One of the largest cyber fraud schemes in recent years has been dismantled in Spain. In Alicante, the Civil Guard uncovered a technological infrastructure capable of sending up to 2.5 million SMS messages and making thousands of phone calls each day to deceive residents. As a result of the operation, a 41-year-old Ukrainian national was arrested, and the seized equipment is valued at 400,000 euros.
The investigation began following complaints from residents of Aspe and Novelda, who fell victim to scammers and lost a total of 170,000 euros. The trail led investigators to Barcelona, where a hidden communications ‘factory’ was found in an ordinary coffee shop. It was here that the perpetrators operated almost 900 modems and hundreds of SIM cards, allowing their operations to run nearly non-stop.
How the scam worked: technology and scale
Inside the Barcelona café, there was an industrial IT complex disguised as a regular establishment. It housed 35 industrial SIMBOX units with 865 modems, 852 active SIM cards, and over 60,000 SIM cards ready for immediate use. In addition, 10,000 new SIM cards, computers, cash, and cryptocurrency were seized.
Each modem could send between 12 and 18 messages per minute, totaling up to 2.5 million SMS per day. The entire system was managed by a dozen computers. To conceal their activities, sender numbers were constantly changed, and SIM cards were bulk purchased using fake identities.
Victims and Fraud Methods
The scammers targeted Russian-speaking and Ukrainian residents in Spain. In their messages and phone calls, they posed as officers of the National Police or representatives of the Bank of Spain, convincing victims to share personal information and make bank transfers. To gain trust, the criminals thoroughly studied the profiles of potential victims and devised personalized fraud schemes.
The system was sold to other criminal groups worldwide. According to investigators, the total damages caused by this network could reach several million euros. The operation to detain suspects and seize equipment was carried out simultaneously in Barcelona, Alicante, and Tarragona.
Further investigation and precautionary measures
The detainee was initially released under a travel ban but was soon arrested again at El Prat airport while attempting to leave the country. He is charged with fraud, document forgery, identity theft, money laundering, and involvement in a criminal organization.
Law enforcement continues to investigate to identify all participants and masterminds behind the scheme. Citizens are advised to be particularly vigilant during periods of high shopping activity and not to trust suspicious messages or calls. It is recommended not to follow unknown links, not to disclose personal or banking details, to use two-factor authentication, and to report any attempted fraud to the police immediately.
