The Guardia Civil has dismantled a major criminal network specializing in bank fraud after a two-year investigation uncovered the theft of personal and financial data from around 500,000 people across Spain. The operation led to 13 arrests, while five more suspects are under investigation in Madrid, Palma de Mallorca, Valencia and Toledo. It began after a victim reported losing €30,000 to a fake SMS claiming to come from his bank.
Authorities said the group used smishing and phishing, sending mass text messages that mimicked legitimate banking communications. Victims were directed to fraudulent websites, where they entered their online banking credentials. The fraudsters then called while posing as bank employees and sought verification codes to complete unauthorized transactions. Together, the fake messages and websites led into vishing, the use of phone calls to impersonate trusted institutions and obtain information or authorization.
The method mirrors a common bank-themed smishing approach described in Spanish coverage: a message warns that an account has been blocked and urges the recipient to follow a link to restore access. Spain recorded 488,426 cybercrimes in 2025, including 429,677 computer-fraud cases, information from official statistics cited by Diario Vasco. Those figures offer national context for the database seized in the investigation.
After gaining access to accounts, the criminals transferred available funds and applied for pre-approved loans or other financial products in victims’ names. They quickly moved the stolen money through a web of bank accounts to obscure its origin and launder the proceeds. Investigators uncovered a sophisticated structure built around false identities and third-party accounts, with a distributed technological infrastructure spanning several countries.
The financial impact of such fraud can grow through repeated transfers. Banco de España supervisory data reported by Cinco Días showed that the average amount of fraudulent transfers rose 42% in the first half of 2025, reaching €2,347 per operation. The same publication reported €318 million in banking-sector fraud in Spain in 2024, with customers bearing approximately two-thirds of the amount.
During the final phase of the operation, police conducted three searches, two in Valencia province and one in Madrid. They seized mobile phones and computers, along with other electronic devices, documents and cash linked to the criminal activity. Among the confiscated materials was a database containing personal and banking details for approximately half a million individuals. Nearly 2,000 potential victims have been identified so far, and the Guardia Civil says that figure could rise as the investigation continues.
The suspects, ten men and eight women aged between 23 and 43, face charges including fraud and money laundering, as well as membership in a criminal organization. Investigators highlighted the complexity of the case, which required financial intelligence and technological analysis to trace false identities, rapid transfers between banks and international links.
Spanish authorities remind the public that banks do not ask customers to disclose passwords or verification codes by phone, SMS or email. They urge anyone receiving a suspicious message to keep personal and banking information private, use official channels to access online banking, and contact their bank directly about unexpected communications. Customers are also advised to monitor account activity and report unauthorized transactions immediately.
The case comes amid growing concern about digital fraud in Spain and judicial proceedings in Madrid involving complex financial crimes. The ongoing review of high-profile corruption cases, including the one involving Begoña Gómez, reflects broader challenges for the Spanish legal system as it addresses sophisticated criminal networks. More details on the judicial response can be found in this recent report on Madrid's court proceedings.
Cybercrime accounted for a major share of recorded criminal activity in Spain in 2025, with computer fraud making up nearly nine out of ten reported cybercrime cases, according to official figures cited by Sevilla Actualidad. In separate reporting on complaints involving cyberfraud, RTVE said that 5,000 such complaints had been rejected by the Banco de España during the previous year. These figures feed into a wider debate over how losses are divided between banks and customers, particularly when criminals use stolen credentials or verification information to make transactions appear authenticated. As digital banking expands, law enforcement agencies continue to urge institutions and customers to stay alert to developing impersonation and fraud tactics.
