Police in Helsinki announced on Tuesday that more than 40 individuals were suspected of involvement in up to ten related scam operations which defrauded victims of an estimated 375,000 euros over the course of a year.
The police's preliminary investigation into six of the cases revealed that the banking and personal data of hundreds of people were stolen by the scammers using a variation of similar methods. The stolen data was then used to apply for loans from financial institutions.
Police believe the suspects are Finnish and Estonian, and that they obtained victims' banking information through fraudulent phishing messages sent in the name of companies such as Posti. The first wave of scam text messages were sent out in April 2020 and the most recent in the first few days of January 2021.
Each of the ten cases are being probed as aggravated fraud, police added, and are in various stages of investigation.
Fraud method carefully planned and "exceptionally complex"
The suspected crimes were carefully planned and executed, police said in a statement.
For example, some victims received a text message appearing to have come from national mail carrier Posti informing them that they had received a package, and that they had to click on the link in the message to provide further details in order to complete the delivery process.
The sensitive personal data was captured by the fraudsters when the victim opened the link in the text message and sought to confirm their identity using their bank identification information. This stolen data was then used to apply for bank loans in the victim's name.
"The money obtained was then quickly transferred between different bank accounts and individuals to others," Detective Inspector Matias Björklund said in a police press release. "In this way, an attempt was made to disguise the origin of the money. One individual could have opened up to ten accounts for this purpose alone. It also emerged that the perpetrators had contingency plans in place just in case any cash flow became disrupted in the midst of securing the proceeds of their crimes."
Eventually, the money was withdrawn from ATMs in Finland and abroad, and was then delivered to pre-agreed locations from where it was picked up and transported onwards, the police added.
"The method is exceptionally well-planned and complex. It took weeks before we fully understood how these very carefully coordinated crimes were carried out," Björklund said.
Arrest leads to breakthrough
Police said they began to untangle the web when a suspect was taken into police custody in Espoo on suspicion of using identity theft to fraudulently withdraw money from an ATM.
About 4,000 euros in cash was found in the suspect's possession, which was seized by police. A bank card in the name of another suspect as well as other incriminating evidence were also seized.
Police added that 12 suspects believed to have been involved in three phishing waves carried out during the autumn of 2020 applied for a total of 176 loans from several finance companies. Cash in excess of 80,000 euros related to these loans was then withdrawn from ATMs.
Two people are suspected of having participated in a total of six different waves of the fraudulent operation.