Spanish police dismantle €140 million investment fraud and BEC cybercrime ring

Spanish police have dismantled a sophisticated cybercrime and money-laundering organization responsible for defrauding victims of €140 million ($160 million) through investment scams and business email compromise (BEC) attacks. The operation, which involved international cooperation, led to the arrest of four individuals across Spain, Portugal, and Panama, based on information published by Bleeping Computer.

The cybercrime network operated on an industrial scale, utilizing at least 800 bank accounts and 120 business accounts, with 67 external accomplices acting as money mules. The group received large sums of illicit funds, immediately dispersing and concealing them through complex transaction chains to launder the proceeds. Investigators confirmed €94 million ($107 million) flowed through the network and linked an additional €61 million ($69.5 million) to BEC operations in 2024, often referred to as "CEO fraud" or "false-invoice fraud." These attacks involved social engineering tactics like impersonating executives to divert payments.

The investigation began after police detected money laundering signs in 19 associated companies. International law enforcement, with assistance from Interpol and Europol, conducted raids in Spain and Portugal, and apprehended a suspect in Panama. Authorities seized 15 computers and over 170 smartphones, believed to be used for fraudulent transfers. Approximately €3 million ($3.4 million) in crime proceeds was frozen and will be made available to victims. Spanish police believe the network has been effectively dismantled with the arrest of its main operators.

Source: Bleeping Computer