Fraudulent shopping sites tied to cybercrime marketplace taken offline

Europol has supported the dismantling of a sophisticated criminal network responsible for facilitating large-scale online fraud. In an operation led by the Hanover Police Department (Polizeidirektion Hannover) and the Verden Public Prosecutor’s Office (Staatsanwaltschaft Verden) in Germany, and supported by law enforcement authorities across Europe, over 50 servers were seized, significant digital evidence was secured, and two key suspects were placed in pretrial detention.

The investigation began in the autumn of 2022, following reports of fraudulent phone calls in which scammers impersonated bank employees to extract sensitive information, such as addresses and security answers, from victims. The stolen data was traced back to a specialised online marketplace that operated as a central hub for the trade of illegally obtained information.

A central hub for cyber fraud

The marketplace allowed its thousands of users to buy stolen data sorted by region and account balance. This customisation enabled criminals to carry out targeted fraud with greater efficiency. 

Investigators also uncovered a network of fake online shops used to trick consumers into entering payment information, a method commonly referred to as phishing. The stolen credentials were then sold through the marketplace, generating significant profits for its operators.

Cross-border crackdown on cyber fraud infrastructure

On 4 December, coordinated actions were carried across Europe. Searches were conducted in Germany and Austria, while infrastructure linked to the marketplace and fake shops was dismantled in Germany, Finland, the Netherlands and Norway.

Law enforcement seized over 50 servers, securing more than 200 terabytes of digital evidence. 

The two main suspects – a 27-year-old and a 37-year-old – were arrested in Germany and Austria respectively under European arrest warrants and are currently in pretrial detention.

Europol’s unique support to Member States’ investigations

Europol has been closely involved in this investigation for over two years, providing a vital platform for cooperation and intelligence sharing between law enforcement agencies across Europe and beyond.

Its European Cybercrime Centre (EC3) deployed its full range of resources and expertise, ensuring that every aspect of this complex operation was covered. Europol’s unique forensic capabilities played a pivotal role in advancing the case, offering tailored solutions to analyse and secure the complex digital evidence.

In addition, Europol deployed a dedicated taskforce of data scientists who worked to process and interpret vast amounts of data, uncovering crucial connections. During the action day, three EC3 experts were deployed to Germany and Austria to assist the national authorities in their enforcement actions. 

The following authorities took part in the operation:

• Austria: State Office of Criminal Investigation (Landeskriminalamt)
• Czechia: Bureau of Criminal Police and Investigation Service, Regional Police Directorate of the Capital City of Prague
• Finland: National Bureau of Investigation (Keskusrikospoliisi)
• Germany: Hanover Police Department (Polizeidirektion Hannover), Verden Public Prosecutor’s Office (Staatsanwaltschaft Verden)
• The Netherlands: National Police (Politie)
• Poland: Central Cybercrime Bureau (Centralne Biuro Zwalczania Cyberprzestępczości)