Fourteen people have been arrested in Torrevieja for their alleged involvement in a large-scale SMS fraud operation that targeted victims across the whole of Spain. The scheme, which generated losses of more than €200,000, involved sending thousands of fraudulent text messages designed to steal banking details and make unauthorised withdrawals and payments.
The Guardia Civil says it has so far identified nearly 200 victims in 46 provinces, with the investigation remaining open as officers believe there may be further victims both in Spain and abroad, including in Lithuania, Cyprus, Poland, France and Greece.
The criminal network is accused of committing close to 1,000 cyber fraud offences, many of them attempted scams. According to investigators, the operation was run primarily from Torrevieja, where most of those arrested were living.
Three-phase investigation
The investigation, led by the Guardia Civil’s Investigation Unit in Torrevieja, began in early 2024 after a sharp increase in payment fraud cases was detected nationwide. Although victims were spread across the country, many of the fraudulent transactions were carried out in the Vega Baja region, particularly in Torrevieja.
The operation was carried out in three phases and included three house searches in the city, where officers seized a large quantity of electronic equipment used to carry out the scams.
How the scam worked
Investigators uncovered a well-organised and flexible criminal structure dedicated to the illegal trade and use of payment methods, both physical and digital. The network was divided into several levels, ranging from technical specialists who obtained stolen banking data, to intermediaries and so-called “money mules” who withdrew cash or made fraudulent purchases at ATMs, shops, betting shops and gaming venues.
The scammers created fake websites and links that impersonated banks, major telecommunications companies and even public institutions. Victims received mass SMS messages pretending to be from these organisations and were tricked into entering their banking credentials.
The criminals then used this information to add victims’ cards to mobile devices and carry out unauthorized payments and cash withdrawals.
Luxury villa raids
In the first phase, carried out between July and August 2025, officers focused on the upper levels of the network responsible for the mass enrolment of bank cards. A search of a luxury villa in Torrevieja uncovered what police described as a “card enrolment laboratory,” where they seized 65 high-end mobile phones, cryptocurrency wallets, anonymous prepaid cards and computer equipment.
Two suspects — a 44-year-old man and a 36-year-old woman of Ukrainian origin — were arrested. One of them was remanded in custody by order of Torrevieja Court No. 2. Police say the arrest prevented a significant expansion of the scam.
Fraudulent card use
In a second phase, running from January to October 2025, investigators dismantled another branch of the group focused on using stolen physical bank cards, mainly linked to a well-known bank.
In October, a second villa in Torrevieja was searched and three suspects — two men aged 20 and 52 and a 24-year-old woman, all of Romanian origin — were arrested. They are accused of using the cards to commit fraud at ATMs, shops and gaming venues and were brought before the Orihuela duty court.
Final arrests across several locations
Despite sophisticated security measures used by the criminals, a third phase of the operation led to the arrest of nine more suspects between 19 and 24 November 2025. These arrests took place in Torrevieja, Dolores, Almoradí, Los Montesinos, Santa Eulalia in Ibiza and Villamalea in Albacete. All nine are of Moroccan origin.
Charges and seized material
In total, 14 people — 11 men and three women aged between 22 and 52 — have been arrested. They face charges including ongoing fraud, theft, handling stolen goods, document forgery, membership of a criminal organisation and identity theft.
Officers seized 74 mobile phones, 85 SIM cards, three computers, two tablets, a point-of-sale terminal, routers, signal jammers, prepaid cards worth €12,000, cryptocurrency wallets and other technological devices.
The operation was supported by Guardia Civil units in Almoradí, Dolores, Santa Eulalia (Ibiza), Albacete and the USECIC unit in Alicante.
The Guardia Civil says it has dealt a major blow to organised cybercrime, completely dismantling the group’s entire operational capacity.
