Agents of the National Police have dismantled the economic structure of an organization dedicated to laundering money from scams with the method known as "man in the middle". Six people have been arrested who acted as "mules and recruiters in Madrid, Seville, Murcia, Las Palmas, Estepona and Cartagena and as many searches have been carried out in which computer equipment has been seized.
The investigation began as a result of a complaint filed in December 2023 at the National Police Station of Huesca for a scam against a company in the Sobrarbe region. In said complaint, the businessman stated that he had instructed his tax advisor to pay a supplier an amount exceeding 170,000 euros. It was not until a few days later, when said supplier reported that he had not received any payment and the businessman realized that the email he had sent had been intercepted since his tax advisor had received the same email, but modifying the invoice in the part corresponding to the transfer number to which the payment should be made.
The steps taken made it possible to find out that behind this scam was a criminal organization that selected powerful companies, intercepting their emails so that when they detected that a multi-million dollar payment had to be made, they modified the account number of the beneficiary of the transfer.
Prior to the execution of the scam, the organization had allegedly created an economic structure to launder the money obtained. In this way, through recruiters, they used a network of mules and bank accounts in such a way that, as soon as the victim fraudulently deposited the money into the account of the criminals, it was quickly transferred through a network of bank accounts and withdrawn at ATMs located in France.
Operation of the economic structure of the organization
In a first step, the organization had a network of banking mules distributed throughout the national territory. These money mules received from the organization the amount of 150 euros for each online bank account they opened in their name. Once the bank account was opened, they gave the access codes to the organization, thus becoming controlled by the leaders of the criminal network.
To open these online accounts, the mules carried out a video verification with the bank to carry out a check with the identity documents provided. Generally, the mules used their own identity documents, although it has been detected that the organization used artificial intelligence to alter identity documents, keeping the mule's photograph, but using the personal data of third parties completely unrelated to these events, from whom they had fraudulently obtained their data.
Once the mules had opened these accounts, they requested the issuance of several bank cards associated with the accounts and that said cards be sent to a postal address. The postal addresses used by the organization corresponded to houses under construction in which the owners did not reside and which had an accessible mailbox, in which members of this criminal group appeared to extract the letters from the bank.
Once they had these bank cards, they sent them to France, where the organization had members dedicated to withdrawing money from ATMs located on the outskirts of Paris.
In this way, once this entire structure was created, the organization was ready to commit the scam. As soon as the businessman, under the deception of the man in the middle scam, made the transfer to a first "mule" account, it was emptied almost instantly, diverting the money through the network of fraudulently opened bank accounts and was withdrawn at ATMs.
Operational results
The investigation, led by the Provincial Brigade of the Judicial Police of Huesca and coordinated by Group 2 of Fraud in Online Commerce of the Central Cybercrime Unit of the General Police Station of the Judicial Police, has had the participation of the Brigades of the Judicial Police of Madrid, Seville, Murcia, Cartagena, Las Palmas and Estepona, where five people who acted as "mules" and three as recruiters have been arrested.
The investigation has made it possible to establish the connection of this network of mules and their recruiters with the scammers, based in other European countries, so the investigation remains open.
