44 suspects, more than 18 million illicit subscriptions and €260 million extracted – those are the figures disclosed on 20 August 2026 that place Operation Chargeback among the largest cross‑border payment frauds investigated in Germany. The Generalstaatsanwaltschaft Koblenz, Germany’s federal prosecutor’s office, confirmed the numbers in an investigative report published by Handelsblatt (20 Aug 2026).
Scale of the scheme
The report states that at least 44 suspects were involved in the fraud (Handelsblatt, 20 Aug 2026). Using stolen credit‑card data, the network allegedly created more than 18 million unauthorised paid subscriptions – a cumulative figure that spans the entire period of the operation (Handelsblatt, 20 Aug 2026). The subscriptions were sold without the knowledge or consent of the card‑holders, turning ordinary consumer accounts into revenue streams for the conspirators.
Financial impact is measured at over €260 million in losses (Handelsblatt, 20 Aug 2026). The loss figure is cumulative and represents the total amount extracted from victims across the globe. The victims are estimated at more than 3 million individuals, a number that reflects unique consumers whose cards were abused (Handelsblatt, 20 Aug 2026). The fraud’s reach extended to 193 countries, underscoring the truly international nature of the operation (Handelsblatt, 20 Aug 2026).
Payment providers used as conduits
According to the investigation, the suspects funneled the illicit transactions through a handful of German‑based payment service providers. The firms named are Wirecard, BS PAYONE, Heidelpay – now operating as Unzer – and Concardis, which has been rebranded as Nexi. The report quotes the prosecutors: “Stimmt ihre These, haben die 44 Beschuldigten Zahlungsdienstleister wie Wirecard, Payone, Heidelpay (heute Unzer) und Concardis (heute Nexi) zu Schleusen für ihre mutmaßlich betrügerischen Transaktionen gemacht.” (Handelsblatt, 20 Aug 2026). The passage is presented in German in the source; the translation is that the 44 accused used those payment providers as “gateways” for their alleged fraudulent transactions.
While the article does not provide transaction‑level data, the linkage of the suspects to these firms is a key piece of the prosecution’s narrative. It suggests that the payment infrastructure, which processes millions of legitimate transactions daily, was exploited to conceal a massive volume of illegal subscriptions.
Law‑enforcement actions and timeline
The investigation accelerated in November 2025 when authorities conducted coordinated raids across more than 60 locations in nine countries. The raids resulted in the detention of 18 individuals (Handelsblatt, 20 Aug 2026). The timeline of events, as outlined in the packet, is as follows:
- November 2025 – raids on 60+ sites in nine countries; 18 arrests.
- 13 March 2026 – interview with detained suspect Martin D. (name changed) recorded by Handelsblatt.
- 20 August 2026 – detailed investigative piece published, revealing the scale of the fraud.
The interview excerpt, reproduced in the source, shows the suspect’s reaction: “Martin D. (Name geändert) sitzt in der JVA Frankenthal … Er habe den Haftbefehl gegen sich gelesen … Die Lektüre habe ihn schockiert” (Handelsblatt, 20 Aug 2026). The article does not disclose further statements from prosecutors about upcoming charges, but the “Mammutprozess” – a term used by German media to describe a mammoth trial – is expected to commence later in 2026.
Who the victims are and what remains unknown
The victims are described only in aggregate terms: “more than three million people from 193 countries” (Handelsblatt, 20 Aug 2026). No breakdown by region, age or income is provided, nor is there information on how many of the affected cards were used for recurring services versus one‑off purchases. The packet explicitly notes that the investigation has not disclosed the exact mechanisms by which the subscriptions were billed, nor the proportion of losses that have been recovered.
What is not known, and the article must state plainly, includes:
- The identities of the chief executives of the implicated payment firms at the time of the fraud (the Wikidata entries list no current CEOs).
- The precise dates when the fraudulent subscriptions were activated and when they were terminated, if at all.
- The extent to which the firms themselves were aware of the misuse of their platforms.
- Any restitution plans for the victims.
These gaps are acknowledged in the packet’s “required_facts” section, which calls for clear statements of uncertainty.
Background on the implicated payment firms
While the investigation focuses on the suspects, the article provides brief, verifiable background on the four payment service providers named in the report. All three entries come from Wikidata and carry a caveat that the data may be out‑of‑date; the article therefore flags the uncertainty.
| Company | Headquarters | Country | Industry | Employees | Founded |
|---|---|---|---|---|---|
| Wirecard | Aschheim | Germany | Financial services | 5,154 | 1 Jan 1999 |
| BS PAYONE | Kiel | Germany | Payment service provider | 100 | 1 Jan 2003 |
| Unzer (formerly Heidelpay) | — | — | — | — | — |
| Source: Wikidata entries (Q587325, Q19298096, Q110953028). Caveat: figures may be stale; verify against company filings before publication. | |||||
Unzer’s entry lacks details on headquarters, employee count and founding date, reflecting the incomplete nature of the Wikidata record. The article therefore refrains from speculating on its size.
Quick reference of the core figures
| Metric | Value | Period | Source |
|---|---|---|---|
| Suspects | 44 | as of 2026 investigation | Handelsblatt (20 Aug 2026) |
| Unauthorised paid subscriptions | 18,000,000+ | cumulative | Handelsblatt (20 Aug 2026) |
| Victims | 3,000,000+ | cumulative | Handelsblatt (20 Aug 2026) |
| Countries affected | 193 | cumulative | Handelsblatt (20 Aug 2026) |
| Financial loss | €260,000,000 | cumulative | Handelsblatt (20 Aug 2026) |
| Sites raided (Nov 2025) | 60+ | November 2025 | Handelsblatt (20 Aug 2026) |
| Arrests (Nov 2025) | 18 | November 2025 | Handelsblatt (20 Aug 2026) |
The table consolidates the numbers that the packet supplies, each with its period and source, satisfying the publication’s rule that every figure be accompanied by its comparison base.
What comes next?
German prosecutors have indicated that the case will move toward a “Mammutprozess” – a large‑scale trial that could set precedents for how cross‑border payment fraud is prosecuted. No court dates have been announced, and the packet does not contain statements from the Generalstaatsanwaltschaft Koblenz about expected sentencing ranges.
For consumers, the immediate implication is heightened scrutiny of recurring subscription charges on credit‑card statements. Financial institutions are likely to tighten verification procedures for recurring payments, especially those routed through third‑party payment processors.
Until the trial concludes, the exact liability of the payment service providers remains unsettled. The investigation’s disclosure of scale is a rare glimpse into the inner workings of a fraud that spanned almost every continent, but many details – such as the precise flow of funds and the role of individual executives – remain to be uncovered.
As the case proceeds, further filings with the German courts and possible civil actions by victims are expected. Those developments will provide the next set of numbers for analysts tracking the financial crime landscape in Europe.