Action to counter undeclared labour and tax fraud in Germany: five arrests

Source: Eurojust

11 October 2024|

Eurojust supported authorities in Germany, Croatia, Czechia and Italy to counter a long-term fraud with illegal or undeclared labour and tax evasion. During an action day, five suspects were arrested for allegedly running a network of building enterprises that employed labourers without paying taxes and social levies. In total, 47 places were searched in the four countries concerned.

The perpetrators set up three different building companies, mainly operating in and around the city of Münster in Germany, which did not pay taxes or social levies on the wages of their employees. To mask this fraud, a string of so-called service companies were set up in the Czechia, which supplied fake invoices. One of the suspects also functioned as alleged manager or administrator of some of the enterprises, to give the fraud an official front.

The fraud ran at least since 2019 and was uncovered by the Public Prosecutor’s Office of Münster in North-Rhine Westphalia. At their request, Eurojust supported the recent action day, with the execution of European Investigation Orders in the four countries and provided legal assistance.

Operations were carried out at the request of and by the following authorities:

  • Germany: Public Prosecutor’s Office Münster; Main Custom Office Münster; Tax Investigation Münster
  • Croatia: County State Attorney’s Office in Rijeka
  • Czechia: Municipal Public Prosecutor’s Office Prague; Regional Police Directorate Prague, Economic Crime Unit; Regional Police Directorate České Budějovice, Economic Crime Unit
  • Italy: Public Prosecutor’s Office Trieste; Carabinieri Unit at Public Prosecutor’s Office Trieste

Three Belarusian nationals charged for forcing Polish plane to land to arrest dissident

Source: Eurojust

Belarusian air traffic controllers forced the aircraft to divert from its route to Vilnius by providing false information about an alleged explosive device, forcing the pilots to make an emergency landing at Minsk airport. After the aircraft landed in Minsk, the passengers were evacuated and their luggage was searched.

During the evacuation, two passengers, a Belarusian dissident and his companion, were arrested by officials. Investigations into the incident revealed that these arrests were the real reason the flight was diverted to Minsk.

Immediately after the incident, investigations were launched by the Polish and Lithuanian authorities. With the support of Eurojust, a joint investigation team (JIT) team was set up, which interviewed a number of witnesses, including passengers and the crew of the aircraft, and secured recordings and photographs taken during the incident.

The unprecedented nature of the case called for very close cooperation between multiple countries. Eurojust organised several coordination meetings and facilitated the execution of European Investigation Orders in Bulgaria, Greece and Romania to secure evidence and the requests for legal assistance in Switzerland, Norway and the United States.

Witnesses testified that air traffic controllers were informed of the false bomb threat by their superiors. The air traffic controllers were then instructed by Belarusian officials on what action to take and what information to pass on to the pilots of the aircraft.

The cooperation of the authorities led to the issuing of arrest warrants for three Belarusian nationals. The suspects are charged with unlawfully depriving 132 people of their liberty through terrorist acts and intending to seriously intimidate numerous people, including groups opposed to the Belarusian regime. Detention on remand for three months is imposed on all suspects.

The following authorities were involved in the actions:

  • Lithuania: Department for Organised Crime and Corruption Investigation at the Prosecutor General’s Office, Criminal Police Bureau
  • Poland: Mazovian Division of the Department for Organised Crime and Corruption of the National Public Prosecutor’s Office; Internal Security Agency

Fugitive Italian crime leader arrested in Slovenia

Source: Eurojust

A fast and coordinated action by Italian and Slovenian authorities, supported by Eurojust, has led to the arrest of a dangerous criminal hiding in Koper, Slovenia. The leader of an Italian organised crime group (OCG) was on the run from a 21-year prison sentence. He had been convicted of several crimes including drug trafficking, extortion and kidnapping.

The Italian OCG leader, of Calabrian origin, fled on the eve of his conviction in February this year. A national and European Arrest Warrant was issued for the 40-year-old fugitive. Complex investigations lasting several months were launched. The fugitive was finally located in Slovenia through a phone tapping and surveillance operation.

