Are you facing an investigation by the ZCB?
Is the Central Office for Cybercrime Bavaria (Zentralstelle Cybercrime Bayern, ZCB) at the Bamberg Prosecutor General’s Office investigating you? Have you been affected by a search of your home, an arrest or even an arrest warrant in such proceedings?
From our office in Nuremberg, Rudolph Rechtsanwälte provides determined and experienced defense in all proceedings before the ZCB and the Regional Court of Bamberg.
What is the role of the Central Office for Cybercrime Bavaria?
The Central Office for Cybercrime Bavaria, known as the ZCB, was established in 2015 within the Prosecutor General’s Office in Bamberg. It handles major cybercrime investigations throughout Bavaria, including cases requiring substantial IT investigation work, involving organized criminal structures or targeting important sectors of the economy. It works with Bavarian police specialists, its own IT forensic experts and authorities in other countries. According to its own information, its priorities include fraud through so-called cybertrading platforms, fraudulent online shops, ransomware attacks on businesses, darknet offenses and cases involving sexual violence against children online.
Not every internet-related offense is investigated in Bamberg. Ordinary cases are handled by local prosecutors. Since 1 October 2024, section 55c GZVJu has concentrated cybercrime cases falling within its statutory definition from across Bavaria at the Regional Court of Bamberg, where a regional court has first-instance jurisdiction under the provisions specified there; a dedicated cyber and white-collar crime chamber was established there. The investigation and trial therefore often take place in the same city. Rudolph Rechtsanwälte is based in Nuremberg.
Technical attacks and internet-based economic offenses
The term cybercrime covers very different allegations. Technical attacks target data and systems: obtaining or intercepting data under §§ 202a et seq. of the German Criminal Code (StGB), data interference and computer sabotage under §§ 303a and 303b StGB, or extortion using malware. These must be distinguished from economic offenses in which the internet is the means of committing the offense: fraud through trading platforms, investment fraud, fraudulent online shops, phishing and forwarding customer funds, which may be investigated as money laundering under § 261 StGB. The distinction matters to the defense because the evidence, legal requirements and role of the individual suspect differ fundamentally.
A substantial proportion of ZCB proceedings concern cybertrading: online platforms on which customers were meant to trade contracts for difference, foreign exchange or crypto assets, but where investigators allege that trading was merely simulated and the deposits went to the operators. Such cases involve investigations not only into operators but also call center staff, intermediaries, payment service providers, account and company holders, and software developers and operators. Trading losses do not, by themselves, prove fraud. The underlying fraud and the requirements of the alleged form of participation must be assessed separately for each suspect.
Why these proceedings have international connections
Platforms, call centers, payment processing and injured parties are often spread across several countries. The ZCB therefore cooperates with Europol, Interpol and foreign law enforcement authorities, sometimes in joint investigation teams. Evidence is obtained through mutual legal assistance, and searches and arrests are carried out abroad. Suspects outside Germany often learn of proceedings only through an arrest warrant, an international alert or an extradition request. Press releases from the Prosecutor General’s Office in Bamberg document extraditions to Germany from various countries, including Israel.
This gives the defense two tasks. In Germany, the issues are access to the file, review of the arrest warrant, the legality of evidence gathered abroad and the evidence against the individual. Abroad, the question is what rights the person has in extradition proceedings in the requested state. In such cases, we work with lawyers in the relevant country and coordinate the defense in both proceedings. The requirements for extradition and potential obstacles are explained on our page on extradition and the European Arrest Warrant.
These investigations are not directed against particular nationalities. Being a citizen or resident of a particular country does not in itself make someone a suspect. What matters is always the specific conduct and evidence.
Digital evidence and the individual’s role
ZCB cases rely on large volumes of data: chat logs, customer databases, server data, payment flows, wallet addresses and analyses of seized devices. An IP address, user account or wallet does not automatically identify the person who acted. Chat logs are often translated from other languages and presented in excerpts; context, completeness and attribution must be checked. Digital evidence must be assessed fully, transparently and in its proper context. This is demanding work, but in many cases it is the core of the defense.
The individual’s role is equally important. Someone who worked for a platform, developed software or forwarded payments was not automatically a co-perpetrator of fraud. Aiding and abetting requires proof of assistance to an intentional unlawful principal offense and the corresponding intent; merely belonging to a profession or industry is not enough. An allegation of membership of a criminal organization under § 129 StGB likewise requires more than activity in the vicinity of an organization. The defense therefore identifies the precise conduct alleged against the individual, the evidence said to support it, and whether investigators can actually establish the person’s knowledge and intention.
Airsoft and FakeTrade: Why the Evidence Needs Scrutiny
The September 2026 FakeTrade reporting illustrates why software features, the prosecution’s allegations, and judicial findings must be distinguished. According to the published prosecutor interview, Bamberg Regional Court did not adopt the prosecution’s joint-perpetrator theory in the reported Airsoft case and instead convicted for aiding and abetting. That difference matters.
