Spain's National Police Arrest 43 Over Bank Antifraud SMS Scam That Took More Than $1.26 Million

Spain's National Police on 12 November 2026 announced the arrest of 43 people accused of defrauding bank customers by impersonating the antifraud or security departments of their banks.

The force said the scheme caused losses of more than €1.14 million (about $1.26 million) and that it had clarified 134 offences against more than 130 victims, who were generally over the age of 65.

The arrests followed a year-long investigation by the Economic and Fiscal Crime Unit (UDEF).

In the final phase, which ended in October and completed a three-stage operation, officers carried out three searches, two in Madrid and one in Cádiz.

Those detained have been charged with belonging to a criminal group, fraud and money laundering.

A further 13 people were questioned as suspects but not arrested, and 95 people have been formally accused in all, across Spain.

At a briefing at the Canillas police complex in Madrid, the heads of UDEF's financial-fraud section and group said the 43 arrests were made in about 20 provinces.

Most of those arrested are Spanish nationals of Dominican origin and no more than 30 years old, according to reporting from that briefing.

The investigation remains open, and further arrests have not been ruled out.

Dollar figures use the European Central Bank reference rate of €1 = $1.1081 on 12 November 2026.

How the SMS scam worked

Police said the suspects posed as bank antifraud or security staff and used urgent, unsolicited messages and calls to pressure customers.

Victims were generally older, and investigators said customer information was used to identify targets.

Some victims were pressured to move money or disclose account access.

Police said the scam caused more than €1.14 million in losses.

The force advises customers to end unexpected calls or messages about account fraud and contact their bank through a trusted channel.

NFC relay attacks and money mules

Police said the investigation also uncovered an NFC-related payment method.

This article omits the operational steps.

Customers should not install unverified apps, perform card actions on a phone, or share account information at the request of an unsolicited caller.

Investigators said suspected proceeds were moved through money-mule accounts and, in some cases, converted into cryptocurrency.

Organised on Telegram

Police said the suspects coordinated through private Telegram channels and fictitious identities.

Investigators analyzed 400 channels and groups on the app, collected 300 user identities and fully identified 100 people.

The inquiry remains open.

How to protect yourself

Police advice matches the warning in the force's public post: a bank will never ask for passwords or codes by SMS or by telephone, and will not tell customers to transfer money to “protect” their funds.

• If you receive an urgent SMS or call about a supposed fraud on your account, hang up. Do not call a number given in the message.
• Contact the bank only through a number or app you already know, or go to a branch.
• Do not install an app, delete your official banking app, tap your card on a phone, share your screen, or hand over passwords because someone claiming to be from the bank asked you to.

The same pattern, spoofed bank SMS messages and calls from a supposed fraud department, is widely used against customers in India.

The same rule applies: never move money or share credentials at the prompting of an unsolicited message or call.