It was at this point that Eurojust became involved in the operation by executing a European Investigation Order (EIO). The EIO enabled surveillance activities in Slovenia, including phone tracking and physical tailing. In just 10 days, the EIO was executed and the Slovenian and Italian authorities were able to pinpoint the fugitive’s precise location in Koper, leading to his arrest on 20 August.

In February, the OCG leader was sentenced to 21 years in prison. The Italian was the leader of a criminal organisation that trafficked cocaine throughout Italy. He was also convicted of other crimes such as robbery, fraud, embezzlement, extortion, kidnapping and the illegal possession of weapons. In a separate trial, he was found guilty of mafia-related offences.

The following authorities were involved in the actions:

  • Italy: General Prosecution Office at the Court of Appeal of Perugia; Carabinieri – ROS (Special Operational Department); Anti-crime Section of Ancona and Investigation Unit of Fermo; SIRENE Office at the Italian Ministry of Internal Affairs.
  • Slovenia: Public Prosecution Office of Koper; Police Directorate in Koper.

Website used for child pornography, prostitution and drug dealing taken down with support of Eurojust

Source: Eurojust

An online platform known for facilitating various crimes was taken down by the French authorities, in cooperation with Bulgaria, Germany Lithuania, the Netherlands and Hungary. The authorities had been investigating the digital platform since December 2023. During an action day on 24 June the servers located in Germany were seized and disconnected and over EUR 5.6 million of criminal funds were frozen.

The website was used for many years to facilitate a range of criminal activities, in particular for child pornography, sexual exploitation, drug dealing, ambushes and even homicides. Criminals were able to send messages and connect with other criminals active in their criminal activities.

Since 2021, more than 23 000 judicial procedures have been initiated involving the online platform. At least 480 victims of the platform have been heard during these judicial procedures. Investigations into the platform were started by French authorities in December 2023. These investigations showed that the platform was concealing and facilitating transactions for organised crime groups and was enabling criminal activities such as pimping and paedophilia.

A coordinated action to take down the website was carried out with the full support of Eurojust. The authorities seized the servers located in Germany, which resulted in the platform being disconnected and the display of a splash page. The Lithuanian and Hungarian authorities ensured the swift execution of freezing orders, which led to the freezing of over EUR 5.6 million in criminal funds.

At the same time, a European Investigation Order (EIO), issued from France, was successfully executed in Bulgaria. All investigative actions have been carried out in presence of French magistrates and officials from the Law enforcement authorities of France upon authorisation by the competent Bulgarian authorities. As part of the execution of the EIO, bank statements were  revealed, searches and seizures were carried out and witnesses were questioned.

The actions were carried out by the following authorities:

  • France: PPO Paris JUNALCO (National Jurisdiction against organised Crime) Cybercrime Unit; Gendarmerie Nationale – Cybercrime unit; ONAF (Anti Fraud National Office)
  • Bulgaria: Sofia City PPO and General Police Directorate Combating Organised Crime
  • Germany: Public Prosecutor’s Office Limburg; Hessian State Criminal Police Office
  • Hungary: Budapest IX. District Public Prosecutor’s Office
  • Lithuania: Vilnius Regional Prosecutor’s Office
  • The Netherlands: Public Prosecutor’s Office Amsterdam

Successful operation against cryptocurrency scam coordinated by Eurojust

Source: Eurojust

A coordinated operation to uncover an intricate cryptocurrency scam led to the arrest of a suspect in France. The investigation in Portugal, France, Germany, Italy and Romania, supported by Eurojust and Europol, revealed that the suspects were using a scam method known as ‘rip deals’ that caused losses of EUR 700 000 to Portuguese victims.

Scammers using the ’rip deal’ method trick their victims into exchanging money via a fraudulent money exchange programme, which they then use to steal the victim’s assets.

Investigations revealed that the suspects scammed victims across Europe, including in Austria, Italy, Portugal, Spain and Switzerland. The suspects would approach their victims by expressing an interest in acquiring commercial businesses. After gaining their trust and convincing them to install crypto asset wallets, the suspects would steal the victim’s funds.

