Million-dollar scheme against Caixa had server support to leak PF operation

A criminal group focused on financial fraud managed to steal around R$45 million from Caixa Econômica Federal account holders, counting on a surprising illicit advantage: early access to a confidential warrant from the Federal Court. The file in question detailed exactly the police operation that would be launched to dismantle the gang itself, demonstrating a serious failure in institutional security.

Thirty days in advance of the Federal Police raid, the suspects were already actively preparing for the arrival of the agents. During this period, the organization’s members dedicated themselves to erasing compromising digital records, transferring properties to third parties and awaiting the inevitable police approach with assets already shielded.

Despite all the efforts to eliminate the traces of fraud and internal communication, a technical error committed by fraudsters left fundamental evidence behind. It was precisely this failure that made it possible for Federal Police investigators to map the path taken by the leaked document until it reached the hands of the embezzlers.

How the diversion structure worked that emptied social benefit accounts

Tracking illicit activities began in 2025, shortly after a series of complaints about invasions of bank accounts maintained by Caixa Econômica Federal. Virtual attackers accessed victims’ profiles and carried out unauthorized transfers, mainly targeting social vulnerability resources, such as the Service Time Guarantee Fund (FGTS) and emergency aid installments, accumulating a loss of more than R$45 million.

Reports from the Federal Police highlighted the strong contrast between the reality of the scammers and that of the people harmed by the scheme. While the ringleaders of the fraud boasted luxury goods and trips financed by stolen money, low-income citizens were left without basic resources to purchase ongoing medicines and daily supplies, revealing the cruelty behind cybercrimes.

The tactical investigation conducted by federal agents mapped the gang’s division into two distinct operational nuclei. In the state of São Paulo, the coordination of systemic invasions was the responsibility of the couple Matheus Casado Natário and Isabely Alves de Sousa, who managed the technology necessary to crack passwords and invade customers’ banking applications.

To launder the misappropriated capital and prevent judicial blockade by Brazilian authorities, the duo from São Paulo opened a shell company in the British Virgin Islands, a Caribbean territory famous for its banking secrecy. In addition to international remittance, a significant portion of the amount was converted into digital assets and cryptocurrencies, a modern tactic that requires international cooperation for effective tracking.

The operational arm located in Rio de Janeiro was commanded by Jader Henrique Areas de Almeida, identified by investigations as the main coordinator of the scheme. His role was to validate successful invasions, schedule the exact moment of fraudulent transfers and pass on stolen credentials to other members to execute withdrawals.

The organization’s financial machinery depended directly on Enzo Grillo Filho, classified in the survey as the group’s main monetary operator. Acting as Jader’s main agent, he was the key player in ensuring that illicit amounts moved continuously and covertly between bank accounts in the states of Rio de Janeiro and São Paulo.

The discovery of the leak that compromised the confidentiality of the police operation

During the technical examination carried out on smartphones seized from the suspects, federal agents came across an alarming breach of security: the fraudsters had a confidential government file in their hands. It was a full copy of the order signed by a magistrate authorizing searches and arrests against the gang itself.

This type of documentation is processed under strict judicial secrecy in the judiciary’s electronic systems, and is visible exclusively to the judge in the case, members of the Public Ministry, police officers involved and registry office employees. The fact that the file reached the targets of the investigation represents a very serious violation of the State’s security protocols.

The leader of the criminal scheme even tried to delete the message history where the PDF file had been received, believing he had eliminated evidence of corruption. However, he made a digital slip-up when he forgot that a version of the text had been copied and automatically saved in his own smartphone’s notes app.

Forensic analysis recovered a crucial dialogue where the head of the fraud sends a warning about the imminent operation to one of his associates. In the intercepted response, the interlocutor shows concern and suggests quick action: “What a joke, huh… Shield the assets”, highlighting the immediate plan to hide luxury cars and empty accounts before the vehicles arrive.

Faced with this irrefutable material evidence, the line of investigation gained a new and urgent development. The delegates needed to discover, as a matter of utmost priority, what was the internal loophole that allowed a high-level court order to be extracted from the Federal Court servers and sent directly to the swindler’s cell phone.

Digital tracking exposes public servants’ involvement in the scheme

Through an audit of the procedural system’s access logs, the Federal Police were able to map the exact route of the leak. Electronic records showed that the first improper viewing of the confidential decision was made using the official login of a public servant of the Federal Court, identified as Jackson Cozendey.

The investigation indicates that the public servant was not assigned to the criminal court responsible for the case and had no work justification to open that specific case. Because of this irregularity, he came to be investigated as the main suspect of selling sensitive data from the judiciary to the criminal organization, receiving bribes in return.

The deeper breach of telematic confidentiality revealed that subsequent consultations on the document took place outside the court’s premises. The IP address used to download the file belonged to the internet network of a private law firm, where the server’s wife, Gabrielle Cozendey, practices her profession.

A financial analysis carried out by the Financial Activities Control Council (Coaf) brought to light a monumental discrepancy in the lawyer’s standard of living. Although she officially declared monthly income in the range of R$5,200, breaches of bank secrecy proved that her accounts moved the surprising amount of R$1.74 million in a short period of just six months.

In response to the accusations formalized in the investigation, the legal team responsible for the defense of Jackson Cozendey and his wife, Gabrielle Cozendey, issued a statement denying any irregularity. The couple’s lawyers maintain that their clients have no connection whatsoever with the fraud crimes or the leak discovered by the authorities.

Despite the denials, intelligence reports from the Federal Police indicate that the extraction of the document was not an isolated act. The corporation concluded that the breach of court secrecy required complex and coordinated coordination, involving the direct participation of at least three public servants assigned to the court.

The dangerousness of the gang became even more evident after the extraction of audio files from the seized phones. In one of the recordings, Jader openly debates with his associates the possibility of murdering the Federal Police chief who was in charge of the investigations, an attack that fortunately never came to fruition.

The transcript of the threat reveals the criminal leader’s tone of impunity when referring to the investigator: “It’s a new little police chief there who is putting all the investigations out there… The guy is a sheriff up to a certain point. The person’s money, the person holds it here, holds it there, you know, holds the police station, boom. Orders to be killed. Makes this mess, you know. This shit is over”, declared Jader in the intercepted audio.

The report attempted to contact the legal representatives of Matheus Casado, Isabely Alves de Sousa and Jader Almeida, but did not receive any response until the closing of this edition. Likewise, the lawyers appointed to defend Enzo Grillo Filho could not be reached on the telephone numbers registered to comment on the money laundering accusations.

When contacted to detail the next steps of the operation, both the Federal Police communications department and representatives of the Federal Public Ministry informed that the institutions will not grant video or audio interviews at the moment, aiming to preserve the progress of the investigations that are still under secrecy.

Sources linked to the investigation confirmed that public prosecutors and federal delegates have already filed new precautionary requests in court. The objective now is to obtain authorization to carry out unprecedented search and seizure warrants directly in the rooms and offices of the Federal Court building itself, with the aim of collecting institutional computers.

The administration of the Federal Regional Court, the body responsible for supervising the employees cited in the leak scandal, was officially questioned about the administrative measures adopted against the employees. However, the court chose to remain silent and did not issue any official statement on the serious security breach that occurred on its premises.