Loading story…
French and Spanish authorities, with support from Europol, dismantled an online marketplace that allegedly sold counterfeit identity and administrative documents to migrant smuggling networks across the European Union. Investigators traced the operation after French authorities identified a website advertising forged documents, leading to the arrest of a suspect in Alicante, Spain on May 27.
Police seized document-production equipment and about 800 fake European identity documents from an apartment rented under a false name. Europol said the platform supplied both physical and digital forged documents to customers across Europe, enabling criminal networks to evade border controls, fraudulently obtain residence rights, and facilitate movement within the EU, reinforcing law enforcement warnings that document fraud remains a key enabler of migrant smuggling and related organized crime.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
In March 2026, Europol expanded its anti-smuggling capacity under the new European Centre Against Migrant Smuggling.
An EU regulation adopted in December 2025 established the European Centre Against Migrant Smuggling, expanding Europol's framework for anti-smuggling operations.
Investigators said the suspect had been living in Alicante, Spain, since 2024 before being traced there during the cross-border investigation.
French authorities discovered a website advertising forged identity and administrative documents, triggering an investigation into a marketplace serving customers across Europe.
On May 27, French and Spanish authorities, supported by Europol, arrested a suspect in Alicante, Spain, and seized document-production equipment and about 800 counterfeit European identity documents from an apartment rented under a false name.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spanish National Police, working with international partners, dismantled a cybercrime organization accused of stealing and laundering about **€140 million** through fake investment platforms, **business email compromise (BEC)**, CEO fraud, invoice fraud, and man-in-the-middle attacks. Investigators said the group operated an industrial-scale laundering network tied to more than **800 bank accounts**, **120 business accounts**, **19 companies**, and **67 money mules**, with confirmed links to over **€94 million** in transactions and another **€61 million** connected to 2024 CEO fraud activity. Authorities arrested **four suspects** in Spain, Portugal, and Panama during an operation supported by **Europol** and **Interpol**. Raids in Spain and Portugal led to the seizure of computers, smartphones, and other digital devices allegedly used in the schemes, while police froze **€3 million** in criminal proceeds for potential victim restitution. Officials said the network’s main operators were taken into custody and the laundering infrastructure was effectively dismantled, though the investigation into its wider international links remains ongoing.
Jul 16, 2026
Spanish police arrested a man in Murcia accused of using deepfake face-swapping software, forged identity documents, and custom lighting setups to pass a certificate provider’s live video identity checks and obtain digital certificates in other people’s names. Investigators said the suspect made **38 impersonation attempts** involving more than **30 identities**, and succeeded multiple times before a brief glitch in the face-altering software exposed his real face during a verification call. The case began after an electronic certificate company flagged suspicious requests tied to its video verification process. Authorities said the fraudulently obtained certificates and digital signatures were allegedly intended for further cybercrime, including financial fraud. Investigators traced the operation through communications and payment records despite the suspect’s use of VPNs, ultimately linking him to **320 phone lines** across **24 mobile devices**, many reportedly registered under stolen identities. A search of the suspect’s home recovered an encrypted laptop, phones, storage devices, and documents, and he now faces charges related to the ongoing falsification of official documents.
Aug 12, 2026
Spanish and Ukrainian authorities, supported by **Europol**, dismantled a criminal network that exploited war-displaced **Ukrainian women** to facilitate an online gambling fraud and money-laundering operation. Investigators said the group recruited vulnerable women from heavily attacked regions, transported them to Spain, and escorted them through obtaining temporary protection status and opening bank accounts and credit cards—then seized control of those accounts to run the scheme. Police arrested **12 suspects** following a **two-year investigation** and identified **55 Ukrainian women** used in the operation, which generated roughly **€4.75 million (about $5.5 million)** in illicit proceeds. The network allegedly used **bot-driven automation** to place thousands of simultaneous **low-odds bets** across online gambling platforms to produce steady, seemingly legitimate returns, while leveraging **stolen identities** (over **5,000** across **17 nationalities**) to create and operate large numbers of betting accounts; authorities said proceeds were also funneled into assets including **luxury real estate** in Europe.
Jun 29, 2026