Kathimerini Greece Newsroom
Authorities are unraveling what prosecutors call the nation’s most extensive cyberfraud operation, accused of siphoning funds from hundreds of online bank accounts through a sprawling network of coordinated scams.
A 750-page investigative dossier outlines an elaborate structure involving 1,298 people suspected of orchestrating or participating in 669 confirmed frauds since February 2022, generating more than €6 million in illegal gains.
The syndicate is believed to have run operations from multiple regions across Greece, including Corfu, Crete, Thessaloniki and the Cyclades, with targets ranging from small businesses and media companies to religious institutions.
Investigators said the group maintained a strict chain of command, unlike the loosely organized phone scams seen in the past. Roles were clearly divided among ringleaders, managers, call center operators, data specialists and “money mules.” Members allegedly sent phishing texts impersonating banks to capture login credentials. In one documented case, a victim identified as K.S. was tricked into clicking a fake bank link in May 2022, losing €78,690.
Police traced the operation’s core to Roma settlements in Zephyri, Zevgolatio and Examilia, where improvised call centers made hundreds of fraudulent calls daily. The makeshift offices reportedly shifted locations frequently to stay ahead of authorities.
Many suspects were related to one another, with the more tech-savvy handling electronic systems and online transactions. “Money mules,” paid between €200 and €600, handed over their debit cards and access codes, then reported them lost to cover the tracks of stolen funds.
The scale of the investigation has overwhelmed prosecutors. One directive ordered police to “bring order to the files” and create separate case folders for each defendant. “This is among the most voluminous case files ever assembled, making management extremely challenging,” defense lawyer Konstantinos Gogos said.
U.S. legal assistance and cooperation from Google played a key role in tracing the group’s digital infrastructure, including phishing domains and linked accounts.
