Cyprus Boys VAT Fraud: How iPhone Trading Allegedly Cost €114 Million

The EPPO has announced five arrests and estimated losses of €114 million. Here is how the alleged iPhone trading chain and cross-border VAT carousel are said to have worked, what the public record still does not show, and how Cyprus could strengthen prevention.

Grigoris Aivazidis · Lawyer, AVZ Law Office · Legal News & Commentary · 18 October 2026

Cyprus Boys VAT Fraud is the label attached to a cross-border iPhone trading investigation in which the European Public Prosecutor’s Office says five suspects were arrested and estimated VAT losses reached €114 million. The public announcement gives the outline. A report citing case-file material describes a more specific route through companies and payment platforms, with alleged organisers operating from Cyprus.

The distinction matters. The EPPO announcement of 16 October 2026 confirms the arrests, the countries involved and its estimated losses. It does not publish a full company-by-company invoice trail. The more detailed account below is attributed to reporting by Politis, citing Protothema and case materials. These are allegations in an ongoing investigation. The persons concerned remain presumed innocent.

What the Cyprus Boys VAT Fraud investigation confirms

EPPO links the case to its Investigation Midas. It says five suspects were arrested during the week of 16 October: three in Cyprus, one in Germany and one in Italy. Searches and seizures were carried out in Cyprus, Greece and Italy. It describes a suspected cross-border VAT carousel involving smartphones sold through companies and missing traders based in Germany, Albania and Sweden.

The official release estimates tax losses at €80 million in Sweden and €34 million in Germany. It says the suspects are believed to have set up and controlled the scheme. Twelve searches were conducted, and assets were frozen or seized in the countries involved. The Cyprus Tax Department, Cyprus Police and MOKAS are among the authorities listed as supporting the investigation.

Press reporting citing case papers gives a more precise total of €115,529,455, comprising €80,860,171 associated with 33 alleged VAT-evasion cases in Sweden and €34,669,284 linked to Germany. The public EPPO notice does not explain the difference between that reported total and its €114 million headline estimate. This article therefore uses the EPPO figure when describing the official announcement and identifies the higher amount as a figure reported from the case papers.

Media reports say the transactions under examination principally concern 2019 and 2020. They also describe four Cypriots as alleged organisers, while EPPO reports five arrests overall. The public information does not explain the role of each of the five arrested suspects, so the two descriptions should not be treated as interchangeable.

How the alleged iPhone VAT carousel worked

To understand the alleged scheme, it helps to separate the established VAT mechanism from the case-specific claims. A carousel fraud does not require a new tax rule. It exploits how VAT is accounted for when qualifying goods move between VAT-registered businesses in different EU Member States.

1. Phones were bought for rapid resale

According to the case-file account reported by Politis, approximately €7.25 million worth of mobile phones was purchased between late July and mid-October 2019, a period of roughly two and a half months. The reported company network included German businesses, two companies in Albania and seven companies involved in the Swedish side of the transactions. EPPO independently confirms the broader cross-border structure, naming Germany, Albania and Sweden.

The €7.25 million figure is the reported value of phone purchases, not the alleged VAT loss. The loss figure concerns VAT allegedly charged on sales and not accounted for across the wider chain, so the amounts measure different things.

For a qualifying business-to-business supply of goods dispatched from one Member State to another, the seller generally does not charge domestic VAT on the invoice, subject to the statutory conditions. The buyer accounts for VAT on the intra-Community acquisition in the destination country and may generally deduct it if entitled. The European Commission’s explanation of carousel fraud describes why this treatment can be exploited.

2. VAT was allegedly collected on domestic sales and not paid over

The critical point comes when goods are resold domestically. A trader selling phones to a customer in the same country normally charges VAT. In a missing-trader fraud, the seller collects that VAT but does not pay it to the tax authority. The company may then become unreachable, cease trading or otherwise fail to account for the tax. The loss arises because the customer has paid VAT to the seller, while the tax authority has not received it.

In a longer chain, other businesses may claim deductions or refunds for VAT shown on invoices, while the tax collected earlier in the chain remains unpaid. Repeated cross-border sales can make the chain harder to reconstruct and may allow the same goods or trading value to generate several linked transactions. That is the carousel element. The European Commission describes the missing trader as the point at which collected VAT is pocketed rather than remitted.

3. Unrelated invoices allegedly obscured the real trading activity

In this investigation, Politis reports that invoices for Voice-over-IP services and gift vouchers appeared in the chain and were considered by investigators not to reflect genuine trading activity. The reporting says those invoice chains were used to conceal the alleged fraud. The EPPO’s public release does not describe those invoices or explain their precise accounting function. It would therefore be unsafe to assert that each one generated a particular deduction or refund.

