Inside 'Hermes': How a €410M VAT Carousel Hid in Plain Sight

On 7 October 2026, investigators in eight European countries carried out more than 300 searches in a single day. By the end of it, 62 people had been detained. The Europe-wide operation against two suspected criminal networks shows why spotting fraud one company at a time no longer works.

"The operation, codenamed Hermes and led by the European Public Prosecutor's Office (EPPO), targets two suspected criminal organisations accused of draining at least €410m in VAT from European Union member states. The goods at the heart of the scheme were mobile phones and other electronics."

Searches took place in Austria, France, Germany, Italy, Malta, the Netherlands, Portugal and Spain. Of those detained, 39 were in Portugal, 20 in Spain and three in Italy. As the EPPO stresses, all of them are presumed innocent unless proven guilty in court.

How a Carousel Works (MTIC Fraud)

The method is known as missing trader intra-community fraud, or MTIC, and is more often called a VAT carousel. It exploits a simple rule: goods sold between EU countries are exempt from VAT, so a company can import a consignment of phones without paying the tax.

• The Missing Trader: Sells the goods within its own country, charges VAT, and disappears without remitting the funds to the tax authority.
• Buffer Companies: Consignments pass through a series of intermediary companies designed to lend the chain an air of ordinary trade and put distance between the missing trader and the final seller.
• Fraudulent Reclaim: At the end of the chain, an exporting company claims back the VAT it paid on the goods. Because the original tax was never collected, the state effectively refunds money it never received.
• Shared Logistics & Cross-Laundering: The two criminal groups ran separate schemes but shared companies, goods, and logistics, cycling proceeds through each other's businesses to launder funds using encrypted messaging.

A Network That Moved On: Criminal Resilience

One strand of the case shows how resilient such networks can be. The EPPO says a suspect who had led a VAT fraud against Sweden between 2019 and 2023 moved to Portugal after Swedish authorities investigated and the companies went bankrupt. There, he is alleged to have set up a similar scheme using companies registered in the names of relatives and trusted associates. Personnel in Hermes also overlapped with two earlier major EPPO investigations, known as Admiral and Moby Dick.

The Cost to Portugal & Massive Asset Seizures

Portugal appears to have borne much of the damage, with Portuguese authorities estimating losses of more than €150m, including at least €125m in one investigation and €30m in another. The Portuguese operation involved about 740 Judicial Police officers. Across the operation, prosecutors ordered the seizure of assets worth up to €310m, freezing bank accounts, corporate shares, luxury vehicles, cash, and gold coins.

Three Practical Questions for Compliance Leaders

• Can we see connections between customers? Shared directors, addresses, devices or counterparties can link companies that look independent.
• Do we notice unusual trading patterns? Sudden, high-volume cross-border activity in goods such as electronics, particularly where funds move in circles, deserves attention.
• Can analysts explain an alert? A warning is only useful if the team can see quickly why it was raised and act on it.

How SecuroQ Fits In

SecuroQ builds financial crime intelligence tools aimed at these problems, bringing customer, transaction and ownership data into one view so that networks can be mapped and unusual behaviour flagged with clear reasoning. We have no connection to the Hermes investigation. It simply shows why seeing the whole carousel, rather than one rider at a time, matters.

"Official Sources: European Public Prosecutor's Office (EPPO) 7 October 2026 News, Portugal Resident & Mobile News."