Swift action by the Policía Nacional in Valladolid and the victim’s financial institution led to the recovery of €9,327.21 transferred by a local resident after a fraudulent bank message prompted them to authorize a payment. The response came before the funds could move through additional accounts. That window matters in payment fraud: money can be harder to trace once it has been split or sent onward.
Police identified a man from Granollers, Barcelona, as the alleged “money mule” connected to the funds. A mule’s role differs from that of the person who first sends the deceptive message: mule accounts can receive proceeds and help move them through transfers or withdrawals. The case file was forwarded to the competent judicial authority on July 3. That step moved the investigation into the judicial process; it was not a court finding of guilt.
Smishing is impersonation fraud carried out through SMS or similar mobile messages. A common tactic is a false warning that an account has been blocked or flagged, followed by a link to a counterfeit banking site or instructions prompting the recipient to authorize a transfer. Diario Vasco has described messages such as “We have blocked your account. Click here to unblock it” as an example of this approach. In Valladolid, the victim reportedly acted on a message they believed came from their bank.
The scale of digital fraud offers wider context, although national totals do not measure smishing alone. Diario Vasco, citing official figures published in 2026, reported 488,426 cybercrimes in Spain in 2025, including 429,677 computer-fraud offences. The publication also said men accounted for 52% of victims, with people aged 51 to 65 the most affected group. These figures cover computer fraud broadly and do not show how many cases began with fraudulent text messages.
At European level, a report citing the European Central Bank and the European Banking Authority put the increase in payment fraud across the European Economic Area at 17% in 2024. The cited dataset recorded €153 million in fraudulent transfers and €141 million in card fraud. In Spain, the same report said the average value of fraudulent transfers rose 42% in the first half of 2025, reaching €2,347 per operation. These sector-wide figures do not establish how common smishing is or its typical losses, but they show the financial stakes of reporting a transfer quickly.
Payment fraud also accounts for a impressive share of Spain’s banking-complaints workload. A 2025 Banco de España memorandum, as cited by El Nacional, said card- and transfer-related fraud made up nearly 28% of complaints admitted to the process, making it the leading complaint category. That share covers complaints handled by the banking-complaints system; it does not measure all fraud offences or the proportion of victims who recover their money.
Warnings about messages impersonating trusted institutions point to a broader risk: identifying the first recipient of stolen funds does not, on its own, establish who created the message or whether the alleged mule knew the money was illicit. In this case, investigators and the bank coordinated before the funds moved through further accounts. Other financial investigations have also drawn attention, including the Guardia Civil’s UCO request for a full audit of PSOE accounts amid missing transactions, detailed in this related report.
The Valladolid case shows how quickly a customer contacts a bank, and how promptly the bank alerts law enforcement, can affect the chances of stopping or tracing a suspicious transfer. Spain’s Banco de España has also reported that card and transfer fraud leads the categories of admitted banking complaints, while European figures show large losses across payment methods. These broader measures describe payment fraud as a whole, not smishing specifically, but reinforce the need to treat unexpected banking messages and urgent payment requests with caution.
