Chats by alleged fraudster who impersonated banks presented in court

Chats by an alleged fraudster who impersonated banks were presented to court on Wednesday along with explanations of how such schemes operate.

The details were presented as evidence against suspected fraudster Tammy Caruana, a 25-year-old St Paul’s Bay woman who is accused of duping some 200 people and defrauding them out of €1 million. She is pleading not guilty.

The first to take the stand on Wednesday was inspector Claire Vella Borg, who is stationed at the Financial Crimes Investigation Department. She told the court that in 2025, several police requests were made to local mobile phone providers for call data and call profiles, among others. Go Plc provided the police with an Excel sheet containing the data. One mobile phone number, although it was not registered on Caruana, was associated with the Revolut account she had been using.

Fraud Prevention Specialist at Go Mobile Charmaine Galea Triganza, who provided the inspector with the information requested, was the next to take the witness stand. She explained that the company investigated Call Line Identification Spoofing (CLI), which is a fraudulent technique where callers deliberately falsify information transmitted to a recipient’s caller ID display to disguise their identity.

The witness said that as a telephone operator, the company could stop such calls. She explained that in the data presented in court, there was the local number, which was described as the “incoming carrier” but the company could determine exactly from where the call originated. Comparing the call to a parcel being delivered by couriers, the witness said that if something was shipped from China, which was then sent to Germany, then to Italy and Malta, they would only be able to see Italy to Malta. Such calls could not be made using what appeared to be a fixed line, and in fact such attempts were stopped following a collaboration between Go and Malta Communications Authority (MCA). However, with mobile phone numbers, the witness explained that if she were in Italy calling someone in Malta, the carrier would appear as Italian, and therefore could not be stopped. Scammers allegedly used numbers resembling numbers used by banks, however, sometimes they had a digit which was either missing or extra. The witness explained that for SMSs it was a bit more complicated.

A police officer from the Cybercrime unit explained that he was present for a search in Qrendi where electronic devices had been seized. He analysed an iMac and Apple laptop found during the search. In the analysis officials found evidence in connection to the case, including links from where SMSs from a computer were sent to mobile devices, applications to mask the identity of the perpetrator, applications relating to Virtual Private Networks (VPNs), bank transfers and job searches in connection with call centres. They also found that the user of the laptop had allegedly searched things like “what is 15% of €1,000?”.

The witness explained that since Apple’s infrastructure allowed one to link all the devices, the information was synchronised. From Caruana’s Messenger chats, the police found potential seed phrases - a sequence of random words that stored the data required to access or recover cryptocurrency.

The accused did not provide passwords

Vella Borg then took the stand again and explained that Caruana did not provide the password to her devices, but the police opened an iPhone 16 on the day. From the analysis, it emerged that she told her mother she earned €5,000 a month. She told others that she was working with someone else, between 8:30am and 1:30pm, in cryptocurrency and was earning between €1,000 to €2,000 a week.

She told another person that she was a secretary within a company and took care of the clients.

The police also found that Caruana had searched for different amounts for different percentages, for example 30 percent of €7,000. 

A lot of evidence was extracted from Caruana’s iPhone 16 including two seed phrases associated with two wallets. The first wallet had a total of $12,268 incoming transactions while the second wallet had over $82,000.

The inspector briefly delved into the contents of Caruana’s chats which showed how the scheme worked. A chat in question was created earlier this year, with the police suspecting that an earlier chat was likely deleted.

From the chat it emerged that Caruana received instructions and information about the victims. She would then call them up and set up pages that resembled bank pages. From these chats it emerged that they would test before approaching the victims and discuss the amounts to be taken out of their victims’ accounts.

Vella Borg highlighted arguments between Caruana and her associates, when transactions were unsuccessful.  

It also transpired that Caruana and her associates discussed taking more money out of a victim’s account after realising that it was a business account, Caruana allegedly said “let’s get more”.

Caruana complained that she wanted to make money too, in the chats retrieved by the police.

There were also heated arguments with her associates, one of which was a voice recording played out in court in which she told them that she explained for “55 times” but the victim “did not know how to press a fucking button”. 

A video was played out showing a scam being carried out targeting someone in Turkey.

Screenshots of the testing messages which would later be sent to victims were also shown in court.

The case continues later this month.

Magistrate Lara Lanfranco is presiding over the case.

A G lawyers Mauro Abela and Marica Ciantar prosecuted, assisted by police inspector Claire Vella Borg.

Lawyers Roberto Spiteri and Franco Galea appeared for the accused. Lawyer Stefano Filletti and Maria Lisa Buttigieg appeared on behalf of BOV and BNF, respectively.