Bank Payment Attacks: Four Arrests in Brazil Over €30 Million Fraud

Operation Between Brazil and Germany

Four suspected cybercriminals have been arrested in Brazil as part of an investigation coordinated by Brazil’s Polícia Federal and Germany’s Bundeskriminalamt (BKA). Three other suspects were identified in Europe and may face legal proceedings in Spain and Bulgaria.

The operation, dubbed Operation Klonen, led to the execution of 21 search and seizure warrants across seven Brazilian cities. The arrests took place in Rio de Janeiro, Guarulhos, Goiânia, and Carapicuíba.

Authorities have charged the suspects with aggravated theft through electronic fraud, participation in a criminal organization, and money laundering. A Brazilian federal court also ordered the seizure of financial assets, vehicles, and real estate worth up to 106 million Brazilian reais—approximately $22.4 million.

The investigation concerns a criminal operation carried out over four days in November 2023. Total losses are estimated at around €30 million, equivalent to $34.6 million.

Vulnerability Introduced by a Faulty Update

According to investigators, the attackers allegedly exploited a vulnerability that emerged after a faulty software update was installed at a service provider.

The affected component was part of the infrastructure used by a financial institution to process payments and transactions. The issue allegedly enabled numerous unauthorized debits or withdrawals from German online banking accounts.

The incident is therefore not being described as a straightforward compromise of customers’ credentials. The entry point was reportedly a defect introduced into the provider’s technology supply chain, within a system with access to payment flows.

Neither the provider’s identity nor the affected software versions have been disclosed. No patch, corrective update, or technical workaround for platform operators has been publicly identified.

German authorities have not publicly named the affected financial institution. Brazilian media have linked it to Commerzbank, a European bank with annual revenue exceeding €11.1 billion.

The bank confirmed that some of its customers were affected by unauthorized direct debits caused by technical problems at a service provider. Commerzbank said, however, that account holders did not suffer financial losses and that it had cooperated with investigators.

From Withdrawal to Money Transfer

The perpetrators allegedly initiated numerous withdrawals from several online banking accounts, subsequently moving the money to Brazil through a network designed to make its origins more difficult to trace.

Most of the funds were reportedly withdrawn in Brazil. A smaller portion was converted into cash in four European countries.

The money-laundering operation allegedly involved multiple financial and corporate layers, including transit accounts, companies, payment institutions, virtual asset platforms, and payment cards issued without the beneficiaries’ consent.

This structure would have separated the initial account access from the subsequent transfer and cash-out stages. The money could therefore pass through several intermediaries before being withdrawn or converted, increasing the complexity of forensic analysis.

The involvement of individuals in multiple countries explains the cooperation between the Polícia Federal and the BKA. The arrests in Brazil are accompanied by proceedings expected in Spain and Bulgaria, where three additional suspects were reportedly identified.

An Investigation with Political Implications

One of the arrested individuals was a candidate for elected office in 2024. According to investigators, some of the illegally obtained funds were allegedly used to finance the political campaign.

This detail adds another dimension to a case that began as a payment-system fraud. The seizure of assets worth up to 106 million Brazilian reais is intended not only to recover part of the funds, but also to prevent the accumulated assets from being transferred or dissipated.

The value of the seized assets exceeds the estimated loss in euros, but the two figures are not directly comparable: the Brazilian order covers financial assets and property linked to the suspects, not necessarily money still held in the accounts used in the fraud.

The investigation must determine the precise role of each suspect, the origin of the funds, and the relationship between those arrested in Brazil and the individuals identified in Europe.

Risk for Banks and Service Providers

The incident highlights the risks associated with software updates distributed by providers operating within critical financial processes. A defect in a processing platform can have consequences far broader than those normally associated with an application vulnerability.

When a component handles payments, debits, or transfers, an error can directly affect transaction integrity. The attack surface then includes not only the bank’s systems, but also the provider’s code, access controls, and oversight processes.

The case also illustrates how difficult it can be to distinguish a technical malfunction from fraudulent activity at an early stage. A faulty update can disrupt operational flows; attackers exploiting that condition can turn the anomaly into a coordinated sequence of transactions.

A contextual finding from the Blue Report 2026 indicates that, after initial access is obtained with valid credentials, defenses block attacker activity in only 37% of cases. The statistic is based on 338 million simulations conducted in customers’ production environments and concerns the ability to counter individual techniques.

The figure does not directly measure this incident, but it helps explain why legitimate or apparently legitimate access to financial systems may remain operational long enough to support complex fraud schemes.

What Organizations Can Check

No vulnerable versions, technical indicators, file names, addresses, or other details useful for immediate system searches have been disclosed. As a result, the incident cannot currently be linked to a specific patch or detection rule.

Banks and providers involved in payment processes can nevertheless review updates installed in the period preceding the criminal operation, correlating changes with anomalous spikes in debits and withdrawals.

Controls should also cover:

• repeated transactions to newly established accounts;
• transfers to intermediaries or virtual asset platforms;
• unusual issuance of payment cards;
• valid-credential logins followed by out-of-profile activity;
• sudden changes to beneficiaries or transaction limits.

The provider should also be able to determine which components were updated, which technical accounts operated on the systems, and which controls validated the transactions.

At present, the measures made public are primarily investigative and judicial: international cooperation, arrests, searches, and asset seizures. It is not known whether the provider has released a fix, modified the service architecture, or introduced additional controls for payment operations.