Ukrainian women fleeing war exploited in multimillion-dollar gambling fraud scheme

A criminal network in Spain exploited dozens of Ukrainian women displaced by Russia’s war to carry out a multimillion-dollar fraud gambling scheme, Europol said Thursday.

Police arrested 12 suspects after a two-year investigation and said thegroup generated roughly $5.5 million in illegal profits.

According to authorities, the network targeted Ukrainian women fleeing the war, recruiting them from regions heavily affected by the conflict and bringing them to Spain under the promise of assistance. Once there, the women were taken to banks and instructed to obtain credit cards by opening accounts. The financial accounts were then taken over by the criminal group and used to move illicit money through online betting platforms.

Investigators say the women had little control over what happened next. In many cases, members of the network accompanied them through the process of opening the accounts and then sent them back to Ukraine shortly afterward, leaving the criminals with full access to the banking infrastructure created in their names.

Authorities say the group also transferred government subsidies the women received after obtaining refugee status in Spain. Police identified 55 Ukrainian women who were brought to Spain and used in the operation.

Spanish police said the suspects operated mainly out of Alicante and Valencia, where they allegedly managed the fraud scheme.

The network used the bank accounts to create large numbers of profiles on online gambling platforms. Investigators say the group relied on automated software programs, known as bots, that placed thousands of bets simultaneously at low odds to generate steady profits while masking the origin of the funds. Some of the proceeds were later invested in luxury real estate across Europe.

To scale the operation, the criminals relied heavily on stolen personal data. Police discovered more than 5,000 stolen identities from 17 different nationalities and at least 3,000 compromised credit cards tied to the scheme.

Police raids in Alicante and Valencia resulted in the seizure of tens of thousands of euros in cash and cryptocurrency, four luxury vehicles, and dozens of electronic devices. Ukrainian authorities carried out eight searches targeting suspects linked to the network alongside the Spanish operations.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

Phobos ransomware leader facing 20 years in prison after pleading guilty to hacking charges

Next Post

New Jersey county says malware attack took down phone lines, IT systems

Related Posts

Critical n8n Vulnerability (CVSS 10.0) Allows Unauthenticated Attackers to Take Full Control

Cybersecurity researchers have disclosed details of yet another maximum-severity security flaw in n8n, a popular workflow automation platform, that allows an unauthenticated remote attacker to gain complete control over susceptible instances. The vulnerability, tracked as CVE-2026-21858 (CVSS score: 10.0), has been codenamed Ni8mare by Cyera Research Labs. Security researcher Dor Attias has been
Read More

JPCERT Confirms Active Command Injection Attacks on Array AG Gateways

A command injection vulnerability in Array Networks AG Series secure access gateways has been exploited in the wild since August 2025, according to an alert issued by JPCERT/CC this week. The vulnerability, which does not have a CVE identifier, was addressed by the company on May 11, 2025. It's rooted in Array's DesktopDirect, a remote desktop access solution that allows users to securely access
Read More