Romania and Italy: “Operation Bruno”, on banking fraud scheme using spear phishing e-mails impersonating tax authorities to steal online banking credentials

2026 marks the 25^th anniversary of the Convention on Cybercrime (also known as the Budapest Convention ).

H ere are 25 selected real cases and operations against cybercrime that speak for themselves on the usefulness and relevance of the Convention and its framework in the daily work of criminal justice authorities worldwide, working on fighting against cybercrime and protecting you and your rights in cyberspace.

Back to the main page

25 cases

Back Romania and Italy: “Operation Bruno”, on banking fraud scheme using spear phishing e-mails impersonating tax authorities to steal online banking credentials

Romania and Italy: “Operation Bruno”, on banking fraud scheme using spear phishing e-mails impersonating tax authorities to steal online banking credentials

Operation “Bruno” represented the first time Romania and Italy established a Joint Investigation Team (JIT) and employed cross border data preservation to secure critical digital evidence throughout a case. This two-year investigation by Romanian and Italian Police, supported by Europol and Eurojust, culminated on 28 March 2018 with dozens of house and computer searches and the arrest of 20 suspects across both countries for a banking fraud scheme that netted over EUR 1 million from hundreds of customers of two major Italian banks.

The organised crime group, mainly composed of Italian nationals, used spear phishing emails impersonating tax authorities to steal online banking credentials, then quietly transferred funds into accounts they controlled, in Romania. Beyond the fraud, the group was also suspected of money laundering, drug and human trafficking, and operating as a criminal organisation.

Operation “Bruno” was supported by several key provisions of the Convention on Cybercrime (Budapest Convention), including those addressing computer-related forgery and fraud (Article 7 and 8), the expedited preservation (Article 16/17/29) and production (Article 18) of digital evidence, and search and seizure procedures (Article 19). The Convention also facilitated international co-operation (Article 23) and mutual legal assistance (Article 25), enabling Romanian and Italian authorities to work together effectively, secure critical electronic data across borders, and conduct joint investigative actions against a criminal organisation engaged in large-scale banking fraud.