Ukrainian women fleeing war exploited in multimillion-dollar gambling fraud scheme

A criminal network in Spain exploited dozens of Ukrainian women displaced by Russia’s war to carry out a multimillion-dollar fraud gambling scheme, Europol said Thursday.

Police arrested 12 suspects after a two-year investigation and said thegroup generated roughly $5.5 million in illegal profits.

According to authorities, the network targeted Ukrainian women fleeing the war, recruiting them from regions heavily affected by the conflict and bringing them to Spain under the promise of assistance. Once there, the women were taken to banks and instructed to obtain credit cards by opening accounts. The financial accounts were then taken over by the criminal group and used to move illicit money through online betting platforms.

Investigators say the women had little control over what happened next. In many cases, members of the network accompanied them through the process of opening the accounts and then sent them back to Ukraine shortly afterward, leaving the criminals with full access to the banking infrastructure created in their names.

Authorities say the group also transferred government subsidies the women received after obtaining refugee status in Spain. Police identified 55 Ukrainian women who were brought to Spain and used in the operation.

Spanish police said the suspects operated mainly out of Alicante and Valencia, where they allegedly managed the fraud scheme.

The network used the bank accounts to create large numbers of profiles on online gambling platforms. Investigators say the group relied on automated software programs, known as bots, that placed thousands of bets simultaneously at low odds to generate steady profits while masking the origin of the funds. Some of the proceeds were later invested in luxury real estate across Europe.

To scale the operation, the criminals relied heavily on stolen personal data. Police discovered more than 5,000 stolen identities from 17 different nationalities and at least 3,000 compromised credit cards tied to the scheme.

Police raids in Alicante and Valencia resulted in the seizure of tens of thousands of euros in cash and cryptocurrency, four luxury vehicles, and dozens of electronic devices. Ukrainian authorities carried out eight searches targeting suspects linked to the network alongside the Spanish operations.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

Phobos ransomware leader facing 20 years in prison after pleading guilty to hacking charges

Next Post

New Jersey county says malware attack took down phone lines, IT systems

Related Posts

Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware

The threat actor known as Silver Fox has turned its focus to India, using income tax-themed lures in phishing campaigns to distribute a modular remote access trojan called ValleyRAT (aka Winos 4.0). "This sophisticated attack leverages a complex kill chain involving DLL hijacking and the modular Valley RAT to ensure persistence," CloudSEK researchers Prajwal Awasthi and Koushik Pal said in an
Read More

Fake WhatsApp API Package on npm Steals Messages, Contacts, and Login Tokens

Cybersecurity researchers have disclosed details of a new malicious package on the npm repository that works as a fully functional WhatsApp API, but also contains the ability to intercept every message and link the attacker's device to a victim's WhatsApp account. The package, named "lotusbail," has been downloaded over 56,000 times since it was first uploaded to the registry by a user named "
Read More

New Advanced Phishing Kits Use AI and MFA Bypass Tactics to Steal Credentials at Scale

Cybersecurity researchers have documented four new phishing kits named BlackForce, GhostFrame, InboxPrime AI, and Spiderman that are capable of facilitating credential theft at scale. BlackForce, first detected in August 2025, is designed to steal credentials and perform Man-in-the-Browser (MitB) attacks to capture one-time passwords (OTPs) and bypass multi-factor authentication (MFA). The kit
Read More