ELS-0020Scams · Spain

Spanish Police Break Up €140 Million Cyber-Fraud Network: A Warning for Expats

Official sources checked
Written by Sue Berry
Practical guidance

Spanish police have dismantled a major international cyber-fraud network. Here are the warning signs expats should recognise before trusting a message, approving a payment or transferring money.

The Quick Answer

Spanish police have helped dismantle a large international cyber-fraud and money-laundering network linked to investment scams and fraudulent payment instructions.

Investigators identified hundreds of bank accounts and numerous people suspected of receiving and moving stolen funds.

For expats, the important lesson is that scammers do not need to break into a home or steal a bank card. They may only need to persuade someone to trust the wrong telephone call, email, WhatsApp message, website or payment instruction.

Expats can be particularly exposed because they often manage banks, pensions, property, taxes, utilities and professional services across more than one country.

The safest response to any unexpected financial request is:

Stop, check and verify independently before sending money.

Why This Matters

Living between the UK and Spain can involve managing:

UK and Spanish bank accounts;

pensions paid in pounds;

currency transfers;

property purchases and sales;

community fees;

Spanish taxes;

utility accounts;

residency paperwork;

insurance;

solicitors, accountants and translators;

travel and family emergencies.

Many of these arrangements are handled through email, telephone calls, WhatsApp and online portals.

A scammer may already know your name, nationality, location or that you own property abroad. They may also know which bank, utility company or professional you use.

This information can make a false message seem genuine.

Older expats may also be targeted because criminals exploit:

politeness;

trust;

unfamiliar Spanish systems;

language difficulties;

complicated technology;

distance from family;

fear of missing an official deadline;

urgency;

the fact that one partner manages the finances.

Anyone can be deceived by a convincing scam. The aim is not to feel frightened or embarrassed. It is to create simple safeguards before a suspicious situation arises.

Frequently asked questions

Will a bank ever ask me to move money to a safe account? No. Treat any request to move money to a safe, secure or protected account as a serious warning sign. End the call and contact your bank independently.

What should I do if a professional emails new bank details? Telephone the professional using a number you already know to be genuine. Ask them to confirm the details verbally before sending money.

Can a scam email appear inside a genuine conversation? Yes. A criminal may compromise a real email account and send fraudulent payment instructions within an existing conversation.

How can I check whether a message from a Spanish authority is genuine? Do not use the link in the message. Visit the authority’s official website independently or telephone through an official published number.

What should I do after receiving a “Hi Mum, this is my new number” message? Call your family member using the number you already have. Do not send money until you have independently confirmed who is contacting you.

Are investment scams always easy to recognise? No. They may use professional websites, realistic dashboards, fake reviews and friendly advisers. Guaranteed returns and pressure to act quickly are important warning signs.

What should I do if I have already sent money? Contact your bank immediately, preserve all evidence, secure affected accounts and report the fraud. Speed may improve the chance of stopping or tracing the payment.

What is the INCIBE 017 helpline? It is Spain’s cybersecurity helpline for individuals and businesses. It provides guidance about online fraud, compromised accounts and other cybersecurity concerns.

Should I delete messages from a scammer? No. Keep emails, messages, telephone numbers, screenshots, receipts and bank details as evidence.

Can scammers target someone again after a loss? Yes. Recovery scammers may contact previous victims and claim they can recover the money in return for another fee.

Should both partners know how bills and banking are managed? Yes. Both partners should understand the main financial arrangements, genuine contacts and what to do when a suspicious request arrives.

When should I call 112? Call 112 when there is an immediate threat, a crime in progress or an urgent risk to someone’s safety.

Important — Read Before You Act

Never move money to a so-called safe account.

Never share:

one-time banking codes;

card PINs;

full passwords;

app-approval codes;

account-recovery codes.

Do not install remote-access software because of an unexpected telephone call.

If you believe money has already been sent to a scammer, contact your bank immediately. Speed can make a difference, although recovery cannot be guaranteed.

For an immediate danger or crime in progress in Spain, call 112.

Spain’s National Cybersecurity Institute, INCIBE, also operates the 017 cybersecurity helpline for individuals and businesses.

