Poland Arrests Nine Suspects in PLN 337 Million Cyberfraud Money Laundering Case

Polish authorities have arrested nine people suspected of laundering approximately PLN 337 million generated by online fraud schemes, in an investigation involving cash couriers, currency exchange offices, bank transfers, fictitious gold purchases and cryptocurrency.

The coordinated operation took place in Łódź, Warsaw and the Małopolska region. The investigation is being conducted by the Regional Prosecutor’s Office in Łódź, with the involvement of Poland’s Central Bureau for Combating Cybercrime, the Border Guard and the Internal Security Agency.

The suspects, aged between 26 and 53, comprise four cashiers, three men managing currency exchange offices and two couriers responsible for transporting cash. Authorities allege that the group operated across Poland and internationally between February 2025 and July 2026, processing funds obtained through numerous online fraud schemes.

According to investigators, the suspected criminal activity involved proceeds from investment-platform scams, cryptocurrency-related fraud and other forms of online deception, including schemes involving Poland’s BLIK payment service and individuals impersonating bank employees or representatives of investment platforms.

Prosecutors estimate that the group handled approximately PLN 337 million during the period under investigation. The amount represents the estimated value of transactions allegedly connected to the laundering operation, rather than assets recovered by authorities.

The investigation uncovered an organised system for collecting and moving cash. Couriers allegedly collected money at designated meeting points, using photographs of torn banknotes displaying specific serial numbers as identification signals. The method enabled participants to recognise one another during cash handovers.

After collecting the funds, couriers allegedly delivered the money to designated currency exchange offices. Both the courier and the cashier reportedly received a secret code on their mobile phones. When the codes matched, the cash was accepted and processed without the usual anti-money laundering (AML) procedures being followed.

Investigators allege that the exchange offices formed part of a wider network operating in Poland and other countries. The suspected arrangement was used to obscure the origin of fraud proceeds and make it more difficult to establish the identity of the individuals responsible for the funds.

Some of the cash was reportedly deposited through cash-deposit facilities operated by a cooperating company before being transferred into bank accounts. From there, the money was moved to accounts belonging to connected entities. Other amounts were allegedly transported across national borders in specially prepared compartments concealed within vehicles.

Authorities also suspect that fictitious gold purchases were used to disguise the movement of funds. According to investigators, most of the proceeds were ultimately converted into or placed in cryptocurrency. The public information released so far does not identify the specific digital assets, cryptocurrency platforms or wallet addresses involved.

The alleged use of currency exchange offices, cash deposits, cross-border transportation, gold transactions and cryptocurrency allowed the funds to pass through several channels before reaching their final destinations. Investigators are examining the roles played by the different participants and the relationships between the transactions.

During searches of residential properties, offices and currency exchange premises, authorities seized cash and gold with a combined value exceeding PLN 1 million. Computers, mobile phones and other electronic data storage devices were also secured for examination.

A court ordered seven of the nine suspects to be held in pre-trial detention. Six were detained for three months, while another was placed in custody for two months. The remaining two suspects were released subject to financial guarantees, police supervision and restrictions on leaving Poland.

All nine suspects face allegations of participation in an organised criminal group and money laundering. Some also face additional allegations relating to failures to notify Poland’s General Inspector of Financial Information (GIIF) about suspicious transactions, as required under applicable anti-money laundering legislation.

The alleged reporting failures are a separate element of the investigation. Authorities are examining whether suspicious transactions were processed without the required notifications being submitted to the financial intelligence authority.

The case highlights the role that cash-intensive intermediaries can allegedly play in moving proceeds generated by cyberfraud. In this investigation, the suspected laundering chain extended beyond the initial fraud to include physical cash collection, exchange-office transactions, banking channels, purported gold purchases and cryptocurrency.

The investigation remains ongoing. The suspects have not been convicted, and the allegations must be established through the judicial process. If convicted of the alleged offences, they could face prison sentences of up to 15 years.

By fLEXI tEAM