In the next phase of the scam, other members of the organised crime group would launder the proceeds of the fraud by moving them through several crypto assets. This made it difficult to trace the proceeds.

The investigation, spanning several years, culminated in an action day supported by Eurojust and Europol. During the operation, carried out simultaneously in France, Germany, Italy, and Romania, one suspect was arrested and several houses were searched. Authorities froze multiple bank accounts and seized material goods such as equipment containing information on the scam.

Eurojust supported the investigation by enabling cooperation between the countries involved in the operation. The coordination meeting at Eurojust helped the authorities to exchange information and prepare for the action day. Additionally, Eurojust supported the execution of European Investigation Orders (EIOs), European Arrest Warrants (EAWs), and freezing orders.

The following authorities were involved in the coordinated operation:

  • Portugal: Regional Department for Criminal Investigation and Prosecution of Coimbra; Judicial Police
  • France: Judiciary Tribunal of Bobigny; National Police 93
  • Germany: Public Prosecutor’s Office Darmstadt; ZK32 at Criminal Directorate Offenbach, Southeast Hesse Police
  • Italy: Public Prosecutor Office in Milan; Italian State Police – Cyber Security Operations Centre “Lombardia” in Milan
  • Romania: Directorate for Investigating Organized Crime and Terrorism – Territorial Structure Timișoara; Romanian Police, Office of Combating Organised Crime Timisoara – Unit Combating Informatics Crimes.

Major operation to take down dangerous malware systems

Source: Eurojust

In an unprecedented operation against aggressive and dangerous computer malware, authorities in the European Union and beyond have taken actions against droppers including IcedID, Pikabot, Smokeloader, Bumblebee and Trickbot, which infiltrated computers via emails. The measures focused on disrupting criminal services through arresting suspects, the freezing of illegal proceeds, and taking down botnets, coordinated by Eurojust. The operation, which was carried out this week with support of Europol, is a follow up to the successful takedown of the Emotet malware system in 2021.

During actions carried out simultaneously in Germany, the Netherlands, France, Denmark, Ukraine, the United States and United Kingdom, 4 suspects were arrested, who offered the malware as a professional blackmail service to other criminal actors. Some of the suspects were involved in operating Emotet in the past.

Via so called ‘sinkholing’ techniques or the use of tools to access the systems of operators behind the malware, investigators managed to block and take down the botnets. Malware droppers are types of malicious software which downloads viruses, ransomware or spyware on computers. They are generally installed via mails with infected links or Word and PDF attachments, such as shipping invoices or order forms, to get access to personal data and or bank accounts of computer users.

Mainly enterprises and national authorities and institutions were made victims of the series of malware systems which now have been taken down. Users are warned to be careful when opening links and attachments to mails and check the origin of mails.

The investigations, which have been ongoing since the takedown of Emotet, also focused on the running of that malware itself as their operators did create the new botnets mentioned. During the coordinated actions 16 places were searched.

In total over 100 servers were taken down or disrupted and over 2 000 domains are under control of law enforcement authorities.

Furthermore, investigations showed that one of the main suspects has earned at least EUR 69 million in cryptocurrency by renting out criminal infrastructure for the deployment of ransomware. The transactions are constantly being monitored and legal permission to seize these assets instantly through future actions has already been obtained.

Eurojust set up a coordination centre on its premises to manage simultaneous actions in all countries concerned. The Agency also assisted national authorities in the preparation and execution of European Arrest Warrants, European Investigation Orders and requests for Mutual Legal Assistance, and organized five coordination meetings.

