Rethymno: electronic fraud on Regional Unit account

A service bank account of the Rethymno Regional Unit was emptied within a few hours, following an electronic fraud that began on Friday 21 August 2026. According to the reports, an employee of the service carried out an official transaction that day, unknowingly entering a fake environment built to resemble the official environment of the partner bank. This is how the perpetrators stole the access codes. In the early hours of Monday 24 August 2026, they carried out 55 successive transactions, which moved the money out of the service’s account.

The exact amount does not match between the two sources, and the discrepancy needs to be noted: ERT cites 140,000 euros, while Flashnews reports 150,000 euros, with the transactions placed between around 03:00 and 05:00. The fraud was noticed a few hours later, when the movement in the account was detected. The employee and her supervisor were called in and gave statements to Rethymno Security, describing the procedure that had been followed. As stated, only two employees of the Regional Unit know the codes for these particular transactions, a detail that significantly narrows the circle of people with access.

This is not a private account but public money, and that is what makes it significant for Rethymno and for the operation of the regional administration. According to the reports, administrative circles have expressed puzzlement as to why there were no safeguards blocking official service transactions outside working hours, when no regular payment would be justified at that time. No official announcement from the Region of Crete on the incident was found, so it is not known what the administration’s position is, whether an internal audit has been ordered, or whether payment approval procedures are being changed.

The case is being handled by the Rethymno Sub-Directorate for Crime Suppression and Detection, while the bank is also tracing the transactions to establish where the money ended up. It is not known whether a suspect has been identified, whether the transactions led to accounts in Greece or abroad, or whether there is a chance of recovering part of the amount. It is also not clarified who bears responsibility for making good the loss, a question that will only be answered once the investigation is complete and it is established how the payment system’s safeguards were bypassed. It is not known whether the service account handled payments to third parties or payroll, so it cannot be assessed whether the loss affects current obligations of the Regional Unit, and it is not clarified whether the 55 transactions were of equal or varying amounts. Neither of the two sources names the partner bank.