Europol-Backed Operation Dismantles Fake ID Marketplace Serving Migrant Smugglers
French and Spanish authorities, with support from Europol, dismantled an online marketplace that allegedly sold counterfeit identity and administrative documents to migrant smuggling networks across the European Union. Investigators traced the operation after French authorities identified a website advertising forged documents, leading to the arrest of a suspect in Alicante, Spain on May 27.
Police seized document-production equipment and about 800 fake European identity documents from an apartment rented under a false name. Europol said the platform supplied both physical and digital forged documents to customers across Europe, enabling criminal networks to evade border controls, fraudulently obtain residence rights, and facilitate movement within the EU, reinforcing law enforcement warnings that document fraud remains a key enabler of migrant smuggling and related organized crime.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
Europol expands anti-smuggling capacity
In March 2026, Europol expanded its anti-smuggling capacity under the new European Centre Against Migrant Smuggling.
EU adopts regulation creating anti-smuggling center
An EU regulation adopted in December 2025 established the European Centre Against Migrant Smuggling, expanding Europol's framework for anti-smuggling operations.
Suspect begins living in Alicante
Investigators said the suspect had been living in Alicante, Spain, since 2024 before being traced there during the cross-border investigation.
French authorities identify fake-document marketplace
French authorities discovered a website advertising forged identity and administrative documents, triggering an investigation into a marketplace serving customers across Europe.
Police arrest suspect and seize fake IDs in Alicante
On May 27, French and Spanish authorities, supported by Europol, arrested a suspect in Alicante, Spain, and seized document-production equipment and about 800 counterfeit European identity documents from an apartment rented under a false name.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
Counterfeit Document Production Facility Busted in Spain
securityonline.info
Open sourceFake document marketplace aiding migrant smuggling dismantled in Spain | brief | SC Media
scworld.com
Open sourcePolice dismantles fake ID marketplace used by migrant smugglers
bleepingcomputer.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Europol-Backed Takedown of Gambling Fraud Ring Exploiting Ukrainian Refugees
Spanish and Ukrainian authorities, supported by **Europol**, dismantled a criminal network that exploited war-displaced **Ukrainian women** to facilitate an online gambling fraud and money-laundering operation. Investigators said the group recruited vulnerable women from heavily attacked regions, transported them to Spain, and escorted them through obtaining temporary protection status and opening bank accounts and credit cards—then seized control of those accounts to run the scheme. Police arrested **12 suspects** following a **two-year investigation** and identified **55 Ukrainian women** used in the operation, which generated roughly **€4.75 million (about $5.5 million)** in illicit proceeds. The network allegedly used **bot-driven automation** to place thousands of simultaneous **low-odds bets** across online gambling platforms to produce steady, seemingly legitimate returns, while leveraging **stolen identities** (over **5,000** across **17 nationalities**) to create and operate large numbers of betting accounts; authorities said proceeds were also funneled into assets including **luxury real estate** in Europe.
Mar 21, 2026
European Law Enforcement Dismantles SIM Card-Based Cybercrime Network
European law enforcement agencies have dismantled a sophisticated cybercrime network that provided phone numbers and SIM cards to criminals, enabling a wide range of fraudulent activities across Europe. The operation, coordinated by Europol, involved authorities from Latvia, Austria, and Estonia, and resulted in the arrest of at least five to seven individuals, including the alleged organizer of the illicit service. During the raids, police seized 1,200 SIM box devices containing 40,000 active SIM cards, as well as five servers and hundreds of thousands of additional SIM cards. The network operated an online platform that allowed criminals to rent phone numbers registered in more than 80 countries, which were then used to create fake accounts on social media and messaging platforms. These accounts facilitated crimes such as phishing, investment scams, account intrusions, credential and financial data theft, extortion, migrant smuggling, and the distribution of child sexual abuse material. Investigators linked the group to over 3,000 cyber fraud cases, with financial losses exceeding 5 million euros ($5.8 million), primarily in Austria and Latvia. The infrastructure supporting the operation was described as highly advanced and professionally organized, featuring a polished website and a global logistics network for procuring SIM cards. The service appeared to operate as a legitimate business, masking its true purpose and scale. Authorities estimate that more than 49 million online accounts were created using the illicit service, allowing criminals to conceal their identities and locations. The operation, dubbed "SIMCARTEL," involved 26 searches in Latvia and was described by Latvian police as unprecedented in scale and complexity. One of the main suspects had a prior criminal history in Estonia, including arson and extortion. The takedown of this network is considered a significant blow to cybercriminals who rely on anonymous phone numbers to evade detection and law enforcement. Europol emphasized the unique and novel nature of the scheme, noting that it posed a new challenge for European authorities. The successful operation demonstrates the effectiveness of international cooperation in combating organized cybercrime. The seized infrastructure and arrests are expected to disrupt ongoing and future cyber-enabled fraud schemes across Europe and beyond. Authorities continue to investigate the full extent of the network's activities and its connections to other criminal enterprises.
Mar 21, 2026
European Police Dismantle €600 Million Cryptocurrency Investment Fraud Network
European law enforcement agencies arrested nine individuals suspected of operating a large-scale cryptocurrency investment fraud network that defrauded victims of over €600 million. The suspects allegedly created dozens of fake cryptocurrency investment platforms, luring victims with promises of high returns through social media ads, cold calls, and fabricated celebrity endorsements. Once funds were transferred, victims were unable to recover their money, while the criminals laundered the stolen assets using blockchain technology. The coordinated operation, led by Eurojust and involving authorities from France, Belgium, Cyprus, Spain, and Germany, resulted in simultaneous arrests and searches in Cyprus, Spain, and Germany, with significant seizures of cash, cryptocurrencies, and bank assets. The investigation revealed that the network used sophisticated methods to conceal the origins of the stolen funds, cycling them through various wallets and exchanges. Authorities seized €800,000 in bank accounts, €415,000 in cryptocurrencies, and €300,000 in cash during the raids. The operation underscores the growing threat of organized cybercrime leveraging fake investment platforms to target individuals across Europe, and highlights the importance of international cooperation in combating large-scale financial fraud in the cryptocurrency sector.
Mar 21, 2026