The following national authorities were involved in the operations on the ground:

  • Germany: Prosecutor General’s Office Frankfurt am Main – Cyber Crime Center; Federal Criminal Police Office (Bundeskriminalamt)
  • The Netherlands: National Prosecution Service; National Police
  • Austria: Public Prosecutor’s Office of Salzburg; Criminal Intelligence Service Austria (Bundeskriminalamt)
  • Denmark: National Special Crime Unit (NSK)
  • France: Prosecutor’s Office JUNALCO (National Jurisdiction against Organised Crime) Cybercrime Unit; Gendarmerie Nationale C3N
  • Ukraine: Prosecutor General’s Office; Main Investigation Department of National Police of Ukraine; Cyber Department of the Security Service of Ukraine
  • United Kingdom: National Crime Agency
  • United States: United States Department of Justice, Federal Bureau of Investigation, The Defense Criminal Investigative Service

Eurojust supports arrest of nine human traffickers in France and Spain

Source: Eurojust

An organised crime group (OCG) active in human trafficking and sexual exploitation has been exposed, and suspected members were arrested with the support of Eurojust and Europol. The arrest of nine suspects in France and Spain has stopped the structured human trafficking network in its tracks. Six victims of the human traffickers were taken to safety.

After French authorities discovered an apartment that was used for prostitution in 2022, an investigation was launched that exposed the network’s activities in human trafficking and sexual exploitation in France and Spain. The victims, mostly from Latin America, the Caribbean and Romania, were taken to France and then moved around the country to engage in prostitution in apartments rented for short periods by the OCG. Members of the network used the internet to advertise paid sexual services.

Following the operation and arrests of the suspects, six victims in France were offered assistance and shelter by a dedicated non-profit organisation.

To prepare for the action day, Eurojust organised a coordination meeting between the French and Spanish authorities, ensuring smooth cooperation for the coordinated actions. Eurojust also assisted in the execution of several European Investigation Orders, freezing orders and European Arrest Warrants.

These actions were carried out by the following authorities:

  • France: JIRS Nancy (Interregional Specialised Jurisdiction) and OCRTEH (Central Office against human trafficking)
  • Spain: Audiencia Nacional (Central Investigative Courts num 1 & 2 and PPO) at judicial level and UCRIF (Policía Nacional) at police level

Support to arrest 22 suspects forcing female victims into prostitution

Source: Eurojust

Specific members of the OCG used the so-called ‘lover boy’ method, pretending to engage personally with women from a poor background in Bulgaria and other countries in Eastern Europe and promising them good job opportunities in Italy. In reality, their passports were taken away and the victims were forced into prostitution in Italy in dire conditions.

The OCG had a clear division of roles, with certain members being responsible for luring the victims to Italy and others taking care of transport and controlling them, occasionally under extreme duress.

The Italian authorities started investigating the OCG in 2021, and a year later Eurojust was contacted to coordinate the cooperation with their counterparts in Bulgaria, via the National Desks of both countries at the Agency.

Eurojust provided support with the execution of European Investigations Orders and requests for Mutual Legal Assistance, as well as the setting up of a coordination meeting. During the joint action day, assistance was also provided to the three competent Bulgarian Prosecution Offices in order to rapidly execute European Arrest Warrants for seven of the suspects, who were residing in Bulgaria.

The tracing and arrest activities in Bulgaria were carried out via the European Network of Fugitive Active Search Teams, specifically by the Bulgarian team, upon activation by their counterparts in Italy, which provided constant information.

The operations on the ground were carried out at the request of and by:

  • Italy: Public Prosecutor’s Office of Lecce; Italian State Police HQ of Lecce; Fugitive Active Search Team (FAST) Italy, at the Service for International Police Cooperation (SCIP) of the Ministry of Internal Affairs.
  • Bulgaria: FAST Bulgaria, at the General Directorate of the National Police – Wanted and Missing Persons Unit.

Support to halt money laundering in Italy via tax fraud and fake invoices

Source: Eurojust

Eurojust has supported judicial authorities in Italy, Portugal and Spain in halting an elaborate money-laundering scheme via tax fraud. In a coordinated operation, five suspects have been arrested in Italy and Spain for laundering illicit criminal proceeds by committing VAT fraud on the alleged import of frozen fish from Portugal and Spain. The main suspect is associated with the Cosa Nostra mafia-type criminal organisation.

© – Guardia di Finanza

In a recent operation, approximately EUR 3.3 million in cash, luxury vehicles and jewellery were seized. This includes the seizing of cash and blocking of bank accounts worth around EUR 600 000 by the Spanish authorities. In total, twelve individuals are currently under investigation by the Italian authorities, including the five suspects who were detained.