4. Proceeds were allegedly routed through Cyprus

The same report says proceeds from the transactions were collected in corporate bank accounts in Sweden and then transferred to Cyprus through companies and payment platforms allegedly controlled by the Cypriot suspects. It describes the alleged roles in broad terms: coordinating phone purchases and controlling a financial platform, distributing proceeds, creating and controlling payment platforms identified in the report as P-Exec and Rivalz, and overseeing accounts, transfers and financial statements. These role descriptions come from the media account of the case file, not the EPPO announcement.

This reported financial trail is one reason the Cyprus connection matters. It does not establish that Cyprus was where the estimated VAT losses arose. EPPO attributes the €80 million and €34 million losses to Sweden and Germany. Nor does the public record establish that a Cypriot authority had an earlier warning or that a particular local control failed.

What remains unproven about the alleged scheme

The term “carousel” describes a broad pattern, not proof that every phone physically travelled in a perfect circle. The public EPPO release does not provide a handset-by-handset route, a complete list of invoices or a full reconciliation of each company’s VAT return. The media account adds detail from reported case materials, but it remains an account of allegations rather than a judicial finding.

The investigation may examine money laundering and participation in a criminal organisation, according to the reporting. That does not mean those offences have been established. The appropriate conclusion is narrower: prosecutors suspect that a cross-border company and payment network was used to trade smartphones, generate VAT exposure in Sweden and Germany, and move proceeds through structures connected to Cyprus.

Could Cyprus have prevented the alleged VAT fraud?

On the information currently public, it is not possible to say that Cyprus could have stopped this particular scheme before it began. The first EPPO notice confirms that Cypriot tax, police and financial-intelligence authorities assisted the investigation. It does not say when they first received information, what warning signs were available earlier, or whether any specific control was missed.

There are practical measures that can make similar schemes harder to operate. Cyprus already directs businesses to verify a customer’s VAT number through VIES before issuing an invoice for an intra-Community transaction. That check is a starting point. A valid number does not prove that goods moved as invoiced, that the buyer has the commercial capacity for the volume, or that the payment trail is consistent with the stated transaction.

Tax authorities should be able to join transaction data quickly across VAT returns, VIES statements, customs and transport records, company ownership information and suspicious payment flows, subject to lawful access and safeguards. A new company with a sudden surge in high-value phone trading, repeated circular counterparties, weak evidence of goods movement or payments routed through unrelated entities should prompt proportionate review. None of those indicators alone proves fraud, but together they can justify prompt verification before exposure multiplies.

Cyprus can also make fuller operational use of Eurofisc. The European Commission says the network’s Transaction Network Analysis tool enables tax officials to exchange and jointly process VAT data to identify suspicious networks earlier. Eurofisc can support follow-up such as information requests, audits or VAT-number deregistration. The value is not simply having access to data. It is connecting the same trader, goods, invoice chain and money flow while intervention is still possible.

Commentary by Grigoris Aivazidis

The weakness exposed by this case is often described as a VAT loophole. That phrase needs care. The intra-EU VAT treatment of qualifying cross-border sales is part of the legal system. The vulnerability is that one authority may see a properly documented cross-border supply, while another sees a domestic resale where VAT is charged and allegedly never reaches the treasury. If those administrations cannot connect the two sides quickly, a company can collect tax faster than the system can identify the missing payment.

Cyprus should not be blamed for a failure that the public evidence has not established. The EPPO announcement confirms that Cypriot authorities took part in the investigation. But the case should still prompt a serious question about prevention. When companies, payment platforms or proceeds are linked to Cyprus, the relevant information should be capable of reaching the people who can verify the goods, counterparties and source of funds before the trail goes cold.

That means more than checking whether a VAT number exists. It means risk-based monitoring of exceptional turnover, fast exchange of intelligence with other Member States, and a coordinated response between tax investigators, financial intelligence and law enforcement. The response must also protect legitimate traders from automatic suspicion. A new or fast-growing business is not guilty because it trades in phones. But invoices, goods and money should tell one coherent story.

“A valid VAT number is only the beginning of the check. The real test is whether the goods, invoices, counterparties and money describe the same transaction, and whether authorities can compare that evidence before the VAT disappears.”
Grigoris Aivazidis, Lawyer, AVZ Law Office

That is the lesson Cyprus should take from the alleged Cyprus Boys VAT Fraud. The question is not whether cross-border trade should be obstructed. It is whether a sophisticated chain of companies can move high-value goods and collect VAT without triggering a joined-up inquiry until the loss has already been exported to another country.

For advice on Cyprus VAT controls, cross-border trading structures or a matter involving a tax investigation, contact AVZ Law Office through our Private Enquiry page.