Vishing Operation Worth $3.15 Million Dismantled in Spain and Peru

• A total of 83 individuals were arrested, and three call centers were dismantled.
• The goal of the vishing operation was to persuade individuals to give out their bank account information for the purpose of withdrawing cash.
• The investigation started in 2022, and additional arrests have still not been ruled out.

The Spanish police, supported by their colleagues in Peru, shut down a vishing (voice phishing) operation that defrauded more than 10,000 individuals. Per the Policia Nacional’s press release, 83 individuals were arrested – 35 in Spain, across Madrid, Vigo, Barcelona, Mallorca, and Salamanca, and 48 in Peru.

The police operation also included 29 raids across Spain and Peru, in which money, mobile phones, computers, and documentation related to these scams were seized. The arrested individuals are believed to have defrauded more than $3.15 million through vishing.

The investigation started in August 2022, following initial reports about a criminal group with a pyramidal structure made up of people of the utmost trust—family and close friends. The organization's leader was in Peru, and he had three individuals under his control who were in charge of supervising each of the established call centers.

Around 50 people worked in those dedicated call centers, making thousands of calls daily. Their modus operandi consisted of calling individuals based on a script with social engineering elements. The goal was to convince the victim that they had a fraudulent charge blocking their bank account. The scam ended when the organization obtained the victim’s PIN code, which allowed the scammers to withdraw cash from ATMs.

The operators received a 20% to 30% cut upon each successful scam call. Meanwhile, the rest of the money was sent to the organization in Peru through companies specializing in sending cash abroad.

More than a hundred police agents participated in this operation, which shut down three call centers across Peru. The press release adds that additional arrests or the appearance of new victims are still possible.

To avoid vishing scams, remember that private companies or public institutions would never ask for any codes to verify your personal data. Generally, never share your card information, identity documents, usernames, codes, or passwords. If you have doubts about talking to your bank’s agents, cut off the communication and call the customer service number of your bank found on its official website.