The Guardia Civil has dismantled a criminal organisation in Alicante dedicated to business email compromise (BEC) fraud. The cybercriminals intercepted and impersonated corporate emails to divert legitimate payments into bank accounts under their own control.
The operation has resulted in one arrest, five individuals placed under investigation, and the clarification of financial damages exceeding 330,000 euro, according to a statement from the Armed Institute.
The Technological Investigation Team (EDITE) of the Judicial Police Organic Unit of the Alicante Command launched the inquiries in the summer of 2025. This followed a complaint from a credit institution whose vehicle sales subsidiary had been defrauded. Other affected businesses were subsequently identified, totalling three major companies hit across different Spanish provinces.
Investigations revealed that the perpetrators intercepted or spoofed email communications between businesses during legitimate commercial transactions. Capitalising on this access, they altered payment instructions and destination bank accounts, ensuring that transfers were routed to accounts they controlled.
To move the stolen money, the group utilised “money mules” who were offered financial incentives in exchange for providing personal identification documentation or opening bank accounts. These accounts were used to receive, split, and transfer the funds in an attempt to hide the orchestrators of the plot.
Investigators tracked down and arrested the main suspect in Alicante, who was responsible for recruiting the intermediaries and coordinating the financial network. The other five individuals involved are being investigated across the provinces of Alicante, Cordoba, Las Palmas, and Madrid.
While a portion of the capital was blocked by the affected bank, another sum had already been transferred abroad. Collaborative efforts between investigators, Europol, and international police cooperation mechanisms successfully froze funds in a Hungarian bank account, recovering an amount close to 40,000 euro.
Those involved face charges of aggravated fraud, money laundering, and membership of a criminal group. The arrested individual was brought before the Instruction Section of the Court of First Instance in Denia and was subsequently released with precautionary measures.
