I'm sure this happened, but this is where the checks and balances come in; there were apparently no checks to see if the people actually lived and worked in NL. And there was no recourse to get the money back, which is a failing of European law and the fraudster's country of origin's legal branches.

And the fix was to cast too wide a net; instead of handling the individual cases, they instead tried to apply logic and rules to it; if (country == bulgaria) fraudPotential += 100 kinda thing.