Such geographical fragmentation can make investigations considerably more difficult. Criminal networks can establish companies in different countries, use payment providers elsewhere and target customers across the world. The resulting transactions can cross several legal and regulatory jurisdictions within a very short period.

The investigation has consequently involved international cooperation. Earlier stages of the operation included searches and arrests carried out as part of a major investigation that required authorities to pursue evidence and financial relationships across borders. Previous reporting indicated that investigators had submitted more than 90 requests for international legal assistance.

The current prosecution represents the next stage of that investigation. Prosecutors have now formally accused nine individuals, although the charges remain allegations until determined by the courts.

The defendants include eight men and one woman, all reportedly German or Canadian nationals, aged between 33 and 57. Six are currently in pre-trial detention. A detention order against another defendant has been suspended subject to conditions, while one defendant is currently in Canada and is the subject of extradition proceedings.

The case also involves allegations of participation in a criminal organisation based outside Germany. Prosecutors allege that the organisation was established for the continuing commission of fraud and money laundering offences and sought to penetrate Germany's financial system and establish what authorities describe as a shadow financial system.

That allegation adds another dimension to the case. According to prosecutors, the objective was not merely to carry out individual fraudulent transactions but to establish an enduring infrastructure capable of supporting criminal financial activity.

The alleged use of legitimate payment service providers was central to this structure. By obtaining access to payment processing systems, the networks could potentially process fraudulent transactions on a large scale while appearing to operate through conventional commercial channels.

This demonstrates why financial institutions must assess not only whether a prospective merchant has been properly incorporated or possesses apparently valid documentation, but also whether its underlying business activity makes economic and commercial sense.

A company presenting itself as an online subscription business may have a legitimate corporate structure, website and bank account. However, if its transaction patterns, customer complaints, chargeback levels and ownership structure do not correspond with its stated activities, the institution may need to investigate further.

The alleged manipulation of risk reports is particularly concerning because risk assessments are intended to provide precisely this type of protection. If information provided to a payment provider has been deliberately altered or selectively presented, the provider's ability to assess the customer accurately can be significantly compromised.

The case therefore illustrates the importance of independent verification. Compliance teams cannot always rely exclusively on information supplied by customers, intermediaries or third-party advisers. Where risk indicators are present, information may need to be corroborated using independent sources and transaction data.

It also raises questions about the responsibilities of senior management and compliance personnel. Payment providers operate within highly regulated environments, and individuals responsible for risk management and compliance are expected to identify and escalate suspicious activity.

If the allegations are ultimately proven, the case could demonstrate the severe consequences that can arise when individuals with knowledge of financial crime risks deliberately facilitate access to payment infrastructure.

The alleged laundering of the proceeds is another major component of the prosecution. Authorities believe money generated through the fraudulent subscription activity was subsequently introduced into the legitimate financial system, giving rise to charges of commercial and organised money laundering.

The laundering component is important because the fraudulent payments generated enormous volumes of proceeds. Once money has been obtained through unauthorised transactions, criminal networks need mechanisms for receiving, transferring and ultimately using those funds.

The payment infrastructure allegedly used in the scheme therefore served two purposes: it enabled the initial fraudulent transactions and provided a route through which the resulting proceeds could enter the formal financial system.

The case demonstrates how closely fraud and money laundering can be connected. Fraud may generate the criminal proceeds, but laundering allows the perpetrators to move and integrate those proceeds in ways designed to distance them from the original offence.

For financial institutions, this reinforces the need to connect fraud monitoring with AML controls. A merchant generating unusually high volumes of disputed transactions may represent not only a consumer-protection problem but also a potential money laundering risk.

The prosecution also highlights the importance of monitoring the behaviour of payment service providers' own customers after onboarding. Effective due diligence does not end when a merchant account is approved. Transaction behaviour can subsequently reveal information that was not apparent during the initial assessment.

