Spanish Police take down €140 million cyber fraud ring, arrest four

Summary

Spanish police have dismantled a large cybercrime and money-laundering organization responsible for €140 million in investment fraud and BEC attacks. The operation involved at least 800 bank accounts and 67 external accomplices acting as money mules. Four individuals were arrested in Spain, Portugal, and Panama, with authorities freezing €3 million in crime proceeds.

Full text

Spanish Police take down €140 million cyber fraud ring, arrest four By Bill Toulas July 14, 2026 04:23 PM 0 The Spanish Police dismantled a cybercrime and money-laundering organization that made €140 million ($160 million) from investment fraud and business email compromise (BEC) attacks. As part of the law enforcement operation, four people were arrested in Spain, Portugal, and Panama. The police describe the operation as an industrial-level scheme as it involved at least 800 bank accounts, 120 business accounts, and 67 external accomplices who acted as “money mules.” “The suspects created and managed a network of more than 800 bank accounts into which they received large amounts of illicit money defrauded from numerous victims,” the police say. “The funds were immediately dispersed and concealed through another network of bank accounts, creating chains of transactions that placed the criminal proceeds beyond reach and allowed the enormous amounts of stolen money to be hidden and laundered through available mule bank accounts in third countries.” The investigation has confirmed that €94 million ($107 million) was channeled through the network and linked another €61 million ($69.5 million) to the group, tying it specifically to BEC operations that took place in 2024. The police announcement calls this “CEO fraud” and “false-invoice fraud,” indicating the use of social engineering tactics such as impersonating high-ranking executives and diverting payments to bank accounts controlled by the fraudsters. The investigation into the cybercrime operation started after the police detected signs of money laundering in 19 companies linked to it. Following the identification of the main suspects, an international police operation was organized with the help of Interpol and Europol. In this context, six premises in Barcelona, Girona, and Tarragona, as well as in the city of Porto in Portugal, were raided and searched, and another suspect was also arrested in Panama. The two suspects arrested outside Spain left the country recently but continued to operate from their foreign bases in support of the cybercrime scheme. The police agents seized 15 computers and over 170 smartphones, believed to have been used for executing thousands of fraudulent transfers. Additionally, €3 million ($3.4 million) of crime proceeds was frozen immediately and will be made available to victims of the cybercrime ring. Based on its investigation, the Spanish police believe that the money-laundering network has now been effectively dismantled, and all its main operators have been arrested. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: Spain arrests suspected member of pro-Russian hacktivist groupsAuthorities dismantle 'AudiA6' ransomware crypto-laundering servicePolice dismantles fake ID marketplace used by migrant smugglersSpain arrests doxer leaking sensitive data of govt employeesINTERPOL ‘Operation Ramz’ seizes 53 malware, phishing servers

Entities