€140 million: that is the sum the Spanish Police say a cybercrime and money‑laundering organization extracted via investment fraud and business email compromise (BEC) attacks.
Spanish Police operation and arrests
Spanish Police announced the dismantling of an industrial‑scale cybercrime network and the arrest of four people in Spain, Portugal, and Panama. The inquiry began after investigators detected signs of money laundering in 19 companies linked to the scheme. Following identification of the main suspects, police executed an international operation, arrested four people and searched six premises in Barcelona, Girona, Tarragona and the city of Porto in Portugal; an additional suspect was arrested in Panama.
The banking network: 800 accounts, 120 business accounts, 67 money mules
The police describe a sprawling financial infrastructure behind the fraud. “The suspects created and managed a network of more than 800 bank accounts into which they received large amounts of illicit money defrauded from numerous victims,” the announcement states. Investigators say those funds were rapidly moved: the police add that “the funds were immediately dispersed and concealed through another network of bank accounts, creating chains of transactions that placed the criminal proceeds beyond reach and allowed the enormous amounts of stolen money to be hidden and laundered through available mule bank accounts in third countries.”
Police identified at least 120 business accounts and 67 external accomplices who acted as “money mules.” The investigation has confirmed that €94 million was channeled through the network and linked another €61 million to the group, specifically tying that sum to BEC operations that took place in 2024.
Tactics: CEO fraud and false‑invoice business email compromise
The police framed the group's modus operandi as variants of BEC. The announcement calls the activity “CEO fraud” and “false‑invoice fraud,” naming social engineering techniques such as impersonation of high‑ranking executives and diversion of payments to bank accounts controlled by the fraudsters. According to police excerpts, these methods were used to trick victims into authorizing transfers that then flowed through the layered account network.
Law enforcement agents seized digital evidence believed to show the operational reach of the scheme: 15 computers and over 170 smartphones that police say were used to execute thousands of fraudulent transfers.
International coordination: Interpol, Europol, and cross‑border arrests
Spanish Police credited international cooperation for the enforcement phase. The operation was organized “with the help of Interpol and Europol,” enabling coordinated action across borders. The report notes that two suspects arrested outside Spain had recently left the country but “continued to operate from their foreign bases in support of the cybercrime scheme,” underscoring the transnational behaviour investigators say they encountered.
Authorities also froze €3 million of crime proceeds immediately; the police say those funds “will be made available to victims of the cybercrime ring.”
What this means for security teams, companies, and victims
- Security teams and investigators: The seizure of 15 computers and more than 170 smartphones highlights the volume of digital evidence typical of large BEC networks and the technical scale of transactional obfuscation through hundreds of accounts. Teams handling BEC and fraud investigations will likely note the pattern of rapid dispersal and layering described by police as a hallmark to watch for in suspicious payment chains.
- Companies and finance departments: The police description of “CEO fraud” and “false‑invoice fraud” stresses continued risk from social engineering that targets payment workflows. The immediate freezing of €3 million and the promise to make those funds available to victims signals one tangible recovery action, but the size of the network suggests many victims and affected payments.
- Law enforcement and international partners: The involvement of Interpol and Europol in the raids and arrests demonstrates cross‑border coordination used to tackle actors who relocate yet continue operations from abroad. Police say they have now effectively dismantled the money‑laundering network and arrested all its main operators.
Spanish Police conclude that the money‑laundering network has been effectively dismantled and that “all its main operators have been arrested.” The case lays bare how some BEC and investment‑fraud operations combine social engineering with a dense, multi‑jurisdictional web of accounts and mule operators — and how law enforcement is responding with coordinated international action and targeted asset freezes. Whether further assets can be recovered and how quickly victims will be made whole remain practical, case‑specific next steps now in the hands of investigators.
