Fintech accounts laundered funds
- Cybercriminals used fake or compromised French fintech business accounts to move stolen funds through SEPA and cross‑border payments. - Attackers shifted money within minutes, exploiting fast payment rails and weak onboarding controls. - The case highlights the operational need for real‑time monitoring, transaction throttles and stronger identity verification (cybersecuritynews.com).
Cybercriminals are using French fintech business accounts to wash stolen money through euro transfers before banks can stop it. (group-ib.com) Group-IB said on April 22 that the accounts are opened on platforms such as Revolut, Wise and N26, often in the name of freelancers or one-person businesses. Once verified, those accounts can send Single Euro Payments Area, or SEPA, instant transfers and cross-border payments from a business profile that looks legitimate. (group-ib.com) A mule account is a pass-through account: stolen funds arrive, then leave again within minutes. Group-IB said verified European freelancer fintech accounts were selling on criminal markets for about $300 to $700 each. (group-ib.com) The speed matters because Europe has spent the past two years making instant euro payments more common. The European Central Bank said the European Union adopted its Instant Payments Regulation on March 13, 2024, and euro-area providers had to receive instant payments by January 9, 2025 and send them by October 9, 2025. (ecb.europa.eu) The same regulation added a “verification of payee” check, which tells a sender whether the account name matches the intended recipient before money is sent. In the euro area, that check became mandatory on October 9, 2025 for banks and other payment service providers covered by the rule. (ecb.europa.eu) Fraud losses are already concentrated in credit transfers. The European Banking Authority and the European Central Bank said on December 15, 2025 that total payment fraud in the European Economic Area reached €4.2 billion in 2024, with about €2.2 billion tied to credit transfers. (ecb.europa.eu) In France, anti-money-laundering supervision sits with the Autorité de contrôle prudentiel et de résolution, or ACPR, which oversees banks and insurers and can open disciplinary proceedings over compliance failures. The ACPR also works with Tracfin, France’s financial intelligence unit, on money-laundering enforcement. (acpr.banque-france.fr) This fits a wider European pattern of criminals hiding behind lawful-looking companies. Europol said in December 2024 that 86% of the European Union’s most threatening criminal networks use legal business structures to support crimes including money laundering. (cybersecuritynews.com) The operational gap is not that the payments system is slow; it is that stolen money can move faster than manual review. That leaves fintechs trying to catch fake businesses, compromised accounts and rapid onward transfers in real time, before the trail disappears. (group-ib.com)