In our view, sweeping descriptions of software as purpose-built for fraud can obscure the necessary technical analysis. Other providers also document client groups and pricing controls. This does not establish that a particular use was lawful; it means that the actual configuration, conduct, and knowledge must be proved. Large reported loss figures also require clear definitions and attribution.
Our critical assessment of Airsoft, FakeTrade, and the Bamberg proceedings examines DER SPIEGEL’s reporting, the prosecutor’s position, and the limits of conclusions drawn from the judgment, with links to public technical documentation.
What German criminal defense can do in these proceedings
A defense lawyer can act in Germany before the suspect is personally in Germany. The lawyer can notify the ZCB of the appointment, apply for access to the file, establish the procedural position and contact the prosecutors. If an arrest warrant exists, we examine its grounds and the possibilities of challenging it or having its execution suspended subject to conditions under § 116 of the German Code of Criminal Procedure (StPO). Whether that course is realistic depends on the allegation, the grounds for detention and the individual’s circumstances; no general assurance can be given.
After reviewing the file, we develop a defense tailored to the suspect’s role and the evidence. This includes technical scrutiny of the analyses, examination of jurisdiction and mutual legal assistance, discussions about resolving the proceedings where appropriate, and preparation for trial before the Regional Court of Bamberg. Early advice helps avoid premature statements, preserve exculpatory documents in an organized form and challenge asset attachment and account freezes in time. Our article on cybercrime and cybertrading explains the legal details of cybertrading allegations, contracts for difference and software developers’ responsibility.
Instructing a German defense lawyer from abroad
German criminal procedure allows a suspect to be represented by a defense lawyer (Verteidiger) from the moment an investigation begins, whether or not the suspect is in Germany. Once instructed, we notify the prosecutor’s office that we act for you, apply for access to the case file (Akteneinsicht), establish the stage the proceedings have reached and open a channel of communication with the prosecutors. Under German law the suspect has the right to remain silent, and silence may not be used against you. We therefore advise clients not to make statements, whether to German authorities, to foreign police acting on a German request, or in chats with former colleagues, before the file has been reviewed.
Instruction is straightforward: a written power of attorney, which can be signed abroad and sent electronically, a written fee agreement and an initial conversation by telephone or video. We communicate in English and German. If proceedings are also pending in your own country, for example an extradition procedure, we coordinate with your local counsel; we are admitted in Germany only and do not advise on foreign law.
What we need from you at the start
At the first contact it helps to know what you have received or been told: letters, court documents, the name of the authority, any case reference, the date and circumstances of a search or arrest, and whether a lawyer in your country is already involved. Please keep all documents, contracts, correspondence and account records unchanged and do not delete messages or accounts; altering material can itself become an accusation. Do not contact other people who may be involved to discuss the case. Everything you tell us is protected by professional secrecy under German law.
Arrest warrants, travel and extradition
If a German court has issued an arrest warrant, it can be executed in Germany and, through international channels, abroad. Whether and how a person can be extradited to Germany is decided by the courts of the country where the person is, under that country’s law and the treaties in force; Germany and Israel are both parties to the European Convention on Extradition of 1957. We do not represent clients in foreign extradition proceedings, but we work alongside the local lawyers who do, and we address the German side of the case at the same time. Statements such as “you will not have to travel to Germany” or “the warrant can easily be lifted” cannot honestly be made in advance; the outcome depends on the allegations, the grounds for detention and the individual circumstances.
What a German defense lawyer can do is concrete: review the arrest warrant and its grounds, apply for it to be set aside or for its execution to be suspended under conditions (§ 116 of the German Code of Criminal Procedure, StPO), clarify with the prosecutors whether an appearance can be arranged voluntarily and under what conditions, and prepare the client for what will happen on arrival in Germany, including the hearing before a judge. In some cases German courts may grant safe conduct (§ 295 StPO) to an absent suspect, protecting him from pre-trial detention for the offense concerned, subject to conditions. Whether any of these options is realistic can only be assessed after reviewing the file. Anyone who is the subject of a German warrant should obtain advice before travelling, not only to Germany but within the Schengen area and to other countries that cooperate with Germany.
For clients in Israel: practical questions
מידע בעברית על הגנה בתיקי סייבר בגרמניה. Advice is provided in German or English.
