A major cybercrime operation has dismantled a network accused of stealing more than €1 million by sending fraudulent bank messages and then calling victims while pretending to be legitimate bank employees.

The Guardia Civil's Operation Ibermellow has resulted in 29 arrests, while another 57 people are under investigation across numerous provinces in Spain, including Las Palmas de Gran Canaria and Santa Cruz de Tenerife.

Investigators say the organisation used a sophisticated combination of fraudulent text messages and convincing telephone calls to persuade victims that their bank accounts were under threat.

However, an important distinction is that the confirmed victims in the investigation were in Aragón. The Canary Islands connection relates to people arrested or investigated as part of the wider alleged network, rather than €1 million having been stolen from victims in the islands.

Fake bank warning started the scam

According to the Guardia Civil investigation, victims initially received a text message designed to look as though it had been sent by their bank.

The message warned that a large or suspicious transaction had supposedly taken place and provided a telephone number to contact to stop it.

This technique is known as smishing, where criminals use fraudulent SMS messages to trick recipients into believing they are dealing with a legitimate organisation.

The second stage involved vishing, where victims were contacted by telephone by people claiming to work for their bank.

The callers reportedly already possessed some personal information about their targets, making the conversation considerably more convincing.

Using social-engineering techniques, victims were persuaded to make transfers into accounts controlled by the organisation or even take out personal loans before the money was diverted elsewhere.

The Guardia Civil says the network defrauded 43 identified victims in Aragón of more than €1 million.

100,000 fraudulent messages an hour

The scale of the operation is particularly striking.

Investigators discovered a call centre capable of sending more than 100,000 fraudulent SMS messages every hour.

During the first phase of Operation Ibermellow in March, properties were searched in Badalona and Terrassa in Barcelona, Carabanchel in Madrid and Cartagena in Murcia.

Five suspected senior members of the organisation were arrested.

Officers seized €57,520 in cash, 365 SIM cards, 176 bank cards, 95 machines capable of mass-producing SMS messages and 70 mobile phones, together with luxury items and documentation.

A second phase targeted the network allegedly used to launder and withdraw the proceeds.

Another 24 people were arrested and 57 placed under investigation, while €256,708 was recovered from bank accounts controlled by the alleged fraudsters. 

Canary Islands connection

The investigation extended across a large part of Spain, with arrests or investigations taking place in numerous provinces, including Las Palmas de Gran Canaria and Santa Cruz de Tenerife.

Police say the network included so-called money mules, people who allowed their bank accounts, virtual wallets or personal information to be used to receive and move illegally obtained money, generally in return for commission.

Others allegedly recruited the money mules or withdrew the stolen money before it reached those controlling the organisation.

The investigation is particularly relevant to residents in the Canary Islands because fraudulent messages purporting to come from banks have become increasingly convincing.

Customers should be extremely cautious about responding to an unexpected SMS claiming there has been suspicious activity on their account.

Rather than calling a telephone number contained in a message, customers should contact their bank independently using its official app, website or the telephone number printed on their bank card.