Cyprus Shell Companies Linked to €300M Credit Card Fraud Scheme

​A global investigation led by Eurojust has exposed a large-scale credit card fraud operation, revealing how a network of shell companies based in Cyprus and the United Kingdom helped fuel a €300 million scam. Authorities report that the fraudulent scheme, which ran between 2016 and 2021, involved the creation of nearly 19 million fake user accounts across 193 countries. These accounts were used to run small, recurring charges on stolen credit card data, often disguised as legitimate subscriptions for services like dating and streaming platforms.

The criminal network's operation was so complex that it involved compromised payment platforms and shell companies, some of which were allegedly acquired through "Crime-as-a-Service" providers. The fraudsters relied on the anonymity provided by these structures to launder money and evade detection.

Investigators estimate that the fraud cost victims at least €300 million, with over €750 million in attempted fraud. Five senior employees at payment service providers in Germany are also suspected of colluding with the perpetrators. The investigation, which involved multiple law enforcement agencies from Europe and North America, was triggered by suspicious transactions traced by Luxembourg's Financial Intelligence Unit. These findings were later shared with German and U.S. authorities, ultimately revealing the global scale of the operation.

Ned Conway, Executive Secretary of the Wolfsberg Group, emphasized the importance of clearer channels for information-sharing between traditional and decentralized finance systems to combat such crimes. The operation has been described as one of the most complex cybercrime investigations in Europe, with contributions from over ten countries, including Germany, the UK, Spain, Canada, and the U.S.

In response to the rising tide of fraud, the Cyprus Securities and Exchange Commission (CySEC) recently suspended public access to its certification registers after scammers were found misusing certified professionals' details for impersonation schemes targeting investors.