ATM fraudsters halted in Europol-supported cross border operation led by Romanian and British authorities

A highly organised criminal group involved in large-scale fraud in Western Europe has been dismantled in a coordinated operation led by authorities from Romania and the United Kingdom (UK), supported by Europol and Eurojust. The gang had travelled from Romania to several Western European countries, mainly the UK, and withdrew large sums of money from ATM machines. They later laundered the proceeds by investing in real estate, companies, vacations and luxury products, including cars and jewellery.

The group members ostentatiously used a derogatory name against the police, which was displayed on the license plates of the cars they owned, on the T-shirts or clothes they wore, on posts on social networks, or even custom-made on the metal gate at the entrance to the courtyard of the house where one of them lived.

In December 2024, law enforcement conducted an operation against the group in the United Kingdom. On 23 July 2025, a follow-up action was carried out against the gang, this time in Bacău, Romania. This operation led to:

• 2 arrests
• 18 house searches
• Seizure of real estate, luxury cars, electronic devices and cash 

Europol’s role

Europol provided significant data analysis based on information collected by Romanian and British investigators, which proved essential to the success of the operation. During the course of the investigation, Europol also hosted several operational meetings and deployed an analyst to Romania to assist the national authorities with their enforcement actions. In addition, Europol supported the joint investigation team (JIT) signed at Eurojust by both Romania and the UK. 

Eurojust not only supported the setting up of the joint investigation team, but also provided cross-border judicial assistance and helped with the preparation of the action day on the ground in Romania

The “TRF” method

The gang committed fraud using the Transaction Reversal Fraud (TRF) method. The suspects removed the screen of an ATM and inserted a bank card to request funds. Before the funds were dispensed, they cancelled the transaction (or reversed it). This allowed them to reach inside the machine and take the cash before it was retracted. Investigators believe the criminal group stole an estimated amount of EUR 580 000 using this method.

The perpetrators were also involved in other criminal activities, including skimming, forging electronic means of payment and transport cards, and conducting bin attacks — a type of card fraud carried out using software designed to identify card numbers and generate illicit income through fraudulent payments.