Overview
- Many German account holders report unexplained €99 withdrawals labeled “Lunero EOOD” or “Lenoxal Limited EOOD,” which are registered in Bulgaria.
- Reporters say the attackers likely used leaked IBAN and account details from data breaches or the Darknet to start the pulls.
- Banks often let SEPA direct debits, known in Germany as Lastschrift, go through without confirming a valid mandate first.
- Victims can ask their bank to reverse the charge within 8 weeks, or up to 13 months if the debit was unauthorized, so checking statements now is key.
- A similar pattern surfaced in February with “Megatipp Emergency Call Services,” and the fixed €99 sum appears designed to slip past routine account checks.