The Mossos d’Esquadra arrested a 22-year-old man on Thursday accused of committing 14 computer scams and appropriating 23,150 euros through a banking fraud that culminated in cash withdrawals from ATMs. The arrest occurred when investigators located him while he was trying to make another withdrawal and intercepted him after he tried to flee.
The case concentrated in just eight days a chain of charges and withdrawals that, in addition to the money already stolen, included attempted transactions for another 6,280 euros. The alleged perpetrator had no prior criminal record and, according to the investigation, exploited the victims’ banking data after deceiving them with messages that simulated coming from their bank’s risk department.
The investigation attributes the use of the Relay Attacks method to the detainee, a system with which he contacted victims via SMS, posing as a banking entity. In these messages, he instructed them to uninstall their official application and install a malicious one.
From there, the malware captured credit card data. With this information, the suspect linked the cards to his mobile phone to withdraw money from ATMs.
Between May 20 and 28, he made 14 withdrawals for a total of 23,150 euros. Investigators also attribute to him attempted new transactions worth 6,280 euros in the same period.
The investigation unit handled the case with the collaboration of a financial institution, which allowed them to follow the trail of the operation until identifying the suspect. The agents located him when he was trying to repeat the same pattern at an ATM.
They then arrested him, although he tried to escape beforehand. The case was subsequently handed over to the duty investigating court in Figueres.
The day after the arrest, the young man was brought before the court in Figueres as a suspect in the 14 computer scams attributed to him by the Mossos d’Esquadra.
The investigation remains open to locate other possible victims of this same type of fraud, which combined bank impersonation via SMS with the installation of malicious software on the victims’ phones.

source