Six people have been arrested over a scam which police believe compromised the security of more than 20,000 bank accounts and credit cards.
Fake websites and spam e-mails are thought to have been used to try to steal an estimated £4m using victims' passwords and card numbers.
The arrests were made in London and in Navan, County Meath, Ireland.
Five men and a woman, all aged between 25 and 40, are being questioned by officers.
They were arrested on suspicion of conspiracy to commit online banking fraud and crimes under the Computer Misuse Act.
The Metropolitan Police, which has been investigating the crimes, said large numbers of unsolicited e-mails were sent as part of the scam.
They directed people to fake websites, designed to look as though they belonged to banks.
The victims entered their passwords and other personal details, which were allegedly recorded and used to transfer money.
Police said the gang had tried to steal £1.14m from 10,000 online bank accounts, successfully obtaining £358,000.
The exact amount taken from credit cards was unclear but has been estimated at more than £3m from about 10,000 cards.
"A great deal of personal information was compromised and cleverly exploited for substantial profit," said Det Insp Colin Wetherill.
"By disrupting the operation, we have hopefully prevented further loss to individuals and institutions across the UK."
Anybody who believes their account has been hacked into is advised to contact their bank and the police.