Spanish police dismantle €140 million fraud ring that drained company bank accounts
Four arrests across Spain, Portugal and Panama close down a laundering network that pushed nearly €100 million through 800 bank accounts, much of it stolen through fake CEO emails.
Key points
- Spanish police arrested four people in Spain, Portugal and Panama over a fraud and money-laundering ring that moved €140 million (about $160 million).
- Investigators traced €94 million through the network and linked a further €61 million to business email fraud carried out in 2024.
- The group ran more than 800 bank accounts, 120 business accounts and recruited 67 people as "money mules" to shuffle stolen cash.
- Officers seized 15 computers and over 170 phones, and froze €3 million that will be returned to victims.
Spanish police have taken apart a criminal group that stole roughly €140 million (around $160 million) from businesses, mostly by tricking staff into wiring money to the wrong accounts.
Four people were arrested. Six premises were searched across Barcelona and two other Catalan provinces, plus Porto in Portugal, and one further arrest was made in Panama. Interpol and Europol helped coordinate the operation, first reported in English by BleepingComputer. Our coverage of Interpol's Operation First Light 2026 on 9 July showed how BEC sits at the centre of nearly every major multinational fraud sweep right now.
What makes this case stand out is the plumbing behind it. The gang ran more than 800 personal bank accounts and 120 business accounts, with 67 "money mules", people who receive stolen funds and pass them on for a cut.
Once stolen funds landed, they were split and pushed through long chains of transfers, often into accounts abroad. That shuffling makes the money hard to follow and even harder to claw back.
How did the criminals actually steal the money?
They used business email compromise, or BEC: a scam where criminals send emails that appear to come from a company's boss or a trusted supplier, instructing staff to move money or change payment details.
Spanish investigators describe two forms. "CEO fraud" targets a finance employee with an urgent message appearing to come from the chief executive, demanding a quiet, immediate transfer. "False-invoice fraud" has criminals impersonating a real supplier and quietly swapping bank details on an invoice so the next payment goes to them.
Both rely on urgency and authority. No malware, no exploit, just a convincing email and a distracted human.
As I've written before, this is where my usual beat gets awkward. Multi-factor authentication stops most password theft, but it wouldn't have stopped this. BEC isn't an authentication problem: criminals don't need the CEO's password. They spoof the display name or register a lookalike domain, and the finance team never checks the actual sending address. We laid out exactly how that supply chain works in our June piece on BEC's anatomy.
What does help is unglamorous. Call-back verification on any change of bank details. A second signature on payments above a threshold. Email rules that flag lookalike domains. And DMARC, an email authentication standard that lets a company instruct the world's mail servers to reject messages faking its domain.
What happens to the stolen money?
Police froze €3 million (about $3.4 million) immediately, to be returned to victims. The rest is realistically gone, scattered through mule accounts in other jurisdictions.
Investigators also seized 15 computers and more than 170 phones, believed to have been used for thousands of fraudulent transfers. The investigation began after suspicious money movements were detected in 19 companies linked to the group. Two of the four suspects had recently left Spain but kept operating remotely in support of the scheme before being caught abroad.
Spanish police say the network's main operators are all under arrest and the laundering pipeline is shut. That's a genuinely good outcome. Given the global scale of BEC, though, it's also a very small dent.
