Spanish Police Dismantle €140 Million Cyber Fraud Network Behind Fake Investment Platforms

Spanish National Police have dismantled an international cyber fraud network accused of stealing approximately €140 million through fake investment platforms, CEO fraud, false invoice schemes, and man-in-the-middle attacks, marking one of the country's largest recent financial crime investigations.

Four suspects were arrested during coordinated operations in Spain, Portugal, and Panama. The group allegedly built an extensive financial infrastructure to receive, move, and launder proceeds from victims across multiple European countries.

According to investigators, the organization controlled more than 800 bank accounts and 120 companies, while using 67 foreign money mules to establish businesses and open accounts throughout Spain. These accounts served as the backbone of the laundering network, allowing stolen funds to be rapidly transferred through multiple layers before reaching overseas destinations.

Police said the suspects operated fake investment platforms alongside other business email compromise schemes, including CEO fraud and fake invoice scams. Once victims transferred money, the funds were immediately dispersed through a chain of bank accounts designed to disguise their origin and complicate asset tracing.

Authorities have so far identified more than €94 million in illicit financial flows linked to the laundering operation. Investigators also connected the network to €61 million lost through CEO fraud in 2024, bringing the total value associated with the criminal organization to around €140 million.

Searches carried out in Barcelona, Girona, Tarragona, and Porto resulted in the seizure of more than 170 smartphones and 15 computers allegedly used to manage thousands of fraudulent transfers. Investigators also froze €3 million in suspected criminal proceeds, improving the prospects for victim recovery.

Police said the operation dismantled two of the organization's main money laundering hubs and significantly disrupted its international infrastructure. Investigations remain ongoing as authorities continue tracing additional assets, identifying accomplices, and pursuing further enforcement actions against the network's remaining members.