Spanish authorities have dismantled a criminal network accused of orchestrating the “hijo en apuros” scam, which targets victims with urgent messages impersonating family members. The Guardia Civil’s operation, codenamed Jogal, led to four arrests and three additional suspects under investigation after a resident in Almassora, Castellón, was deceived into transferring €7,000 to fraudsters posing as his daughter.
The investigation began when the victim reported receiving a message from an unknown number urgently requesting money for an alleged emergency. Believing the sender was his daughter, he made the transfer before realizing it was a scam. The complaint allowed officers to trace the stolen funds, revealing a structure involving multiple bank accounts and people allegedly acting as money mules to obscure the proceeds’ origin and movement.
Initial inquiries led to the arrest of a 29-year-old woman in Oropesa del Mar, Castellón, identified as the first recipient of the illicit funds. As the probe expanded, authorities uncovered a network that distributed money across various accounts, making it harder to trace and recover. The operation also identified three women, aged between 41 and 72, living in Oropesa del Mar and Vegas del Genil, Granada. They allegedly played roles in the group’s financial operations and are under investigation.
Further efforts by the Guardia Civil, with support from officers in Santa Pola, resulted in the arrest of a 39-year-old man in Elche, Alicante, believed to have coordinated the group’s economic activities. Two more suspects, a 34-year-old man and a 25-year-old woman, were detained over their alleged roles in managing and coordinating fraudulent transactions. The operation covered Castellón and Alicante, with investigators also working in Granada. Investigators said members of the group had distinct functions, from contacting victims to moving proceeds through financial transactions intended to hinder detection.
All four detainees and the three people under investigation have been brought before judicial authorities. The allegations concern a fraud pattern based on social engineering, not a technical breach of a victim’s bank account. A criminal claims to be a relative using a new or unfamiliar number, invents an urgent problem and pressures the target to transfer money before checking the story.
In Spain, the Instituto Nacional de Ciberseguridad (INCIBE) has also warned of related variants that exploit publicly available family details and phone numbers. Voice recordings can make impersonation more convincing. The method has expanded from text messages to fraudulent calls and artificial-intelligence-generated voice imitations. INCIBE-linked reporting says 15% of queries handled by its 017 cybersecurity helpline in 2025 concerned vishing, meaning fraudulent or attempted fraudulent telephone calls. That figure relates to helpline queries, not the share of all fraud cases.
The broader figures show the scale of cybercrime in Spain, though they do not measure this specific scam: 488,426 cybercrimes were recorded in 2025, including 429,677 computer fraud offences. Men accounted for 52% of victims, and people aged 51 to 65 were the most affected age group, information from official figures cited in Spanish reporting. The “hijo en apuros” modality is difficult to quantify because attempted and completed incidents may go unreported.
INCIBE advises people who receive a suspicious request not to share sensitive information and to verify the relative’s identity through a separate, familiar channel, such as the person’s usual phone number. If money has already been transferred, victims should contact their bank immediately to ask whether the payment can be stopped or recovered. They should also preserve messages and screenshots, then report the incident to the Policía Nacional or Guardia Civil. These steps can help investigators trace communications and follow the flow of funds.
Individual losses can be large. In a separate case reported in Irun, a victim transferred €30,000 after being contacted through the same impersonation method. The suspect was later arrested in Tarragona and was accused of taking almost €100,000 in total. The case shows how criminals can use the same urgent-family narrative against multiple victims, while transfers through multiple accounts can make it harder to identify where the money ultimately goes.
This case reflects the ongoing challenge of financial fraud in Spain, where digital scams continue to evolve. The Guardia Civil’s actions come amid increased scrutiny of suspicious financial activity, including in other high-profile investigations. For example, the force has previously called for deeper audits of political party accounts amid concerns over untraceable transactions, as detailed in a recent report on the difficulties tracing suspected secret funds.
Spanish authorities and cybersecurity bodies stress the need to check identities independently. An unfamiliar number or persuasive writing style should not, on its own, be treated as proof of identity. The same applies to a familiar-sounding voice. Prompt reporting and preserving evidence can support investigations and may improve the chances of tracing funds after a transfer.
