Spanish police have arrested 40 people for their alleged involvement in a phishing scam that targeted more than 300,000 people, resulting in confirmed losses of at least €700,000 ($770,000). The operation was run by the Trinitarios criminal organisation, which used stolen credit card details to purchase cryptocurrency, which was then exchanged for fiat money. Victims received phishing SMS messages alleging that they needed to resolve a security issue with their bank accounts.
The SMS messages included a link to a phishing website that was designed to look like a legitimate bank portal. The hackers used phishing panels to monitor the entered data in real-time and used it to request loans, link new verification phone numbers to compromised accounts, and link cards to virtual crypto wallets under their control.
The police investigation revealed that Trinitarios used the stolen funds to cover its legal and operational expenses, as well as to fund other activities such as purchasing drugs and arms, financing meetings, paying lawyers, or sending money directly to imprisoned members of the gang.
The remaining amounts were sent to the Dominican Republic, where other group members used the money to purchase real estate. The Spanish police are currently working with international partners to locate all stolen amounts and assets derived from crime and potentially recover stolen payments.
Organised crime gangs have increasingly turned to cybercrime as a new revenue stream. In September 2021, Europol dismantled an extensive network of cybercriminals linked to the Italian mafia, making them yearly profits of over €10 million ($11.7 million) through SIM swapping and business email compromise attacks. The use of technology in criminal activities highlights the importance of cybersecurity and the need for individuals to remain vigilant and avoid falling victim to scams.
Law enforcement agencies must also continue to adapt to new criminal techniques and work together to tackle cybercrime.
