The break is not the scam email. It is the banking layer that turns a fraud into something hard to unwind: once the money lands, it is split across a web of accounts and shell companies across borders, and recovery becomes a tracing problem instead of a simple freeze. That is why a €3 million freeze helps, but it also shows how much had already moved on.
Spanish police say the ring moved about €140 million through fake investment schemes, CEO fraud, invoice fraud, and man-in-the-middle attacks, using more than 800 bank accounts to disperse funds. Four suspects were arrested in Portugal, Spain, and Panama, and investigators also identified 19 companies whose activity looked like laundering rather than real business.
For banks, payment firms, and AML teams, the signal is the mule-account pattern itself: scam losses often persist because the cash-out network is built to outpace single-account blocking and to spread the trail across jurisdictions.