The following points answer practical questions that arise for clients in Israel in connection with ZCB investigations into trading platforms and call centers. First, how to reach us: by telephone at (+49) 911 999 396-0 during German office hours or through the contact page; we reply in English. Video meetings are available for the initial consultation and for the ongoing work. Second, language: we work in English and German; we do not offer Hebrew, so documents in Hebrew should be accompanied by a translation. Third, fees: work is charged on the basis of a written fee agreement, usually by time spent, which we explain and agree before the mandate begins; payment from abroad by bank transfer is possible. Fourth, coordination: if an extradition request or other proceedings are pending in Israel, we cooperate with your Israeli lawyer, who remains responsible for Israeli law. Fifth, documents: a power of attorney signed in Israel and sent as a scan is sufficient for us to act in Germany; originals can follow later.
We have no office in Israel, are not admitted to practice there and hold no formal cooperation with Israeli law firms. Our role is the defense in Germany, from the first contact with the Bamberg prosecutors to the trial before the Regional Court of Bamberg and, where necessary, appeals.
Who we are
Rudolph Rechtsanwälte was founded in Nuremberg in 2003 and concentrates on criminal defense, tax crime and white-collar crime. Dr. Tobias Rudolph is a specialist lawyer for criminal law and for tax law (Fachanwalt für Strafrecht und für Steuerrecht) and a certified adviser in criminal tax law; his colleagues Franziska Fladerer and Christian Krauße hold the same two specialist titles, and Laura Todde practices criminal defense with a focus on white-collar and medical criminal law. The firm has published on ZCB investigations into cybertrading since 2020 and follows the practice of the Bamberg prosecutors and courts closely. All lawyers at the firm can also advise you in English.
Frequently asked questions
Is the ZCB responsible for every internet-related offense in Bavaria?
No. The ZCB handles major proceedings involving substantial IT investigation work, organized structures or particular significance. Ordinary cases, such as an individual online insult or a small-scale goods fraud, remain with local prosecutors.
Which court hears charges brought by the ZCB?
Since 1 October 2024, section 55c GZVJu assigns cybercrime cases within its statutory definition from across Bavaria to the Regional Court of Bamberg, where a regional court has first-instance jurisdiction under the provisions specified there. The court has a dedicated cyber and white-collar crime chamber. Charges brought before a local court follow the general rules.
I have learned that I am under investigation in Bamberg. What should I do first?
Do not make a statement to investigators, co-suspects or in chats, and instruct a defense lawyer who can apply for access to the file. Preserve documents, contracts and communications without altering them. The next steps depend on the specific allegation.
I only worked for a platform as an employee. Could I still be criminally liable?
That can only be assessed by examining your actual work. Where fraud is alleged, particular importance attaches to whether you participated in a deception or intentionally assisted an intentional unlawful principal offense; working for a platform does not in itself establish this. What you knew, what you were told and what you personally did are decisive.
How do you deal with the large volumes of data in these cases?
We systematically review the case file and electronic evidence, check the attribution of accounts, addresses and chats to individuals, review translations and excerpts, and involve IT experts where necessary. Only then can it be assessed whether the investigators’ analysis actually supports the allegations against the individual.
Further questions for clients abroad
Can I instruct a German lawyer without coming to Germany?
Yes. A defense lawyer can be appointed by written power of attorney from abroad and can apply for access to the file, contact the prosecutors and act on your behalf in Germany while you remain in your own country.
Will I be told what I am accused of?
Once we are instructed, we apply for access to the case file. During the investigation, access may be restricted to the extent that disclosure could jeopardise its purpose. If the suspect is in pre-trial detention, or such detention has been requested following provisional arrest, the defense must nevertheless receive the information essential to assessing the lawfulness of the deprivation of liberty; access to the file must generally be granted to that extent. We pursue full access as soon as the legal conditions permit.
Does a German arrest warrant mean I will be extradited?
Not automatically. Extradition is decided by the courts of the country you are in, under its law and the applicable treaties. At the same time the German warrant can be challenged in Germany, and its execution can in some cases be suspended under conditions. Both routes should be pursued in parallel by your local lawyer and your German defense lawyer.
I only worked in a call center. Why am I a suspect?
German prosecutors often investigate everyone who worked for a platform. Whether you are criminally liable depends on what you personally did and knew, not on your job title. Establishing this from the evidence, in particular from chat logs and internal documents, is the main task of the defense.
How long do these proceedings take?
ZCB investigations frequently run for years because they involve many suspects, several countries and large volumes of data. For an individual suspect the timeline depends on his or her role, on whether a warrant exists and on the stage of the overall investigation. We give a realistic assessment after reviewing the file.
What does a German defense lawyer cost in such a case?
Cross-border cybercrime cases are handled under a written fee agreement, normally based on time spent, because statutory fees do not reflect the volume of the file. We discuss the expected scope and the terms before you instruct us.
Contact
If you or a family member are facing proceedings conducted by the Central Office for Cybercrime Bavaria, contact us before making a statement. You can reach our Nuremberg office on (+49) 911 999 396-0 or through the contact page; enquiries can be made in German or English. A German-language version of this information is also available.