Operation Chargeback: 4.3 million cardholders affected, EUR 300 million in damages

On 4 November 2025, an international coordinated action day targeted three major fraud and money laundering networks as part of Operation “Chargeback.” Led by the Cybercrime Department (Landeszentralstelle Cybercrime) of the General Prosecutor’s Office (Generalstaatsanwaltschaft) in Koblenz, Germany, and the German Federal Criminal Police Office (Bundeskriminalamt), the operation has been investigating these networks since December 2020. More than 60 house searches were conducted and a total of 18 arrest warrants executed. The criminal networks are suspected of misusing credit card data from over 4.3 million cardholders across 193 countries. In total, the estimated damage from the fraud scheme exceeds EUR 300 million, with attempted damages amounting to over EUR 750 million.

Europol supported this investigation, which targeted 44 suspects from Germany and other countries. Among the suspects are individuals allegedly involved in the fraud networks, executives from German payment service providers, intermediaries, crime-as-a-service providers who supplied shell companies, and an independent risk manager.

In Germany alone, investigators searched 29 premises across several Federal States and executed five arrest warrants. Over 250 officers from the Federal Criminal Police Office, the Public Prosecutor General’s Office in Koblenz, the Federal Financial Supervisory Authority (BaFin), and the tax investigation unit were involved. As part of the investigation, assets worth over EUR 35 million were secured in Luxembourg and Germany.

Modus operandi in this alleged fraud scheme

Between 2016 and 2021, the suspects allegedly used stolen credit card data to create around 19 million fake online subscriptions on professionally operated websites, primarily offering pornography, dating, and streaming services. These websites were designed to evade search engine indexing, making them accessible only through direct URLs or links. The charges on credit cards were kept low, around EUR 50 per month, with obscure descriptions, making it difficult for cardholders to identify unauthorised transactions.

Involvement of payment service providers

The suspects allegedly exploited the infrastructure of four major German payment service providers to process and launder the illicit transactions. Six suspects, including executives and compliance officers, are accused of colluding with the fraud networks, enabling them to access the payment infrastructure in exchange for fees.

Money laundering and shell companies

To conceal their activities, the suspects used numerous shell companies, primarily registered in the UK and Cyprus. These companies were used to distribute the fraudulent transactions, minimising the risk of chargebacks and detection. The shell companies were obtained through crime-as-a-service providers, who supplied complete corporate structures, including fake directors and Know-Your-Customer (KYC) documents.

International cooperation

On the action day on 4 November 2025, coordinated measures were taken in Germany, the USA, Canada, Singapore, Luxembourg, Cyprus, Spain, Italy, and the Netherlands, with support from Europol and Eurojust. Numerous search warrants were executed, leading to the seizure of documents, data carriers and communication devices. Arrest warrants were also served, and significant assets were frozen.

The action day followed extensive investigations, both nationally and internationally, involving over 90 legal assistance requests to 30 countries. The success of the operation is attributed to the close cooperation with authorities in the USA, Canada, Singapore, the UK, Luxembourg, the Netherlands, Cyprus, and Spain, as well as the coordination efforts of Eurojust and Europol.

Catherine De Bolle

Europol Executive Director

Operation Chargeback is a testament to the power of international cooperation in dismantling complex criminal networks. It underscores the critical role Europol plays in supporting law enforcement agencies across the globe. By leveraging our analytical capabilities and facilitating cross-border coordination, we have been able to bring down the networks defrauding millions of credit card users worldwide. This success demonstrates our commitment to staying ahead of evolving criminal threats. Together, we are making significant strides in the fight against serious and organised crime.

Magnus Brunner

EU Commissioner for Internal Affairs and Migration

The cross-border cooperation within the EU and with partners, coordinated by Europol, leads to meaningful global results. This is why we are working to update Europol’s mandate – to better support our law enforcement in protecting our citizens. We must boost our efforts against serious and organised crime by ensuring law enforcement has access to the data it needs. Today, over 85% of investigations rely on online evidence, and without this data, the fight against crime cannot be effective.

Europol’s support

Europol supported this investigation since May 2023, providing analytical support, organising several operational meetings and supporting the localisation of suspects. Law enforcement cooperation across all concerned countries was facilitated by the network of Liaison Bureaux situated at the Europol Headquarters in The Hague. On the action day, a crypto expert was deployed in Luxembourg, while another Europol expert took part in the coordination centre set up at Eurojust to support the joint action day in all countries concerned.

Eurojust also enabled the cross-border judicial cooperation with the United Kingdom and United States via their Liaison Prosecutors at Eurojust and with the authorities in Canada and Singapore via its network of Contact Points. The seized evidence is currently being analysed, and further legal actions are expected to follow. For now, the suspects face charges of organised computer fraud, membership in a criminal organisation and money laundering.

More information: Europol