Criminal Network Targeting Victims Through WhatsApp Scam in Tenerife

The National Police have recently uncovered a sophisticated network of victims in Tenerife, linked to a group of five individuals arrested in Valladolid. These individuals are believed to be integral members of a criminal organization involved in a range of illicit activities, including scams, money laundering, and bank fraud. The primary method employed by this group is a technique known as WhatsApp account takeover, which has proven to be alarmingly effective in deceiving unsuspecting victims.

Investigation Unfolds

The investigation, led by the Cybercrime Group of the Provincial Judicial Police in Valladolid, was initiated after authorities received a staggering 48 complaints filed between January 21 and January 25, 2025. Among these reports, 38 victims reported losing access to their WhatsApp accounts, while ten individuals experienced financial losses totaling €4,723. This alarming trend prompted law enforcement to delve deeper into the operations of the criminal network.

Initially, the investigation was concentrated in Valladolid, where the majority of the complaints originated. However, as the inquiry progressed, it became evident that the criminal activities had extended to Tenerife, revealing additional victims who had fallen prey to the same group. This expansion highlighted the widespread nature of the scam and the need for a coordinated response from law enforcement agencies across regions.

Structure of the Criminal Organization

Through meticulous analysis of financial transactions and collaboration with banking institutions, authorities were able to uncover the hierarchical structure of the scam network. At the base of this structure were the so-called “bank mules,” individuals tasked with transferring illicit funds on behalf of the organization. These mules were often unaware of the full extent of their involvement in criminal activities.

Above the bank mules were the “mule recruiters,” primarily located in the Community of Madrid. These recruiters played a crucial role in the operation, actively seeking out individuals to serve as mules, often exploiting their financial desperation. A significant aspect of this operation was the speed at which funds were transferred, often occurring within mere seconds. This rapid movement of money was designed to evade detection by authorities, with the funds subsequently converted into cash through ATMs, retail outlets, and other third-party services.

Operational Tactics of the Scammers

The Cybercrime Research Group of Valladolid, in collaboration with the IX Group of the Provincial Judicial Police of Madrid, successfully apprehended five members of the organization, while three others remain at large. The police have outlined a three-phase approach employed by the scammers, which reveals the calculated nature of their tactics. In the initial phase, the perpetrator would impersonate someone familiar to the victim, sending a deceptive link that appeared legitimate.

Once the victim unwittingly provided a verification code, the scammer would gain complete control over the victim’s WhatsApp account. This access allowed the scammer to exploit the victim’s identity further. In the subsequent phase, the scammer would reach out to the victim’s friends and family, urgently soliciting financial assistance under the guise of an emergency. Those who responded without taking the time to verify the sender’s identity fell victim to the scam, while those who were cautious and confirmed the messages successfully avoided being defrauded.

This method of operation underscores the importance of vigilance in the digital age, as scammers continue to develop increasingly sophisticated techniques to exploit unsuspecting individuals. The emotional manipulation involved in impersonating a trusted contact adds a layer of complexity to the scam, making it even more challenging for victims to discern the truth.

Key points

• The National Police identified victims in Tenerife linked to a criminal gang arrested in Valladolid.
• The investigation began after 48 complaints were filed between January 21 and 25, 2025.
• Ten victims reported financial losses totaling €4,723.
• The scam involved a WhatsApp account takeover technique.
• Five members of the criminal organization have been arrested, with three still at large.
• The network utilized bank mules and recruiters to facilitate money laundering.
• Funds were rapidly transferred to evade detection before being converted to cash.