Spanish National Police have dismantled an international cybercrime and money laundering network accused of stealing more than €140 million ($160 million) through investment fraud and business email compromise (BEC) scams. Four suspects were arrested during coordinated operations in Spain, Portugal, and Panama.
According to investigators, the criminal organization targeted victims across several European countries using fake investment platforms, CEO fraud, fake invoice schemes, and man-in-the-middle attacks. The group allegedly laundered the proceeds through a complex international financial network designed to conceal the origin of the stolen funds.
The operation included raids in Barcelona, Girona, Tarragona, Porto, and Panama. Two suspects were arrested in Portugal, one in Spain, and another in Panama. Police said two of the suspects had recently relocated outside Spain but continued coordinating the fraud operation from abroad.
During the searches, investigators seized 15 computers, more than 170 smartphones, and other electronic devices believed to have been used to execute thousands of fraudulent financial transactions. Authorities also froze approximately €3 million ($3.4 million) in criminal proceeds, which they said could be returned to victims as the legal process continues.
Police allege the organization used sophisticated social engineering techniques to trick companies into transferring money to accounts controlled by the group. In business email compromise attacks, cybercriminals typically impersonate executives, suppliers, or trusted business partners to convince employees to redirect legitimate payments to fraudulent bank accounts.
The investigation was supported by Europol and law enforcement authorities in Portugal and Panama. Spanish police said international cooperation was essential because the organization operated across multiple jurisdictions, using foreign bank accounts, shell companies, and money mules to move illicit funds and complicate financial investigations.
Authorities have not disclosed the identities of the suspects or confirmed whether additional arrests are expected. The investigation remains ongoing as investigators analyze the seized electronic devices and financial records to identify other members of the network and determine the full scope of the alleged fraud operation.