€1million bank scam: Secure email tipped off police about scammer

Updated 2.47pm

An inspector told a court on Thursday that the police had been tipped off about an alleged scammer who defrauded bank clients out of €1 million by a person who sent an email through the secure Protonmail service.

The email contained Tammy Caruana's name and age, details about the spoofing and the application being used, and the suspect’s activities in cryptocurrency, among others. 

Police inspector Claire Vella Borg was testifying in the case against Caruana, a 25-year-old unemployed woman, who stands accused of money laundering, fraud, being part of an organised crime group, and criminal organisation, among others.

She denies the charges.

Taking the witness stand on Thursday morning, Vella Borg explained that in late September 2024, the police received several reports from BOV clients, who were alleging that a woman was calling them from a number similar to that of BOV’s and claiming that she was from BOV customer care.

The woman at the other end of the line was speaking in Maltese, but used different names, including Rachel and Sarah, among others.

The person on the phone would tell the unsuspecting victim that there had just been a transaction from their account, and whether they would want to authorise it or not, since it had been flagged by the bank.

The unsuspecting victims would say that they did not authorise any transactions and ask the caller to stop it.

The alleged victims were then told that they would receive a link by SMS, and that they should click it.

Known as 'smishing', such fake text messages appear to be from a trusted source and are used to trick users into clicking on malicious links.

The link led the alleged victims to a website purporting to be BOV, where they would input their username, first-time signature and second-time signature.

The caller would then tell them that the transaction has been halted, and she hangs up.

However, the alleged victims would actually receive a message from their bank informing them that the transaction was successful.

In other instances, the caller would recommend that the alleged victims delete and reinstall the BOV app.  The alleged victims would then call their bank and would be told that they had just fallen victim to a scam and should file a police report.

Vella Borg testified that initially, the police did not know whether the alleged scammer was real or whether it was an AI-generated voice. 

However, from the reports it emerged that the caller was patient with the alleged victims and would re-explain when they had any queries.

The police observed a pattern in the transactions: each time, the scam was under €5,000. Some were scammed multiple times, but each time it was below €5,000.

While not all the victims filed a report, the police managed to trace over 200 victims following queries with the bank.

The police then asked BOV to provide the IP addresses used for the transactions.

The police received reports from APS clients in mid-May 2025, using the same modus operandi.

The police then received a tip-off about Caruana: they were told she had a BMW and was unemployed. They were also told that she lived in Luqa, but when they looked into the property, they found Caruana's mother renting out the place.

On August 25, 2025, the police received an email via ProtonMail containing the name, surname, age, and crucial details about the scam. They established that Caruana had worked as an operator at Centrecom and later at eCabs and had customer care skills. The last time she worked was in February 2024.

The officers started to follow the woman on her public social media pages, including Instagram, Facebook and TikTok, which were all public until she entered into a relationship and changed the settings to private.

From her posts on Facebook, the police observed that she was living beyond her means since she was unemployed, was not receiving any social benefits and was not being financially sustained by her close-knit family.

Among others, the woman made frequent purchases on the Bolt and Wolt platforms, and was leasing two BMWs.

She also uploaded photos of stays at hotels, purchases of branded clothes, and underwent aesthetic procedures. She also featured in one of the posts, holding a substantial amount of cash. The woman rented out a place in Sliema before moving to Baħar iċ-Ċagħaq.

The police determined that the woman had accounts with BOV, APS and Revolut. While the accounts with the local banks were not being used, the woman made use of Revolut.

The police requested information from Revolut, which provided the investigators with Know Your Client documents (KYC) and bank statements.

From these statements, it was established that the woman was making several deposits in her wallet in cryptocurrency, mainly using Ethereum and Bitcoin.

The police requested information on who was making the cryptocurrency deposits; however, Revolut did not provide any information since the person was not Maltese.

The police sent a rogatory letter to the country in question, which has remained unanswered to this date.

Hexcodes mimic APS, BOV

The police found that the woman was receiving hexcodes which are then inserted into a website to be able to spoof and mimic APS and BOV.

Between May 19, 2025 and June 2, 2025, the police received reports from APS about their clients being scammed. During that time Caruana was receiving hexcodes for APS.

The police were informed that Caruana’s money was being kept by her relative.

The woman moved to Qrendi on January 18. An arrest warrant was subsequently requested.

On February 2, the police moved in and she was arrested in Valletta.

Several devices were seized by the police during the raid on the Qrendi apartment where she lived. The accused refused to give her passwords to the police.

In court, Borg Vella presented a preliminary report showing the transactions on blockchain, and over 200 reports filed by different bank clients.

Representatives of the different banks took the stand and presented different documentation relating to the different alleged victims. An APS representative told the court that out of ten scamming incidents, only two transactions succeeded, the rest were flagged immediately by the victims and there was a chargeback, while others were stopped by the bank when they noticed certain patterns.

At the end of the sitting, the parties made their submissions on bail. The court is set to rule on the matter from its chambers.

Magistrate Lara Lanfranco presided. 

AG lawyer Marica Ciantar prosecuted, assisted by police inspector Claire Vella Borg. 

Lawyer Roberto Spiteri appeared for the accused. 

Lawyer Stefano Filletti appeared for BOV.

Lawyers Roberto Spiteri and Franco Galea appeared for the accused.

More to follow.