The COVID-19 pandemic has become the European Union’s largest socioeconomic crisis and the impetus for the creation of a financial recovery instrument. In 2020, the EU launched the NextGenerationEU program, a massive economic aid package centered on the Recovery and Resilience Facility (RRF).
The facility’s total budget was approximately €577 billion, a significant portion of which was allocated in the form of grants and concessional loans to EU member states. These funds were intended to help economies recover from the effects of the pandemic, accelerate the energy transition, and modernize infrastructure. However, several years after its launch, the fund has become the focus of a growing number of investigations into fraud and abuse.
The idea of a pan-European recovery fund emerged in the spring of 2020, when the economic consequences of the pandemic became apparent. Lockdowns paralyzed economic activity, unemployment soared, and public budgets faced record spending to support businesses and households. In response, the European Commission proposed creating a recovery fund financed by EU co-borrowing on international markets—a move previously considered politically nearly impossible. The RRF’s goal was to finance national recovery plans, including reforms and investment projects. Member states committed to allocating at least 37% of the funds to green transformation and at least 20% to digitalization of the economy. The funds were intended to facilitate the modernization of the EU economy, including the development of renewable energy, digital services, logistics, and innovation.
The distribution of the fund’s resources reflected the scale of the economic damage from the pandemic and the size of national economies. The largest recipients of RRF grants and loans were Italy, which received approximately €194 billion; Spain, approximately €163 billion; France, approximately €40 billion; Poland, up to €59.8 billion; Romania, approximately €29 billion; and Portugal, which received approximately €16.6 billion. In total, by the beginning of 2026, EU member states had received approximately €394 billion from the fund’s total budget. The data shows that Italy and Spain account for almost half of the entire fund. This scale of funding has made these countries key platforms for the implementation of infrastructure, energy, and digital projects.
As the volume of payments grew, signs of abuse began to emerge. Investigations centered on schemes involving shell companies, inflated project costs, and tender manipulation. The European Public Prosecutor’s Office (EPPO), the EU’s supranational public prosecutor’s office created to combat crimes against the Union’s budget, plays a key role in the investigations. According to its end-2025 report, 512 cases related to the use of RRF funds are being actively investigated. These cases involve approximately 2,000 suspects, and the estimated damage is estimated at approximately €5 billion. This was reported on March 2, 2026, by the journalistic publication Follow the Money, citing data from the prosecutor’s office. According to EPPO, fraud involving the recovery fund already accounts for 21% of all active investigations related to the spending of EU funds. A year earlier, this figure was 17%. In 2025 alone, the Public Prosecutor’s Office opened nearly 300 new cases, setting a new record. The largest number of cases involve Italy, with 331 ongoing investigations, making it the largest center of uncovered irregularities. This is partly due to Italy being the largest recipient of the fund’s funds. According to EPPO, of the €394 billion already disbursed by the EU by the beginning of 2026, approximately €153 billion has been allocated to Italy. An additional factor is the active work of the financial police, the “Guardia di Finanza,” which regularly uncovers irregularities in the distribution of subsidies. Investigations by EPPO and national law enforcement agencies have uncovered several common patterns of abuse.
One of the most common schemes involves fictitious projects created solely to obtain subsidies. In such cases, organizers register shell companies or use inactive firms to submit funding applications. For example, in 2024, EPPO conducted Operation Stop the Carousel, which uncovered a network of companies with no real activity. The investigation established that the suspects had registered false financial statements in the corporate registry, purporting to show millions of euros in fictitious revenue, in order to obtain funding for e-commerce projects and international business expansion. As a result, the fraudsters managed to obtain approximately €490,000 in advance payments, which were immediately withdrawn via ATMs and bank transfers to other companies’ accounts. The investigation uncovered at least 15 instances of fraud, with the total funding applications reaching €15 million, which were blocked before they were disbursed. A larger example of a similar scheme was also uncovered in 2024 as part of an international EPPO investigation. Law enforcement agencies then arrested 22 individuals in Italy, Austria, Romania, and Slovakia suspected of creating a network of shell companies and receiving grants under the recovery program. According to prosecutors, the criminal group may have illegally obtained up to €600 million from Italy’s national recovery plan, which is financed by the RRF. The funds were transferred to accounts in other EU countries immediately after receiving advance payments, allowing them to quickly conceal their transactions.
Another common scheme is cost inflating. In such cases, genuine projects exist, but the cost of equipment, work, or services is artificially inflated. In 2025, an EPPO investigation in Italy found that a group of consultants and accounting firms were issuing fictitious documents for energy-efficient building work in order to obtain subsidies and tax credits. The investigation led to searches in several regions of the country, and a court ordered the confiscation of €3.3 million, which, according to investigators, represented illegally obtained funds. The case involves 35 individuals and 16 companies suspected of participating in a criminal organization. A similar scheme was uncovered in 2026 during Operation Nuovi Orizzonti. The investigation established that a group of tax consultants created companies under the names of front men and falsified financial statements to prove their financial soundness and obtain nearly €2 million in state subsidies and tax breaks, some of which were financed by the EU recovery fund. During the operation, Italian financial police confiscated assets worth €1.98 million, including bank accounts, real estate, company shares, and luxury cars.
Another common model involves collusion in public procurement and the allocation of contracts to pre-selected companies. Such schemes are often carried out through networks of intermediaries. Several EPPO investigations have noted the involvement of entire networks of specialists—accountants, notaries, and service companies—who helped create fictitious financial statements and submit grant applications. In some cases, such schemes allowed organizers to receive tens of millions of euros in subsidies by awarding contracts to associated companies.
A common scheme involves misrepresenting project objectives, whereby funds intended for digitalization or environmental modernization are used for other purposes. For example, in one EPPO case in Italy, two companies received €486,000 from the RRF fund for digital business transformation projects. The investigation found that the companies misrepresented their office locations and financial stability, and the projects themselves were never implemented. Part of the funds, approximately €183,000, were subsequently laundered through debt payments to other companies associated with the scheme’s participants. As a result, law enforcement agencies conducted searches in several Italian provinces and confiscated financial assets and real estate worth an amount equal to the alleged damages.
Some cases also demonstrate simpler forms of fraud. For example, in 2024, EPPO blocked a payment of €114,000 to a company that had applied for funding to create an e-commerce platform. The investigation found that the company’s owner had falsified financial statements, artificially inflating the company’s turnover to meet program requirements. As a result, bank accounts totaling €114,000 were frozen, and the investigation continued.
Journalists at Follow the Money point out that approximately €180 billion of the RRF’s total budget remains unused. This means the number of investigations is likely to grow. The more funds flow into the economy, the higher the risk of new fraudulent schemes, especially in countries with numerous infrastructure projects and complex public procurement systems. Scandals surrounding the recovery fund have not only financial but also political significance. The RRF program was the EU’s first attempt at large-scale joint borrowing, effectively setting a precedent for pan-European debt. Therefore, its success or failure will influence future EU financial decisions. Critics argue that weak oversight could lead to distrust of European funds. In response, some politicians are calling for stronger oversight by the European Commission, greater transparency in national programs, and expanded powers for the European Public Prosecutor’s Office.
Brussels understands that further corruption scandals could become an argument for Eurosceptic political forces, and with hundreds of millions of euros still to be distributed, a significant question for Brussels will be the EU’s ability to maintain confidence in its financial mechanisms and prove that European taxpayers’ money is actually going towards economic recovery, and not towards enriching fraudsters.