Authorities in Albania have foiled one of the biggest cybercrime attempts in the country’s history, after uncovering a sophisticated plan led by two Chinese nationals who allegedly tried to steal 5 billion Albanian lek (around $50 million) from citizens’ bank accounts.
The Cybercrime Directorate of the Albanian Police confirmed that Cunfeng Fan (51) and Haike Yan (45) were arrested in the capital, Tirana, earlier this week. The suspects are accused of computer fraud, identity theft, and large-scale data manipulation through advanced phishing schemes.
According to investigators, the two suspects had built a fake version of the official Albanian Post (Posta Shqiptare) website, which they used to trick citizens into entering their banking and personal data. Once a user clicked the fraudulent link—sent via SMS or email—the hackers instantly gained access to their sensitive information, including card numbers, PIN codes, and login credentials.
Authorities estimate that over 5,000 Albanian citizens were targeted by this operation. Had it succeeded, the hackers could have drained millions of euros from local bank accounts within hours.
The two men arrived in Albania only a week before their arrest, reportedly to set up the technical infrastructure necessary for their cyber-attack. They stayed in a hotel near Tirana’s city center, which became the focal point of the investigation.
During a police raid, investigators seized 17 smartphones, 1 laptop, 12 passports, 11 bank cards, 7 identity cards, and 1 driver’s license — all believed to have been used in the criminal operation. Digital forensics teams also discovered spreadsheets containing personal data of 5,000 victims, including addresses, phone numbers, and bank account details.
Officials say the plot was stopped just in time. The operation was carried out in cooperation with international cybercrime agencies, as evidence suggests the two suspects may be connected to a larger network operating across Europe and Asia.
The Albanian Police have since warned citizens to be extra cautious about clicking on suspicious links or providing information through unofficial websites. Cybersecurity experts remind users that government institutions never request personal or banking data via text messages or email.
As digital scams become increasingly advanced, law enforcement across Europe is working to strengthen defenses against phishing and identity theft. This latest case in Albania serves as a powerful reminder that even small nations are now on the front line of global cybercrime threats.