This is the moment a cybercrime gang was arrested after allegedly stealing more than €1million from unsuspecting victims by posing as bank employees.
A total of 29 people were arrested and another 57 placed under investigation over 43 alleged offences including fraud, money laundering and membership of a criminal organisation.
Investigators claim the network operated a sophisticated call centre capable of sending more than 100,000 fraudulent text messages every hour.
The operation has stretched across dozens of provinces, including Malaga, Cadiz, Granada, Cordoba and Sevilla in Andalucia, as well as Madrid, Barcelona, Alicante, Murcia and Valencia.
How the scam worked
The investigation, dubbed Operation Ibermellow, began last year following a series of complaints in Huesca displaying the same pattern.
The alleged scammers combined two increasingly common forms of bank fraud known as ‘smishing’ and ‘vishing’.
According to a Guardia Civil press release, victims received an SMS purporting to come from their bank.
The message warned that a large transaction had been detected on their account and provided a telephone number to supposedly stop the payment.
Victims would then receive a telephone call from someone posing as a bank manager or employee.
According to the Guardia Civil, the criminals already possessed some personal information about their targets, making the calls appear more convincing.
Using social engineering techniques, they allegedly persuaded victims to transfer money into bank accounts controlled by the organisation.
In some cases, victims were even convinced to take out personal loans, with the resulting cash then diverted into accounts controlled by the scammers.
The Guardia Civil says 25 victims in Huesca, 11 in Zaragoza and seven in Teruel lost more than €1million between them.
Money moved across Spain
Once the money reached the fraudulent accounts, investigators say it was rapidly transferred between different bank accounts in an attempt to obscure its origin and frustrate police attempts to trace it.
The cash was eventually withdrawn from ATMs in Barcelona, Madrid and Murcia.
Investigators were able to follow the financial trail and identify numerous suspected money mules.
These are people who allow criminals to use their bank accounts, virtual wallets or personal details to receive and transfer illicit money, generally in exchange for a commission.
Police say the organisation also employed people to recruit the mules and others responsible for physically withdrawing the stolen cash.
Above them allegedly sat the people posing as bank employees and the individual responsible for the call centre and its mass SMS operation.
100,000 scam messages an hour
The first major phase of the operation took place in March, when officers searched properties in Badalona and Terrassa in Barcelona, Carabanchel in Madrid and Cartagena in Murcia.
Police said they dismantled the call centre, which had the technical capacity to send more than 100,000 SMS messages per hour.
Five suspected senior members of the organisation were arrested.
Officers also seized €57,520 in cash, 365 SIM cards, 176 bank cards, 95 mass-SMS machines and 70 mobile phones, alongside luxury goods and documentation allegedly connected to the fraud.
A second phase targeted the money-laundering infrastructure used by the group.
It resulted in a further 24 arrests, while another 57 people were placed under investigation.
Officers also recovered €256,708 from bank accounts allegedly controlled by the cybercriminal network.
Arrests and investigations across Andalucia
The operation ultimately extended across a huge part of Spain, with suspects arrested or investigated in A Coruña, Alava, Alicante, Avila, Badajoz, Barcelona, Cantabria, Cadiz, Cordoba, Girona, Granada, Las Palmas, Madrid, Malaga, Murcia, Ourense, Salamanca, Tenerife, Sevilla, Tarragona, Toledo, Valladolid, Valencia and Zaragoza.
The investigation was led by the Guardia Civil’s Judicial Police Unit and Equipo Arroba cybercrime specialists in Huesca.
