Spanish inboxes hit by €5,670 fake police email that knows your fears
The sender claims to be the Junta de Andalucía, the subject line mutters about a cyber-crime file, and the attached PDF quotes Europol’s Operation Endgame and the forensic tool Magnet Axiom. Open it and you supposedly discover that your network has been marching in the Pikabot botnet and that the Audiencia Nacional is about to kick down the door. The price for making it all vanish: a quick transfer of €5,670 to a Parisian bank account whose holder may not even know he is laundering.
How the scam pivots from fear to payment
Researchers at Eset have watched this confidence trick for years, but the latest wave is polished enough to land in corporate legal departments instead of grandma’s spam folder. The mail is written in the cold administrative Spanish ministries use when they fine you, complete with stale legalese and a Gmail address that still manages to feel plausible at 2 a.m. when the CFO is traveling.
The psychological curve is textbook: first the shock of an international police badge, then the relief of an “optional technical audit” and finally the tight deadline—pay within 48 h or “special intervention groups” will seize servers. Victims who bite receive a second message, this time signed by the Ministry of Justice, that funnels them to an IBAN belonging to a French retail account. The money is usually moved again within hours through a chain of mules recruited on work-from-home portals.
Why the new twist matters beyond spain
Spanish law enforcement confirmed to TechFlux that complaints have tripled since March, yet the template has already been spotted in Italian and Portuguese inboxes, translated and localised with the same bogus letterhead. The gang’s research unit is clearly scraping public corporate registries to match domain names with real tax IDs, making each email feel tailor-made.
Magnet Axiom, the forensic suite name-dropped in the PDF, is popular among European high-tech crime units, so its mere mention plants a seed of authenticity for IT staff who have seen it on police TV documentaries. Pikabot, a real piece of malware dismantled in 2023, is recycled here as the bogeyman that links the victim to an imaginary global investigation. The trick works because it stitches together fragments of truth into a nightmare narrative.
What to do before 5 670 euros leave the ledger
Spanish police stress two rules: official notifications arrive by certified post, never attachments, and no legitimate agency negotiates fines over Gmail. Check the sender’s domain with a simple whois, call the real courthouse switchboard, and forward the mail to [email protected] before someone in finance decides that 5 670 euros is cheaper than a criminal record.
The scammers are betting on the chaos of a crowded inbox and the human reflex to make liability disappear. Their edge is shrinking: every report filed gives investigators another piece of the money-mule map, and banks are starting to flag those Paris IBANs in real time. Delete the fear, keep the money—an equation that never gets old.