The Spanish National Police (Policía Nacional), supported by the Italian National Police (Polizia di Stato), Europol and Eurojust, have dismantled an organized crime group linked to the Italian Mafia involved in online fraud, money laundering, drug trafficking and property crime. The suspects defrauded hundreds of victims through phishing attacks and other types of online fraud such as SIM swapping and business email compromise before laundering the money through a wide network of money mules and shell companies. The illegal profit for last year alone is estimated to be EUR10 million.
Overall, the operation resulted in 106 arrests, mostly in Spain and some in Italy; 16 house searches; 118 bank accounts frozen; and seizures of electronic devices, credit cards, SIM cards, point-of-sale terminals, a marihuana plantation and equipment for its cultivation and distribution.
This large criminal network was very well organized in a pyramid structure, which included different specialized areas and roles. Among the members of the criminal group were computer experts, who created the phishing domains and carried out the cyber fraud; recruiters and organizers of the money muling; and money laundering experts, including experts in cryptocurrencies. Most of the suspected members are Italian nationals, some of whom have links to mafia organizations. Located in Tenerife (Canary Islands, Spain), the suspects tricked their victims, mainly Italian nationals, into sending large sums to bank accounts controlled by the criminal network. They then laundered the criminal proceeds through a wide network of money mules and shell companies.
Europol facilitated the information exchange, the operational coordination and provided analytical support for this investigation, which lasted over a year. During the operational activities, Europol deployed two analysts and one forensic expert to Tenerife, Spain and one analyst to Italy. Additionally, Europol funded the deployment of three Italian investigators to Tenerife to support the Spanish authorities during the action day. The Joint Cybercrime Action Taskforce at Europol supported the operation. This standing operational team consists of cyber liaison officers from different countries who work from the same office on high profile cybercrime investigations.
