The Civil Guard stops in Madrid the biggest cyber-swindler in the history of Spain

With only 23 years old, he had more than 25 judicial requests in force, being one of the most wanted criminals by all the police in our country

It has been found during the investigation that this person's income sometimes amounted to € 300,000 per month, using a criminal group that he had at his command and to which he paid a salary for his work.

During the time that this operation has lasted, more than 30 fraudulent online stores managed by the detainee have been traced

Along with the Ciberestafador, the "Informatico" and the person responsible for collecting the "mules" have been arrested, and the admission to provisional prison without bail has been decreed for the three

Due to the large number of people affected by these scams, the Department of Telematic Crimes of UCO, has activated a web page to channel all possible complaints (

The Civil Guard, in the denominated LUPIN operation and under the direction of the Court of First Instance and Instruction No. 4 of Requena, has arrested J.A.F, 23 years of age and Spanish nationality, considered the largest cyber-fraudster in the history of Spain, on which they relayed more than 25 judicial requests detention throughout the national territory, which made it a priority for all police in our country.

The operation was initiated after detecting the Department of Telematic Crimes of the Central Operative Unit (UCO) of the Civil Guard, a series of possible scams that they affected a multitude of people in different parts of Spain, all of them with several patterns in common.

This is a series of cyber-scams committed mainly by the sale of consumer electronics products in fraudulent online stores, through websites copied from fully legal stores and well-known prestige in the online market, even using their logos and brand names, all with complete ignorance of the scammed user and with the clear intention of misleading him.

A common feature of these fraudulent web pages, was their minimum duration in time, becoming activated only during a weekend and then disappearing without leaving any kind of trace. In that short period, the page was subjected to an intense advertising campaign and web positioning in the main search engines and social networks with striking offers, all with the intention of attracting the largest number of potential buyers in the shortest time possible.

One of the particularities of this organization was, taking advantage of the facilities offered by new technologies, the continuous persecution of anonymity in the network to avoid being detected and that could be linked to the commission of the crimes investigated.

More than € 300,000 per month

During the time that this investigation has lasted, the agents of the Department of Telematic Crimes of the UCO, have detected and tracked close to 30 online stores different, all of them managed by the now detained and his collaborators.

On multiple occasions, it captured its victims in online shopping carts, directing potential buyers to their own fraudulent pages. The accessing external content in the purchase and sale portals is dangerous, as Wallapop recalls in his councils, a portal that has been actively collaborating with the Civil Guard to help in the resolution of this investigation.

The products that were offered in these web pages were mainly consumer electronics in its different areas, highlighting the video consoles and mobile phones. Any attractive product served to cheat, also taking advantage of seasonality, such as air conditioners in summer or heating oil in winter.

Some examples of the websites used are, or The pages elaborated by J.A.F. They can be found at, enabled so that all those affected can facilitate their complaints and centralize judicial actions.

The volume of sales achieved by this person has been such that researchers have been able to corroborate how the monthly income resulting from the criminal activity of the detainee sometimes exceeded € 300,000, a figure that he also used to boast himself in his closest circles .

Different forms of fraud

Although this operation was initiated approximately one year ago by the Civil Guard, it is possible that J.A.F was close to three years committing this type of scams in different modalities, being the most used the one that at the end of the user the payment procedure of the chosen product, the web forced the same to choose the bank transfer as the only possible form of payment. These bank accounts of destination, forced the fraudster to handle hundreds of them, as well as numbers of SIM cards telephony to leave no trace, usually placed both on behalf of young people who paid significant amounts of money to facilitate your personal data for this purpose.

Over time these scams have been perfected, with the excuse of the payment process, the scammer came to call the victim by phone, so that an App was installed that supposedly informed him of the follow-up of the order. What the application actually did was to divert all the SMS from their phone in order to have the codes sent by the banks, which allowed them to sign transfers and charge the credit cards for high amounts, even emptying the accounts. some of his victims.

Once the above is done, using the "contactless" technology, associated the credit cards of the accounts of the mules to their mobile terminals, to extract the money in ATMs on routes made throughout Madrid where it adopted strong security measures. This practice was repeated successively in the same day, arriving to accumulate tens of thousands of euros in only one day of collection activity.

Organized criminal group

For all this operation, J.A.F. he was nourished by a group perfectly organized by him, with different tasks and to which he paid with a salary, as if it were a company. A computer scientist, for example, was responsible for preparing the replica of the fraudulent web pages and uploading them to the Internet, which is why he was arrested this week in the province of Albacete.

On J.A.F, we must highlight the exaggerated security measures that he took in his day to day to circumvent any type of police action on his person, using different identities and never residing for more than a week at the same address, these being mainly hotels and apart-hotels in the capital, Las Rozas and Majadahonda. In turn, another member of the paid organization, was responsible for providing these rentals always on behalf of third parties, as well as give security and conduct counter-movements in their movements.

Another of the people arrested in the town of Las Rozas de Madrid this week, was in charge of the structure of capture of "mules", that is, the people who offered to open bank accounts in their name to be used by J.A.F., for their scams, and that constituted the most basic step of the organization. All these mules have been stopped in the course of the investigation by different territorial units, since they were the owners of the accounts where the transfers of the scams were made.

On these people JAF, maintained a tight control, and when someone tried to cheat him by staying with more money than stipulated, he took measures such as publishing his phone number as if he were the swindler in affected forums, sending emails to victims supplanting the own UCO of Civil Guard and the National Audience with a supposed investigation, or even arriving to pay to third parties so that they beat to him one of these collaborators.

For all the above, after a long and complex operational monitoring of several weeks, we could identify and locate the brain of the plot, and proceeded to the arrest of J.A.F in a downtown hotel in Madrid in which just established. Apart from computer equipment, more than 50 smartphones and more than 100 prepaid SIM cards identified in the name of third parties were intervened.

"… the scam of the century, € 1,000,000 on Black Friday"

Among the many indications and incriminating evidence obtained by the investigators against this criminal organization, it has been known and at the same time truncate short-term future plans of this criminal group, in which JAF was preparing, together with the rest of the detainees, the necessary infrastructure of current accounts, fraudulent telephones and webs to obtain one million euros in the next BlackFriday, an amount that had been marked as a colophon in only one Bell.

For more information, contact the Press Office of the Central Operation Unit (U.C.O.), telephone 91 503 13 27.


Source of new