A merchant whose actual activities differ substantially from its declared business model, for example, may require enhanced review. Similarly, unusually high transaction volumes, patterns of recurring low-value payments, large numbers of chargebacks or unexplained relationships between apparently unrelated businesses can warrant investigation.

The alleged use of fake websites adds another warning sign. Businesses that operate websites designed primarily to provide a formal basis for financial transactions rather than to provide genuine services may be difficult to distinguish from legitimate online merchants without deeper analysis.

This makes technological and behavioural monitoring increasingly important. Financial institutions may need to combine corporate information, website analysis, payment data, customer complaints, chargeback information and other external intelligence to develop an accurate picture of a merchant's activity.

The sheer scale of the alleged scheme also demonstrates the potential impact of seemingly minor individual transactions. A fraudulent charge of a few euros or dollars may appear insignificant to a single victim, but millions of such transactions can produce hundreds of millions of euros in illicit revenue.

This is one reason why criminals may deliberately structure fraud around low-value payments. Small amounts are less likely to attract immediate attention from individual customers and may also be less likely to trigger conventional transaction monitoring thresholds.

The alleged strategy of using unclear transaction descriptions reinforces this point. If customers cannot easily identify the merchant associated with a charge, they may be less likely to dispute it, allowing the fraudulent activity to continue for longer.

The case consequently has implications for both financial institutions and online businesses. Payment providers need systems capable of detecting suspicious merchant behaviour, while legitimate merchants must ensure that billing practices and transaction descriptors are transparent enough for customers to identify payments correctly.

The prosecution now moves to the next stage, with the Koblenz Regional Court expected to determine whether the indictment will be admitted and whether the main trial will proceed.

Until the court makes a determination, the allegations against the nine defendants remain unproven. The indictment nevertheless provides a detailed picture of the alleged network and the methods investigators believe were used to exploit the payment system.

Operation Chargeback illustrates how cyber-enabled fraud has evolved into a sophisticated form of organised financial crime. The alleged perpetrators did not simply steal individual card numbers and make isolated purchases. They are accused of creating websites, subscription structures, intermediary companies and payment relationships capable of processing fraudulent transactions on an industrial scale.

The case also demonstrates that financial crime can exploit weaknesses at multiple points in the financial system. Criminal networks may target consumers to obtain payment credentials, businesses to obtain access to payment processing and financial institutions to move or integrate the resulting proceeds.

For payment companies, the central lesson is that onboarding and ongoing monitoring must be treated as interconnected processes. A customer that passes an initial due diligence assessment may subsequently display behaviour that fundamentally changes its risk profile.

For regulators and law enforcement agencies, the case illustrates the value of following financial infrastructure rather than focusing solely on individual victims. Tracing payment flows and identifying the entities processing fraudulent transactions can reveal the organisational structure behind apparently unrelated fraud incidents.

The alleged involvement of people working within payment service providers also underlines the importance of internal controls, conflicts-of-interest procedures and independent compliance oversight. Financial institutions must consider the possibility that insiders or external intermediaries can undermine controls that would otherwise prevent high-risk businesses from accessing their systems.

The scale of the alleged losses makes Operation Chargeback one of the more significant recent payment-fraud investigations in Germany. More than €260 million in suspected losses, millions of affected cardholders and an alleged additional €750 million in attempted charges demonstrate the enormous financial impact that can arise from automated, cross-border fraud.

Ultimately, the case is a reminder that the same technology and payment infrastructure that make legitimate digital commerce possible can also be exploited by organised criminal networks. Protecting the financial system requires not only effective customer identification and transaction monitoring, but also a clear understanding of how apparently legitimate businesses can be used to disguise fraudulent activity.

The outcome of the proceedings will determine whether the allegations against the nine defendants are ultimately proven. For now, the case provides a significant example of the increasingly sophisticated relationship between cybercrime, payment fraud, money laundering and the misuse of legitimate financial infrastructure.

By fLEXI tEAM