What To Do — Step by Step

Pause when a message creates urgency Scammers often try to stop people thinking clearly. They may claim: a payment is overdue; your account will be frozen; your electricity will be disconnected; police action is about to begin; a family member needs money immediately; an exchange-rate offer is about to expire. Pause before doing anything.
Do not click links in unexpected messages A fraudulent message may appear to come from: your bank; the Spanish tax authority; Social Security; the traffic authority; a delivery company; a utility provider; the police; a local council. Open the official website yourself or use an app you already trust rather than following the link in the message.
End unexpected bank-security calls A caller may say there has been suspicious activity and ask you to: confirm a security code; approve a payment; give card details; move money; install an app. End the call and contact the bank using a number printed on your card, listed in your banking app or saved from an earlier genuine contact.
Verify changed payment details independently Be particularly careful if a solicitor, estate agent, builder, accountant or supplier appears to send new bank details. Call the person using a telephone number you already know to be genuine. Ask them to read the account details back to you. For a large payment, consider sending a small test amount and confirming receipt before transferring the balance.
Recognise business email compromise Business email compromise happens when criminals impersonate a trusted person or gain access to a genuine email account. They may send a message such as: “Our bank details have changed. Please use this account.” The message may appear within an existing email conversation, making it difficult to recognise.
Be cautious with investments and pension offers Investment scams can use: professional-looking websites; convincing account dashboards; fake customer reviews; celebrity images; social-media advertisements; telephone calls from apparent advisers; small early returns designed to build trust. Be cautious of: guaranteed returns; pressure to act quickly; early access to pension funds; unusual overseas investments; promises of protection against currency movements; requests for more money to release profits.
Check currency-transfer companies independently A scammer may offer an unusually favourable pound-to-euro exchange rate and insist that money must be transferred quickly. Before sending funds: search for the company independently; check its regulatory position; verify its genuine website; call through an independently obtained number; confirm exactly where the money is going; avoid acting because of pressure.
Confirm family-emergency messages A common WhatsApp or text-message scam begins with: “Hi Mum, this is my new number.” The sender may claim to have lost a telephone, been locked out of online banking or need an urgent bill paid. Call the family member on their old number or contact another relative. Agree a private family verification phrase that is not easily discovered through social media.
Check property and rental offers carefully Fraudsters may advertise properties they do not own. They may request: a reservation payment; a rental deposit; rent in advance; copies of identity documents; payment before a viewing; money sent to a foreign account. A polished advertisement and friendly conversation do not prove that the property, landlord or agent is genuine.
Refuse unexpected remote computer access A caller may claim to be from: a technology company; your internet provider; a bank; a security service. They may say your device is infected and ask you to install remote-access software. Once installed, the criminal may see information, access accounts or manipulate what appears on your screen.
Protect your email account Your email can provide access to many other accounts. Protect it by: using a unique password; enabling two-step verification; keeping recovery details current; reviewing logged-in devices; checking for unknown forwarding rules; avoiding reused passwords; removing old devices and telephone numbers. A criminal with email access may monitor conversations and wait for a property, tax or business payment.
Protect your UK and Spanish telephone numbers Keep a record of: accounts linked to your UK number; accounts linked to your Spanish number; recovery arrangements; your mobile provider’s genuine contact details; another way family can contact you. Contact your mobile provider quickly if your telephone unexpectedly loses service. This may be a technical fault, but an unexplained loss of service can sometimes indicate an attempted SIM transfer.
Never allow your bank account to be used by someone else Criminals recruit people to receive and move stolen money. The approach may look like: a job offer; an online relationship; a request from a friend; an offer of commission; an opportunity to earn money from home. Never receive or transfer money for someone you do not fully know and trust.
Act quickly if money has already been sent Contact your bank immediately and explain that you believe the payment was fraudulent. Ask whether the bank can: stop the transfer; contact the receiving bank; freeze the payment; secure your account; replace cards; review recent transactions. Do not wait until the following day if the bank has an emergency fraud number.
Preserve evidence Keep copies of: emails; WhatsApp and text messages; telephone numbers; screenshots; receipts; bank details; website addresses; names used by the scammer; dates and times. Do not delete messages because you feel upset or embarrassed. The evidence may help the bank, police or cybersecurity advisers.
Secure affected accounts and devices Change affected passwords, beginning with: email; online banking; payment accounts; social media; cloud storage. Use a device you trust. If remote-access software was installed, disconnect the device from the internet and seek independent technical assistance.
Report the incident Fraud in Spain may be reported to: Policía Nacional; Guardia Civil; the appropriate local police service; your bank; INCIBE through the 017 cybersecurity helpline. For an immediate threat or crime in progress, call 112.
Beware of recovery scams After a person loses money, another scammer may offer to recover it. They may pretend to be: a lawyer; a police officer; a regulator; a bank investigator; a cryptocurrency specialist; a recovery company. They may know details of the original fraud because victim information can be shared between criminals.
Agree a family verification process Create a simple rule for urgent requests. For example: no unexpected payment is made without a telephone call; family members use a private verification phrase; bank-detail changes are checked verbally; large payments are discussed with another trusted person; suspicious messages are shared with family before action is taken. Choose a phrase that cannot easily be guessed from social media.
Make sure both partners understand the finances Both partners should know: which banks are used; where pensions are paid; how bills are managed; which currency-transfer company is used; who the advisers are; which payments are expected; where genuine contact details are kept; what to do if a suspicious request arrives. This does not mean writing down exposed passwords. It means making sure important arrangements are not understood by only one person.