The suspects were allegedly involved in a criminal network that laundered money via a complex tax fraud scheme, using fake invoices and avoiding the payment of VAT to the Italian authorities. For this purpose, an enterprise for the importing of frozen fish products from Portugal and Spain was set up. They are now formally suspected of money laundering, tax fraud, criminal association and the fraudulent transfer of valuables.

Eurojust assisted with the execution of European Arrest Warrants and European Investigation Orders, as well as freezing orders, via the National Desks of Italy, Portugal and Spain. The operations on the ground were carried out at the request of and supported by the following authorities:

  • Italy: Public Prosecutor’s Office of Genoa; Guardia di Finanza (Central Service for Investigation on Organised Crime – SCICO)
  • Portugal: DCIAP (Departamento Central de Investigação e Acção Penal); TCIC (Tribunal Central de Instrução Criminal)
  • Spain: Investigative Judge no. 4 Vigo (Juzgado Instruccion no. 4): Audiencia Nacional Pulbic Prosecutor (Fiscalia Audiencia Nacional); UDEF Policia Nacional and Catalan Mossos d’Esquadra

Over 100 searches and four arrests in Latvia, Germany, France, Italy and Malta against financial institution involved in money laundering

Source: Eurojust

National authorities in Latvia, Germany, France, Italy and Malta have carried out over 100 searches in a large-scale operation against a Russian-Eurasian criminal network and a Maltese-based financial institution allegedly involved in money-laundering services. Four suspects were detained during an action day supported by Eurojust and Europol. Potential suspects and witnesses were also interviewed in Latvia, Germany, Estonia and Malta.

During the actions, over 460 police officers were deployed to carry out the searches. Germany also deployed four officers to support the investigations and searches in Latvia and Malta. In addition to the arrests, various bank accounts and properties were seized.

The Maltese financial institution laundered at least EUR 4.5 million in proceedings from criminal activities since end of 2015. The total sum of laundered money could amount to tens of millions of euros. The financial institution and organised crime group (OCG) behind it offered money-laundering services via a network of fake enterprises and individuals who were registered directors, without performing any real business activities.

The OCG operated mainly from Riga and Berlin. Investigations were initiated in 2021 by the Latvian authorities after they noticed unusual money transfers from Latvia to the Maltese financial institution. Simultaneously, the German authorities had started investigations into suspicious money flows involving the same financial institution.

Eurojust supported today’s concerted action by setting up a coordination centre and establishing and funding a joint investigation team between the German and Latvian authorities. The Agency also organised five dedicated coordination meetings to prepare for the action day and assisted with the execution of European Investigation Orders in the countries involved.

On the action day, Europol deployed a money laundering expert to Latvia and set up a mobile office at Eurojust’s coordination centre to support the operation. Since December 2021, Europol has been supporting the investigation by providing operational and financial analysis and operational expertise. The Agency also supported the joint investigation team and provided financial support to the case.

Today’s operations were carried out by the following authorities:

  • Latvia: Rīga Northern Prosecution Office; Rīga Judicial Region Prosecution Office; 1st Unit of the Economic Crime Enforcement Department of the Central Criminal Police Department of the State Police
  • Germany: Public Prosecutor‘s Office Berlin (Staatsanwaltschaft Berlin); State Office of Criminal Investigations Berlin (Landeskriminalamt Berlin)
  • Estonia: Office of the Prosecutor General of the Republic of Estonia and Estonian Police and Border Guard Board
  • France: Public Prosecutor’s Office and Investigative Judge – Judicial Court of Nice; National Police (DIPN) Alpes-Maritimes Division (Judicial Police Nice; Research and Intervention Brigade; Financial Brigade) – Border Police
  • Italy: Public Prosecutor’s Office Rome; Guardia di Finanza, Financial Police Unit Rome (Nucleo Polizia Economica e Finanziaria di Roma)
  • Malta: Financial Crimes Investigations Department and Asset Recovery Bureau of the Malta Police