An online fraud operation attributed to a criminal network caused losses of €140 million across several European countries, information from Spanish National Police. The investigation led to the arrest of four people, two in Portugal, with the others arrested in Spain and Panama, on allegations linked to high-value scams and money laundering.
Authorities allege that the group used fraudulent investment platforms. Police also cite CEO impersonation and so-called “Man in the Middle” attacks. Fake invoices were another alleged tool. In this type of cyberattack, criminals intercept communications between parties and may alter payment instructions, diverting transfers to accounts they control. CEO impersonation schemes similarly exploit trust in a senior executive or business contact to pressure staff into authorizing payments. Police say the network opened more than 800 bank accounts and established 120 shell companies to move funds taken from victims. The money was then routed through a network of “money mules,” people used to receive or transfer illicit funds. They included European nationals recruited to establish companies and open accounts in Spain.
Investigators identified 67 foreign frontmen who did not live in Spain and traced more than €94 million in financial flows through the network. A further €61 million was reportedly defrauded in 2024 through CEO impersonation. The operation spanned Spain and Portugal, with action also in Panama. Europol and Interpol participated in the cross-border effort.
The investigation began after police examined business activity involving nine people and 19 companies that appeared legitimate but raised suspicions of money laundering. Further inquiries revealed the alleged network’s scale and identified members responsible for managing the scheme and recruiting money mules. In February, the basic suspect moved to Porto, Portugal, prompting coordinated action by Spanish and Portuguese authorities, including European arrest warrants for him and his partner. Another central figure, alleged to have managed the financial infrastructure, left Spain for Panama after travelling through several countries. Police found a fully equipped fraud-management office at his residence.
Some members operated from Barcelona, while others worked in Girona and Tarragona as “mule shepherds,” intermediaries who oversaw the network’s financial logistics. Police dismantled two basic operational centres and arrested their leaders, seizing more than 170 smartphones and 15 computers used to process thousands of transactions. Authorities also froze €3 million in assets linked to the alleged fraud, which are intended to be made available to victims.
The case shows how cyber-enabled financial crime can pair digital deception with conventional corporate and banking infrastructure. The alleged use of shell companies and multiple accounts created layers between victims’ payments and those directing the operation. Recruited intermediaries added another layer. The investigation’s cross-border scope also reflects the challenges authorities face when the people involved are based in different jurisdictions from the companies, accounts and victims. Related legal and public-order pressures have also been reported in Catalonia, where nearly 40% of Spain’s illegal home occupation complaints were concentrated in recent years.
Money mules may know what they are doing or be misled about the purpose of their role. In either case, their accounts can help move funds between victims and organizers. Investigators in this case focused on the technical infrastructure and the people responsible for recruiting and coordinating those intermediaries. Spanish and Portuguese authorities worked with Europol, while Interpol also participated. Their involvement reflects the need for international cooperation when alleged fraud networks operate across borders.
