Criminal suspicions | The 16- and 23-year-olds suspected of the S-Bank fraud series squandered money on Louis Vuitton bags and gambling

S-bank The number of stakeholders in the series of frauds targeting customers has increased from the previously estimated two hundred to around three hundred, says the investigation director of the case, the crime commissioner Klaus Geiger.

The Länsi-Uusimaa police announced a little over a week ago that they were investigating a series of data breaches and frauds that started in May, in which money was taken from the accounts of S-bank’s customers via account transfers. The crimes exploited a vulnerability in the bank’s information system.

At this stage, the case is being investigated at least under the criminal headings of aggravated payment instrument fraud, aggravated money laundering and data breach.

The two main suspects, aged 16 and 23, are in custody. According to the police, the main suspects who live in the capital region are friends with each other.

Director of investigations Geiger says that the proceeds of crime from the skein are estimated to be over one million euros. According to an estimate previously presented in public, 940,000 euros were suspected to have been taken from the victims’ accounts.

The police suspect that in addition to bank transfers, the suspects have taken out loans using the bank’s usernames.

“To what extent is still unclear. We are aware of one loan application, which is around 80,000 euros,” says Geiger.

“Furthermore, money games have been played with the victims’ money, and a profit has been made with it. That is also a benefit of crime. It cautiously talks about 100,000 euros.”

According to the police’s suspicions, the money was also used for high life and invested in, for example, cryptocurrencies.

“A lot of money has been spent on travel and luxury goods, such as Louis Vuittons. The debts of close relatives have been paid off and money has been given to friends. It can be seen that it has also been used for narcotics,” describes Geiger.

Police seeks to recover the proceeds of crime. According to Geiger, however, this will be behind hard work and digging.

“Although the suspects have been very cooperative, they have not started to open the proceeds of crime. It has not been brought up that there is still that criminal benefit.”

At this stage, the police cannot estimate how much of the money could have already been spent.

“There are many events, money has been circulated in different money transfer companies and through different bank accounts. Tracking the cash flow of criminal proceeds is tedious.”

The two of you in addition to the main suspect, the police also have several other suspects in the case in a smaller role.

They are suspected of either basic or felony money laundering – that is, not of participating in the data breach series itself.

“It is suspected that this criminal profit obtained in payment instrument fraud has been laundered in it.”

According to Geiger’s conservative estimate, there are currently five to seven other suspects.

“They are close friends or acquaintances of the main suspects.”

Helsingin Sanomat previously reported that several minors have been involved in the group. There have also been adults close to the young people who, according to Geiger, are suspected of helping in transferring the money to other accounts, for example.

The police according to suspicions, the crimes started in May of this year and continued throughout the summer. According to Geiger, the criminal benefit was used until the end of July.

According to the police’s current information, there are 53 suspected payment instrument frauds. In addition, there are approximately 150–250 data breaches under investigation.

There are victims of crimes in different parts of Finland, but the preliminary investigation is concentrated in the police stations of Western and Eastern Uusimaa. All the suspects live in Finland, and at least the main suspects live in Espoo.

According to the police, the suspects discovered the vulnerability of S-bank’s system by chance. So it was not an activity that required programming skills or a cyber attack.

According to Geiger, at least the second main suspect has had a “good level of knowledge” when it comes to IT skills.

S Bank said on Tuesday of last week that “a limited number” of its customers had the opportunity for almost four months “in certain situations” to log into another customer’s online bank. According to the bank, the vulnerability has since been fixed.

Geiger says that the police have also investigated the matter in cooperation with S-bank, which is currently the interested party in the case.

The police will decide later whether responsible persons from S-bank will also be suspected of a crime related to the events.

“The police will assess S-bank’s position at a later stage.”

The data protection commissioner has already said that he is investigating the personal data security breach that occurred. The data protection commissioner investigates, among other things, how S-bank takes care of data protection and reacts to a data security breach.