Common Mistakes to Avoid

Acting because a caller creates panic - Urgency is one of the main tools scammers use to stop people checking.
Moving money to a safe account - A bank should not ask you to protect money by transferring it to another account.
Sharing a one-time security code - A code may be the final piece a criminal needs to approve a payment or account change.
Trusting the telephone number in a suspicious message - The contact details may belong to the scammer.
Accepting changed bank details by email alone - Always verify changes through a separate, trusted method.
Installing remote-access software - This may give a criminal access to your device and financial information.
Trusting a professional-looking investment website - Websites, dashboards and reviews can all be fabricated.
Paying more money to release investment profits - Requests for tax, insurance or verification fees may be part of the original scam.
Sending a rental deposit before verifying the property - Photographs and property details can be copied from genuine advertisements.
Feeling too embarrassed to report the fraud - Anyone can be deceived. Acting quickly is more important than feeling ashamed.
Believing a recovery company that contacts you unexpectedly - Victims can be targeted again by people promising to recover the original loss.
Allowing only one partner to understand the finances - The other partner may be left vulnerable during illness, incapacity or bereavement.

Your Action Checklist

Pause before responding to unexpected requests.
Do not click links in suspicious messages.
End unexpected bank-security calls.
Never move money to a safe account.
Never share banking security codes.
Verify changed bank details independently.
Use a known telephone number to contact professionals.
Read email addresses carefully.
Send a small test payment before a large transfer.
Agree a payment-verification process with professionals.
Research investment companies independently.
Be cautious of guaranteed returns.
Confirm family-emergency messages by telephone.
Create a private family verification phrase.
Do not install unexpected remote-access software.
Use unique passwords.
Enable two-step verification.
Keep recovery details up to date.
Review devices connected to email accounts.
Keep UK and Spanish telephone information current.
Never receive or move money for strangers.
Keep genuine bank and adviser contact details safely recorded.
Make sure both partners understand financial arrangements.
Contact the bank immediately after a suspicious payment.
Preserve messages, screenshots and receipts.
Change affected passwords.
Report fraud to the appropriate authorities.
Use the INCIBE 017 helpline when cybersecurity guidance is needed.
Call 112 for an immediate threat or crime in progress.
Beware of anyone offering to recover stolen money for an upfront fee.

In Summary

Scammers are becoming more organised and convincing.

They may imitate banks, Spanish authorities, estate agents, solicitors, utility providers, family members or investment advisers.

They often try to create panic by saying:

your account is at risk;

a payment must be made immediately;

your electricity will be disconnected;

you have missed a tax deadline;

a family member needs urgent help;

bank details have changed;

an investment opportunity will disappear;

your money must be moved to a safe account.

Before responding:

stop;

do not click links;

do not share codes;

end the call;

contact the organisation independently;

speak to someone you trust;

verify bank details through a known telephone number.

A genuine organisation should allow you time to check what you have been told.

Sue’s final thoughts & experiences

A personal note from Sue Berry

Scammers know how to create urgency, copy trusted organisations and approach us at the exact moment we are expecting a payment, document or telephone call.

Living abroad adds another layer because we regularly deal with unfamiliar systems and communicate across two countries.

The safest habit is simple:

Stop, check and speak to someone before sending money.

You are not being rude or difficult by ending a call and verifying it independently.

You are protecting yourself, your partner and the life you have worked hard to build.