Court hears how Tammy Caruana’s alleged fraud operations were identified after police received an anonymous letter outlining her operations
A total of €8,000 in cash, €5,000 found in a box bearing the accused’s name and a further €3,000 in an envelope, was discovered during police searches linked to an alleged large-scale online banking fraud.
The compilation of evidence against a 25-year-old woman from St Paul’s Bay continued in court on Thursday.
Tammy Caruana was remanded in custody after pleading not guilty to charges connected to an alleged online fraud scheme that affected around 200 people and resulted in losses estimated at approximately €1 million.
Caruana, who told the court she is unemployed, was arraigned following an extensive investigation by the Malta Police Force’s Financial Crimes Investigations Department (FCID), carried out in coordination with Europol and authorities in Ireland and the United Kingdom.
Police alleged Caruana was the main suspect behind an online fraud operation in which victims were contacted by phone by a woman impersonating a bank customer care representative, using different names during the calls.
How the scam operated
Testifying in court, inspector Claire Vella Borg of the FCID explained the investigation began in late September 2024 after police received numerous reports from Bank of Valletta customers.
Victims reported receiving phone calls informing them that suspicious transactions had been flagged on their accounts. They were told the transactions were on hold and needed confirmation. Victims were then informed they would receive a text message and were instructed to click on a link, which led to a webpage resembling the official BOV login page.
Victims were guided through the process of entering their banking usernames and authorising transactions using first-time and second-time digital signatures.
Once completed, they were instructed to delete and reinstall their banking applications.
Communication would then abruptly stop, and within days victims began receiving notifications of unauthorised transactions on their accounts. Most transactions were below €5,000, with some victims suffering multiple withdrawals.
Multiple banks affected
By May 2025, similar reports were received from APS Bank. Complaints later also emerged involving HSBC and BNF Bank.
As reports exceeded 100 victims, police requested IP address samples from the affected banks. While some IP addresses were Maltese, at least one originated from foreign locations, indicating possible international involvement.
Police later received an anonymous report from a Corradino Correctional Facility inmate identifying the suspect and providing details about her lifestyle, vehicle, and address. Investigations showed the accused was not employed at the time.
Lifestyle and financial investigations
Further inquiries revealed Caruana had previously been employed with Centrecom and later with eCabs, with her last recorded employment ending in February 2024.
Police monitoring of her publicly accessible social media profiles showed what investigators described as a lifestyle inconsistent with unemployment. Images reportedly depicted luxury-branded items, two vehicles, hotel stays, frequent takeaway meals, and photographs of Caruana holding large sums of cash.
No evidence was found indicating financial support from family members.
Financial investigations revealed that although Caruana held bank accounts with BOV and APS Bank, these were rarely used. Instead, she allegedly relied primarily on Revolut accounts. Information obtained from Revolut indicated the use of cryptocurrency, including Bitcoin, with funds traced back to non-Maltese individuals.
Further intelligence suggested that Caruana’s 82-year-old grandfather had been holding money on her behalf.
Arrests and seizures
Arrests were planned for 2 February. Although Caruana was not found at her registered address, she was arrested later that day at around 1pm. Her grandfather was also arrested on the same day.
During a search at a Valletta residence, police found a box bearing Caruana’s name containing €5,000 in cash, along with an envelope holding a further €3,000.
Searches at locations where Caruana had been staying led to the seizure of a MacBook, two iPhones, an iMac, and another electronic device.
The grandfather gave a statement to police after waiving his right to legal counsel and was later released. Caruana was questioned the following day and subsequently arraigned in court.
Witnesses testify
During the compilation of evidence, several institutional witnesses testified.
Ann Marie Calleja, representing BNF Bank, presented Know Your Customer (KYC) documentation relating to five individuals, along with supporting documents.
Accountant Sarah Rausi testified on the financial analysis carried out during the investigation, presenting KYC documentation of victims, transaction records based on data provided to her, and information tracing where the fraudulent funds were first received.
Klivert Gatt, representing APS Bank, presented KYC documentation relating to 10 APS Bank customers identified as victims.
Timothy Zammit, representing HSBC, presented similar documentation relating to HSBC customers.
Louis Buhagiar, from Jobsplus, testified on the accused’s employment history, confirming her past work records.
Following the testimony, the defence filed a fresh request for bail, arguing that most evidence had already been collected and that no civilian witnesses had yet testified.
The prosecution objected, stating that the accused does not have a fixed address and that granting bail would be premature while investigations remain ongoing.
The magistrate said the court’s decision on the bail request would be delivered in camera at a later stage.
The prosecution was led by Inspector Claire Vella Borg, assisted by lawyers Marica Ciantar and Mauro Abela on behalf of the attorney general.
Lawyer Stefano Filetti appeared as parte civile for Bank of Valletta plc.
Lawyers Roberto Spiteri and Franco Galea represented the accused.

source