European law enforcement dismantled a vast credit card fraud and money-laundering network that allegedly exploited the infrastructure of four major German payment service providers to process illicit transactions worth hundreds of millions of dollars, Europol said on Wednesday.

The cross-border investigation led to more than 60 house searches and 18 arrests across Germany, the U.S., Canada, Singapore, Luxembourg, Cyprus, Spain, Italy and the Netherlands. More than 40 suspects were located in Germany alone.

Between 2016 and 2021, the groups allegedly used stolen credit card data from over 4.3 million cardholders worldwide to set up about 19 million fake online subscriptions to pornography, dating and streaming websites.

These professionally built websites were deliberately hidden from search engines and designed to charge small, recurring payments — about $57 a month — with vague billing descriptions, making it difficult for victims to detect unauthorized charges.

According to the German Federal Criminal Police Office (BKA), the suspects abused the payment infrastructure of four unnamed German providers to push fraudulent transactions through legitimate systems.

Six individuals, including former executives, compliance officers and risk managers from Germany, Canada and Austria, allegedly helped the criminal networks gain access to the firms’ infrastructure in exchange for fees.

The suspects reportedly used thousands of shell companies registered in the United Kingdom and Cyprus to disguise their activities and reduce the risk of chargebacks. These entities were allegedly supplied by “crime-as-a-service” vendors who provided full corporate packages, including fake directors and forged know your customer (KYC) documents.

Authorities said more than 2,000 German bank accounts were used to launder the proceeds. One payment provider is accused of developing customized software that allowed funds to be moved through virtual accounts, masking the origin of transfers from financial institutions.

The investigation, which began in late 2020, is ongoing as Europol and national police analyze seized data and communications. The suspects face potential charges of organized computer fraud, money laundering and participation in a criminal organization.

In a separate operation earlier this week, European authorities arrested nine suspects in Cyprus, Spain and Germany over a $700 million cryptocurrency investment scam network that created dozens of fake trading platforms promising high returns but instead siphoned off investor funds.