The Zamora Civil Guard has unveiled a sweeping operation targeting Internet banking fraud, a crackdown that has rippled through eight additional Spanish provinces and highlighted the breadth of sophisticated financial crime activity.
Code-named Operation Coruni, the initiative led to the arrest of two individuals and the formal investigation of 56 others for alleged involvement in fraudulent schemes aimed at customers of financial institutions. The Guardia Civil extended its investigative reach across the provinces of Barcelona, Tarragona, Madrid, Granada, Valencia, Huelva, Gerona, and Albacete, with several inquiries spanning more than a dozen local municipalities. The scale of the operation underlines how cyber threats can propagate across borders within a country when criminals exploit digital channels to exploit unsuspecting banking clients.
Officials from the Zamora Command Center emphasized the significance of the development as they briefed the public on the early results of a major cybercrime campaign that has been under close scrutiny since its inception. The announcement drew attention to a broad cadre of individuals under investigation, revealing the magnitude of the case and the complex web of transactions that investigators have been untangling.
The operation, described as the largest cybercrime effort mounted by the Zamora Command to date, began in June 2022 and, although not yet fully resolved, has now approached a decisive phase. Law enforcement officials indicated that the operation has yielded a substantial surge in evidence and procedural milestones, reinforcing the priority placed on combating online fraud and protecting financial customers.
Financial recoveries to date show a total of 180,000 euros identified in the course of the investigation, with more than half of that amount already blocked by banking institutions at the request of the Civil Guard. This financial containment demonstrates the capabilities of banks to cooperate with authorities in halting fraudulent transfers and preserving funds for potential restitution to victims.
Across the operation, investigators have documented two hundred separate fraud attempts, illustrating the persistence and scale of the criminal activity. Among those detained, two suspects were identified as members of a criminal organization engaged in coordinated fraud schemes, while another 54 individuals face accusations solely related to fraudulent dealings. The arrests in Castellar del Vallès, near Barcelona, marked a critical turning point in the case and signaled a robust, continuing effort to dismantle the network underpinning these crimes.
The fraudulent scheme unfolded through a familiar and deceptive tactic: SMS messages purporting to originate from a financial institution, urging recipients to verify a session or warning of an unauthorized action. Victims were directed to a cloned website that resembled the bank’s site, where attackers gained access to user data and passwords, which were subsequently used to execute transfers. The operation also relied on social engineering, with criminals posing as legitimate bank personnel during follow-up calls to confirm details and secure a transaction key to finalize the transfers.
During the investigation, authorities highlighted the importance of verification and user awareness. In many cases, victims received a call from a number that appeared bank-like, used to reassure the target and construct a narrative that would persuade the individual to disclose confidential information. The tactics illustrate the evolving sophistication of online fraud and underscore the need for ongoing vigilance by financial customers who may be targeted by persistent criminals.
Ángel Blanco, the deputy delegate of the government, pointed to the operation as a major disruption to cybercrime. He described the developments as a significant blow to those who rely on digital scams to siphon funds from unsuspecting people and their financial institutions, and he stressed the ongoing commitment to pursuing those responsible. The case continues to unfold as investigators pursue additional leads and pursue further actions to disrupt the network and recover losses for victims.