Backpacks with distinctive signs of wear or personal features that made them identifiable, comparisons between old photographic material and footage from the day of the attack, as well as forensic morphological analysis by the Hellenic Police’s Directorate of Criminal Investigations, formed the core of the investigation that, 16 years later, led to the identification of the three individuals accused of the deadly arson attack at Marfin Bank on May 5, 2010.

In the new case file, authorities pieced together a network of evidence: video footage from the day of the riots, photographs taken as the group moved towards the bank branch, older personal photographs of the individuals under investigation, identification documents, social media material and, most importantly, objects that appear to have been carried by the suspects at different times and locations.

The Marfin case remains one of the darkest cases of the post-dictatorship period in Greece, in which three employees lost their lives inside the bank branch on Stadiou Street (one of them pregnant), when a group of masked individuals broke away from the crowd during the riots, moved towards the bank, smashed the glass facade and threw Molotov cocktails inside.

The moment “Person A” breaks the glass

The reopening of the investigation, following an anonymous email sent to the Directorate for Combating Organized Crime, brought back under scrutiny material that for years had not been possible to fully exploit.

The key evidence was the footage from the day of the attack. According to the information that has emerged, a journalist who was on Stadiou Street photographed the group of masked individuals from across the street, capturing the moment when part of the group separated and moved towards Marfin. In these images, authorities numbered members of the group in an attempt to map out who played a role in the attack.

The forensic analysis by the Directorate of Criminal Investigations, obtained by Proto Thema, did not rely solely on visual comparison of photographs. Experts examined video footage recorded on May 5, 2010, photographic archives, copies of identification documents, social media records and material stored on digital devices.

The examination followed an international protocol for comparative analysis, involving stages of analysis, comparison, evaluation and verification by specialised examiners.

The first level of the investigation involved linking three reference individuals with actual people. In the report, they are identified as “Person 1,” “Person 2” and “Person 3.” These individuals were compared with photographs from identification documents, archives of individuals previously photographed by authorities and social media material. Based on this comparison, the Directorate of Criminal Investigations concluded that the three reference individuals matched the characteristics of the three people who became the focus of the investigation.

The second and most crucial level was the comparison of these individuals with those appearing in footage from May 5, 2010. Authorities used the code names “Person A,” “Person B” and “Person C.” In simple terms, “Person 1” was compared with “Person A,” “Person 2” with “Person B” and “Person 3” with “Person C.” The first two individuals have already been remanded in custody.

For “Person A,” the analysis identified similarities with “Person 1” regarding visible facial features and body type. Since the lower part of the face was covered, examiners focused on visible characteristics: body structure and proportions, the upper part of the nose, the position of the glasses, and the hat.

The strongest piece of evidence regarding “Person A” was the backpack. According to the forensic report, the backpack carried by “Person A” on the day of the attack matches in all general characteristics and displays the same specific and acquired features (later-added characteristics) as a backpack recorded in earlier material.

This was considered particularly significant, as acquired characteristics — wear marks, distinctive features and signs of use — can function like a “fingerprint” of an object.

For “Person B,” the comparison was more complex regarding facial features, as the face appears to have been completely covered with a scarf or mask. This meant that a reliable morphological facial analysis could not be conducted. However, the report identified similarities in body type and footwear, while once again the decisive element was the backpack.

The backpack carried by “Person B” on the day of the attack was identified, according to the report, as the same backpack recorded in earlier material and carrying unique acquired characteristics. In addition, the footwear worn by “Person B” appears to share several general characteristics with shoes documented in the comparison material.

The element that gives particular weight to the connection between the two men is the cross-possession of the backpacks. The report notes that backpacks with distinctive acquired characteristics appear during the 2008–2010 period to have been carried or located near “Persons 1” and “2,” while on the day of the attack they appear in the possession of “Persons A” and “B” through cross-identification.

In other words, the backpack associated with one individual appears in the possession of the other in footage from the attack, and vice versa.

This, according to the report, is not considered a random finding. The simultaneous presence of the two pairs of individuals in the same place and time, combined with the cross-possession of objects with unique characteristics, is assessed as a strong indication of a non-random connection.

In other words, the backpacks did not function simply as accessories; they acted as a link between earlier material and the footage from the Marfin attack.

For “Person C,” namely the 46-year-old woman arrested in London who appears in the footage, the forensic examination was of a different nature. In this case, no objects were found that could be compared with corresponding items belonging to the reference person. Therefore, the comparison was limited to visible morphological characteristics: body type, visible facial features, forehead, hairline and hair colour.

The report concludes that “Person C” shares similarities with “Person 3” in terms of body type and visible facial and hair characteristics. The conclusion is more limited compared with the other two individuals, as it is not reinforced by objects such as backpacks, hats or footwear.

However, comparison with identification documents and social media material had previously led authorities to match “Person 3” with a specific reference individual.

Thus, the investigation moved along three parallel lines. First, it identified the three reference individuals through older material and official or digital sources. Second, it compared these individuals with those appearing in the footage from the day of the attack. Third, it searched for objects with stable or unique characteristics that could serve as links between the individuals and the Marfin footage.

The major difference compared with earlier attempts to use the material is that this time the analysis was not based solely on facial recognition.

Hoods, scarves and hats drastically limited the possibility of clear morphological identification. For this reason, experts placed particular importance on features that could not easily change during the events: body type, posture, glasses, hats, shoes and, above all, backpacks.

This methodology explains why the case began to be unlocked 16 years later. It was not because new video suddenly emerged, but because old material was re-examined through more advanced forensic processing and a different investigative approach.

Particular importance was also given to the material recorded by the journalist eyewitness, who captured the group before and during the attack. His testimony regarding an organised group, individuals wearing similar or distinctive clothing, backpacks and specific roles in breaking the glass and throwing flammable material, provided the framework within which the footage was evaluated.

According to this testimony, the group did not move randomly. Members allegedly separated from the crowd, approached the bank branch and assumed distinct roles: one at the front, another breaking the glass — identified by authorities through the analysis as “Person A,” namely “Person 1” — another throwing liquid and another throwing a burning object.

This picture is linked to the forensic analysis, as the objects carried by the individuals in the footage gained importance not only for identification purposes but also for assessing their alleged roles.

Overall, the new picture of the investigation shows that authorities did not reach the three individuals through a simple identification or general resemblance. They reached them through a combined evaluation of evidence: old photographs, video footage from the day of the attack, digital archives, identification documents, social media material, morphological analysis and objects with distinctive characteristics.