Operation Klonen bank fraud investigators have arrested four suspects in Brazil and charged three more in Europe over an elaborate scheme that drained roughly €30 million from Commerzbank customers through an exploited flaw at a payment service provider. The theft, which unfolded over four days in November 2023, was investigated jointly by Brazil’s Federal Police and Germany’s BKA.
Neither agency named the affected financial institution in their official communications, but Brazilian media identified it as Commerzbank, which the bank itself did not contradict. A Commerzbank spokesperson confirmed to BleepingComputer that customers were affected but suffered no financial losses. ‘The fraud case is known and dates back to 2023. Due to technical issues at a service provider, unauthorized direct debits were made from customer accounts. There was no financial loss to customers. We cooperated closely and extensively with the authorities,’ the spokesperson said.
How the Hackers Exploited a Software Flaw
German authorities say the attackers exploited a software vulnerability introduced by a faulty update to a payment and transaction-processing system. In November 2023, they initiated numerous unauthorised withdrawals from various German online banking accounts and routed the stolen funds to Brazil through a larger network designed to conceal their origin. The largest portion of the funds was withdrawn in Brazil; a smaller share was cashed out across four European countries.
To move and obscure the proceeds, investigators found the group used pass-through accounts, companies, payment institutions, virtual-asset platforms, and payment cards issued without the beneficiaries’ consent, a layered laundering operation designed to put as much distance as possible between the stolen funds and their source.
Operation Klonen Raids Span Seven Brazilian Cities
Brazil’s Federal Police launched Operation Klonen with BKA support, executing 21 search-and-seizure warrants across seven cities. Four suspects were taken into custody under preventive detention warrants in Rio de Janeiro, Guarulhos, Goiânia, and Carapicuíba. Among the items seized during the raids was a 3-D printer used to manufacture weapons, according to Circuit Magazine, adding an unexpected dimension to what was primarily a financial crime investigation.
A Brazilian federal court also ordered the seizure of financial assets, vehicles, and real estate worth up to R$106 million ($22.4 million). The arrested suspects face charges including aggravated theft through electronic fraud, participation in a criminal organisation, and money laundering.
Three further suspects identified in Europe will be prosecuted in Spain and Bulgaria by law enforcement in those countries.
A Suspect on the Campaign Trail
Perhaps the most striking detail to emerge from the investigation is the political dimension. Authorities found that one of the arrested suspects ran for elected office in 2024 and used a portion of the illicit funds to finance their campaign. Circuit Magazine reported that the candidate had stood for city council in Rio de Janeiro, injecting stolen bank fraud proceeds directly into Brazilian electoral politics.
Commerzbank, which generates more than €11.1 billion in annual revenue, has repeatedly stressed that its own customers were made whole despite the scale of the theft. The bank’s position is that the vulnerability lay with a third-party service provider rather than its own systems, a distinction that will nonetheless attract scrutiny given the volume of funds that moved undetected over four days.
The prosecutions in Spain and Bulgaria are expected to proceed in parallel with the Brazilian criminal process, keeping Operation Klonen bank fraud cases active across three continents simultaneously.
