Just days after making away with millions of rands from the Postbank's investment account, the syndicate - believed to have nine main members - splashed out on luxury cars, a speedboat, expensive clothes, whisky and Cuban cigars.

When Piet Pieterse, head of the police's cyber crimes unit, arrived with other officers to arrest them at 11pm on January 31, they found three prostitutes in the men's company and more than a dozen bottles of expensive cognac.

The Times has reliably learned that Pieterse's unit and the National Intelligence Agency had enlisted the services of an auditing firm, a forensic risk management company and self-confessed hacker Alistair Peterson, once the most wanted online banking hacker in South Africa.

In 2007, Peterson pleaded guilty to hacking four of South Africa's biggest banks and stealing R55-million.

Investigators told of how, while working on the case, Pieterse and his team found an intricate and sophisticated web of cyber hacking that belonged in the realm of novels.

Officials believe that the syndicate stole a desktop computer from the Post Office before Christmas, the only computer from which major transactions can be authorised. The manager authorised to operate the computer was, according to the investigators, on leave. They believe the syndicate then duplicated all the software on the computer and downloaded it onto a laptop, which they later used to siphon off the money.

The syndicate is said to have returned the desktop computer to the Post Office before the theft could be detected.

Investigators believe that, before the heist, several fake IDs were used to open 400 Postbank accounts, to which all the money was deposited.

The investigators said Peterson had suspected that the syndicate had used "key loggers" - software that hackers infiltrate onto a computer system to bug all the words typed on its keyboard - to copy the password used to log on to the computer.

On the day of the robbery, the syndicate used the laptop to go online from an internet cafe in Atteridgeville, west of Pretoria.

Over three days - until 6.11am on the third day - the syndicate worked to transfer all the money from a Postbank account to business accounts at other banks. Before the money was transferred, members of the syndicate increased the cash withdrawal limits on all the fraudulent accounts from R1000 to R100000.

Funds were then transferred from Postbank's investment account to a business account at another bank.

The money was thereafter transferred to a second bank account belonging to a private company, and numerous transactions were made into more than 400 fraudulent Postbank accounts.

The syndicate then dispatched mules to withdraw cash from ATMs.

Of the three suspects, two are former call centre workers for the Post Office.

Police are said to be hot on the heels of at least two other suspects, who are known to them.

Hawks spokesman McIntosh Polela referred all inquiries to the Post Office because, he said, the police did not want to "duplicate communications".

Post Office spokesman Lungile Lose said one of the bank's former employees appeared in the Bloemfontein Commercial Crimes Court on Monday. Another suspect, who did not work for the Post Office, appeared in the Pretoria Commercial Crimes Court on Wednesday.

"They have not pleaded and have been remanded in custody," Lose said.

"Their personal details cannot be divulged until they plead."

The investigators said the police were believed to have seized the speedboat, a fleet of luxury cars, including the latest in the BMW5 series, and a top-of-the-range Jaguar, plus tens of thousands of rands in cash, which the Asset Forfeiture Unit will evaluate.