Police arrest 18 in anti-fraud operation linked to ‘quishing’ scam

Police forces have arrested 18 people and searched locations across the world in a massive investigation into global scam networks, including one revealed by TBIJ.

German prosecutors announced on Wednesday that they had dismantled three large fraud and money-laundering networks that they said had systematically abused online payment systems.

Police agencies confirmed that Aether, which was previously known as Linkmedia, was one of the groups under investigation. Earlier this year TBIJ and ITV News revealed Aether was involved in creating thousands of scam websites that targeted victims across the world.

The group was at the centre of an international network based out of Dubai, and is connected to a millionaire with UK links. In particular, it was responsible for some of the fake QR codes placed at publicly owned car parks across the UK.

These “quishing” scams trick consumers into entering their bank details, then siphon off their cash. We found that almost a third of local councils had been hit by the schemes in the past year.

The years-long police operation, codenamed “Chargeback”, involved coordinated action by Europol and other agencies across nine countries, culminating in the arrests earlier this week. Sixty addresses were searched, including in the UK, Germany, the Netherlands, Singapore, Canada and Cyprus.

Investigators allege that the networks misused about 4.3 million people’s credit card data to process nearly 20m fake online subscriptions between 2016 and 2021. The victims were spread across more than 190 countries.

The payments were made through sham websites that appeared to offer streaming, dating, and entertainment services, but in reality existed only to charge victims’ cards.

The authorities believe the suspects used numerous shell companies, primarily registered in the UK and Cyprus. These companies were allegedly used to spread out the fraudulent transactions, minimising the risk of chargebacks and detection. The shell companies were said to have been set up using “crime-as-a-service providers” who supplied complete corporate structures, including fake directors and documentation.

According to investigators, four major German payment service providers – including Worldline – were compromised and used to process the fraudulent transactions.

Our investigation earlier this year focused on Worldline and revealed that its lax due diligence allowed suspect networks to remain active despite internal concerns.

Worldline’s German subsidiary PayOne said it had already terminated business relationships in the “high risk segment of its e-commerce portfolio” in 2013 and coordinated with regulators to bring in anti-fraud measures. The company said it was unaware of any criminal investigations against it or any of its employees and would not comment on ongoing investigations.

The findings were part of the Dirty Payments investigation conducted by TBIJ and 20 international media partners led and coordinated by the network European Investigative Collaborations (EIC), based on confidential documents and data obtained by EIC.

Authorities estimated all three networks had brought in more than €300m and attempted to steal or launder another €750m. Police allege that the proceeds were laundered through a web of German bank accounts to disguise their origins, amounting to more than 100,000 individual acts of suspected money laundering.

Aether did not respond to a request for comment.

Martina Link, vice president of the Federal Criminal Police Office in Germany, said: “With the successful investigations to identify the criminal networks and the resulting arrests, the German and international authorities have dealt a significant blow to the global financial fraud scene.

“The proceedings highlight the increasingly complex structures of cross-border economic crime, but also the effectiveness of the investigating authorities and their partners.”