The Netherlands Police website (politie.nl) is reporting that on July 7, two Dutch nationals aged 45 and 34 and a 34-year-old Belgian national were arrested in Cyprus, where they all lived. That same day, a 25-year-old Belgian national was arrested in Belgium. On July 10, a 44-year-old Dutch national with no permanent address was arrested in Athens, Greece. More arrests may follow. The main suspect was surrendered to the Netherlands. The Examining Magistrate has issued a pre-trial detention order of 14 days.

In May and July, the Netherlands Police said it dealt a firm blow in the fight against investment fraud. A man travelling from Dubai to Poland was arrested. He is suspected of playing a major and indispensable role in a criminal organisation that employed over 700 people. They worked together to defraud hundreds of victims every day using professional and ruthless methods. It is estimated that this organisation stole over €100 million each month across various countries.

The main suspect is a 46-year-old man who holds dual Israeli and Polish nationality. He is a known figure in the cybercrime scene. Information available online shows that he has been previously prosecuted for breaking into the systems of various prominent foreign government organisations and is a notorious hacker. He is now suspected of playing a key role in a criminal organisation involved in investment fraud. Following a request by the Netherlands Police, he was arrested at an airport in Poland on 26 May.

Israel news sources identified the 46-year-old man as Ehud Tenenbaum, known in hacking circles as The Analyzer. Ehud Tenenbaum became famous in the late 1990s, when he was arrested for hacking computers belonging to NASA, while still a teenager. In 2010 he pled guilty to a $1.5 million credit card fraud scheme.

According to the police’s information, there are approximately 20 call centres worldwide that employ over 700 people pretending to be financial advisers. The Belgian police arrested five such employees.

How did the investment fraud work?

The ‘financial advisers’ or ‘account managers’ were in almost daily contact – online or by phone – with victims who want to start investing. By being in regular contact, sometimes over several months, these fraudsters build up a trusting relationship with their victims. The victims’ first investment always involved a relatively low sum of money and yields a profit immediately. The online platform on which victims can monitor their investments looks very real, but their money is not being invested anywhere. Using kindness and sly tricks, the fraudsters manipulate their victims into investing ever larger sums of money. The money – often in crypto currency – that they believe they are investing ends up in the hands of the fraudsters.

Hundreds of reports made, millions in profit

Currently, around 550 reports made by victims in the Netherlands can be linked to this criminal organisation. During the investigation, the Netherlands Police worked together closely with the Belgian police. In Belgium around 200 cases had been reported. During the investigation, it was found that many victims were not aware they had been defrauded. Many of them were contacted by the police to prevent further financial damage. The police does not yet know how many victims this criminal organisation has targeted worldwide, but it estimates that there are tens of thousands of them. The collective damage suffered by the Dutch victims amounts to nearly €25 million.

Most victims of this fraud lost over €10,000 each. The financial investigation is currently in full swing and includes an effort to identify any assets that may be frozen or seized.

Complex investigation

The investigation has revealed that this criminal organisation has been active since at least 2021. It was set up like a professional business. Hundreds of employees of various nationalities worked in approximately 20 offices across various countries. There was one head office that managed the other offices. Each office had multiple teams, and each team focused on a different country where they targeted victims.

One of the main call centre offices was in Cyprus, where a number of the supposed financial advisers were arrested, as described above.

The organisation did everything it could to remain hidden from the outside world. Employees used pseudonyms and technological means to conceal their true identity and location. The main suspect’s expert knowledge and skills were instrumental in allowing the organisation to operate for so long before it was dismantled.

By investigating financial and digital traces, including IP addresses, used by the criminals, the police were able to secure and examine important equipment. These provided insight into the functioning of the criminal organisation. This way, the Netherlands Police succeeded in tracking down the locations of the various offices and the identity of multiple suspects.

Shutting down the organisation and further investigation

The Netherlands Police have contacted the commercial parties which hosted the criminal organisation’s digital infrastructure. Collaboration with these parties resulted in key elements of the digital infrastructure being taken offline. The Netherlands police also worked with Europol to share details about the suspects with various countries, so that they can be prosecuted.