The son of the former prime minister of Moldova has been ordered to hand over nearly £500,000 following a corruption investigation by the National Crime Agency.

Vlad Luca Filat, 22, was hit with three forfeiture orders for money held in three bank accounts.

His father, Vladimir Filat, is currently serving a nine-year prison sentence for his role in the “theft of the century”, whereby $1bn was stolen from three Moldovan banks and laundered through Latvia’s financial system.

The theft, equivalent to 12.5% of Moldova’s entire GDP, prompted a massive government bailout of the three banks in an attempt to rescue the country’s financial system, causing the country’s currency to collapse.

According to the NCA, the son’s accounts and expenses were funded by large deposits from overseas companies, including in Turkey and the Cayman Islands. Large cash sums were paid into three HSBC bank accounts, including £98,000 in one three-day period.

Luca arrived in the UK in July 2016, one year after his father was arrested. His spending in London included paying almost £400,000 in rent upfront for a penthouse in Cadogan Square, Knightsbridge, one of the most expensive residential streets in the UK. He also spent £200,000 on a Bentley Bentayga, a luxury SUV, purchased from a Mayfair dealership.

Luca’s accounts were hit with freezing orders in May 2018. On Tuesday, at City of London magistrates court, the district judge, Michael Snow, granted orders on the accounts, requiring £466,322 to be forfeited. “I am satisfied on the balance of probabilities that the cash was derived from his father’s criminal conduct in Moldova,” the judge said.

Vladimir Filat, Vlad Luca Filat’s father, in 2009. Photograph: John Mcconnico/AP

Rob MacArthur, from the NCA’s international corruption unit, said: “Account freezing orders are a valuable tool in the fight against illicit finance in the UK. Where we suspect money in an account is the proceeds of crime, we can apply to the court to freeze and then forfeit the sums.

“In this case, Vlad Luca Filat was unable to demonstrate a legitimate source for the money and the court determined it to be recoverable.”

Rachel Davies Teka, the head of advocacy at Transparency International, welcomed the freezing order. “More action like this against high-profile and powerful targets is key to ending the UK’s reputation as a safe haven for dirty money,” she said.

“The case highlights how exposed UK professionals are to suspicious wealth and their importance in reporting this activity to the police. The private sector is the first line of defence against corrupt wealth entering the UK, with vigilance and full cooperation required to counter this threat.”

Ava Lee, a senior anti-corruption campaigner at Global Witness, called for the NCA to investigate the UK entities that received payments from Luca.

“This kid is the son of an former prime minister imprisoned for an abuse of power related to a billion-dollar scandal, driving to uni in a Bentley, renting a penthouse that costs more each day than most students pay a month,” she said.

“The National Crime Agency should now be asking the bank, the university, the estate agent and the car dealer what checks they made on this suspicious spender and his Cayman Island companies.”

Bank account freezing orders were introduced in the Criminal Finances Act 2017, alongside unexplained wealth orders (UWO), which target assets.

Last year the NCA was granted a UWO against a different Knightsbridge property belonging to Zamira Hajiyeva, who spent £16m at Harrods over a decade. Her husband, Jahangir Hajiyev, had previously been convicted of defrauding £2.2bn from Azerbaijan’s national bank.