FC Barcelona Almost Scores Own Goal in Lewandowski Transfer Scam

In July 2022, FC Barcelona announced it had agreed to pay 45 million euros ($46 million) to sign Polish superstar Robert Lewandowski in a highly publicized transfer deal with Bayern Munich.

It was a crowning achievement for Lewandowski’s representative, agent Pinhas "Pini" Zahavi, who has greased the wheels on many of European football’s biggest transfers and is almost as famous as the players he represents. Zahavi pronounced himself “very happy” with the deal and called the protracted Barcelona agreement “one of the most difficult transfers of my career.”

Zahavi was reported to have earned a multimillion-euro commission for his work. Ten days after the signing was announced, FC Barcelona officials received an email requesting an initial installment of 1 million euros.

There was just one problem. The request, which purported to be from Zahavi himself, came from a different address than the agent had used in past correspondence with FC Barcelona. And it asked that the money be sent not to Zahavi, but to an account in Cyprus held by a man named Michael Gerardus Hermanus Demon, identified in the email as a lawyer.

Ordinarily, such irregularities might be expected to put the brakes on a major transaction – particularly in professional football, an industry with an estimated global value of some $600 billion which in recent years has come under scrutiny as an unregulated haven for large-scale money laundering.

But reporters have since discovered that the Barcelona club, undaunted, proceeded to initiate the transfer of the million-euro payment.

Request for Payment

The attempted payment came to the attention of journalists in the spring of 2023 after “Que t’hi jugues” (What are you playing with?), a radio show focused on FC Barcelona that airs on Spain’s Cadena Ser broadcaster, obtained a copy of the email request and shared it with OCCRP and investigative partners from Der Standard and Paper Trail Media. 

Three anonymous sources, all working within FC Barcelona at the time, confirmed to reporters that the club had initiated the million-euro transfer. A fourth source, who had knowledge of the banking transaction, said the payment was ultimately blocked by compliance officers at the recipient Bank of Cyprus, who flagged the transfer as suspicious.

In an email seen by OCCRP, the person claiming to be Zahavi wrote to managers at the Bank of Cyprus to push for the transfer to be approved. The email claimed that Demon, the holder of the Cypriot account, was an “intermediary for us on major football transfers” and that “the fee paid by FC Barcelona for the Lewandowski deal belongs to him.”

One of the sources from inside FC Barcelona said the money transfer was initiated before staff realized an error had been made and sought to stop the wire. It is unclear whether club staff reached the Bank of Cyprus before or after the bank decided to block the transfer.

All four sources asked for their names to be withheld, saying they risked losing their jobs for speaking to reporters.

Zahavi himself described the attempted fraud to reporters from “Que t’hi jugues,” telling them that someone had sent a “fake email” in his name in an attempt to steal the money. The agent said he found out about the scheme after a club director contacted him about the request.

Zahavi said he told the director he had not sent a payment request and advised them to check for fraud. The same director later “hugged me and thanked [me]” for saving the club from what they called “a terrible mistake,” Zahavi said.

FC Barcelona has officially declined to comment on whether the club attempted the payment. In a May 2024 email, a club spokesperson told OCCRP only that scammers did not “receive any amount” from the club.

FC Barcelona also said it reported the attempted fraud to the Catalan police. The police, however, told OCCRP the club had not filed a formal complaint.

Mystery Dutch ‘Lawyer’

Using social media, reporters were able to track down Michael Gerardus Hermanus Demon, the man whose name was on the Bank of Cyprus account. (OCCRP attempted to transfer a small sum to the account in Demon’s name in November 2023 and was informed by the bank the account had been closed.)

Reporters contacted Demon by email in April 2024. He claimed to have no knowledge about either the Cypriot bank account or the FC Barcelona payment, saying his identity had been stolen.

“I don't know anything about this and I don't have a bank account in Cyprus. Unfortunately I was a victim of ID fraud. ID was stolen/lost sometime in 2022,” he wrote.

Demon did not reply to any subsequent calls or emails from reporters.

Public records do not show Demon being employed in the football industry or having professional ties with Zahavi. Nor does he appear to be a lawyer. His name could not be located in any searches of Dutch or international bar associations.

Asked about Demon’s claim of identity theft, the Bank of Cyprus defended its customer-verification protocol, saying it is impossible to use stolen documents to open an account.

“[We are] able to validate the authenticity of passports/IDs and ensure that the applicant is indeed the same person as the one shown on the uploaded ID documents,” a bank spokesperson said in an April 2024 email.

The bank said it would only activate an account after meeting with the applicant, either in person or over a video call.

The bank declined to comment on the attempted Barcelona transaction, citing confidentiality policies.

‘So Much Money Involved’

Experts in the European football industry expressed both shock and resignation at the idea that a major club would make such a large payment based on a simple email.

“The days of ‘send this amount to this bank account’ are long gone,” said Andrew Mills, a sports consultant who has worked on player transfers in the English Premier League. “As a business, you have got to invoice. You can’t just request the money. There should always be a paper trail.”

Still, he and others acknowledged that the size and complexity of major football deals, coupled with Zahavi’s renown, could make it easy for a potential scammer to find a gateway to requesting a fraudulent transfer.

“The lack of due diligence that you see in certain departments in football clubs is quite staggering,” said Kieran Maguire, the English author of “The Price of Football: Understanding Football Club Finance.” He added he “would not be surprised” if FC Barcelona tried to send the money based only on an email. 

The international transfer market currently generates close to 11 billion euros in club investments a year, with Europe’s five major leagues making up two-thirds of the trade. 

A 2022 report by the United Nations Office on Drugs and Crime (UNDOC) said gaps in banking oversight, the frequent use of offshore accounts, and the staggering sums of money to be made all left the transfer market vulnerable to fraud and other illicit financial streams.

European officials have attempted to rein in corruption in the football sector, mandating professional clubs to put safeguards like customer verification and transaction monitoring in place by 2029.

For now, sports pages remain rife with reports of falsified transfers, money laundering, and fraudulent payment schemes. In 2018, Italy’s Lazio reportedly fell for an email scam, paying 2 million euros to fraudsters who posed as the Dutch club Feyenoord following the transfer of defender Stefan de Vrij.

“There is so much money involved, and a lot of people who want a small slice of the pie,” Maguire said. “A small slice is still a lot of money.”

Jim Gee, a financial and cybercrime specialist, is the co-author of a 2011 study on fraud in professional football, an industry where he found a fundamental imbalance between weak accounting and regulations in clubs controlled by ultra-wealthy owners.

“In that kind of loose environment with powerful people in it, you’re more likely to find corruption and fraud,” Gee told reporters. “This was 10 years ago, but I haven’t observed any increasing regulation in football. The power dynamic is still the same.”