Paula Sánchez (Pontevedra, 47 years old) was sitting in front of her monitor as she did every day. She had spent half her life managing accounts, budgets, and balances. She knew how to read numbers and anticipate threats. That November morning in 2025, when she came across a remote job vacancy ad on LinkedIn, she saw no risk. For her, the offer represented extra income, an opportunity compatible with her family life and her job as an administrative manager. “Hello,” wrote Sofía Koivu to her via WhatsApp, a fake Dutch recruiter from ReSee, a luxury vintage boutique based in Paris. One message led to another and, within hours, she signed a pre-contract to take the position of Marketing ranking associate with a base salary of 600 euros. “You just have to help improve the positioning of the products,” the woman explained. It was just another chat among many, but unknowingly, she was taking the first step toward something that had nothing to do with a job.
“I had to convert 100 euros into cryptocurrency to start the day,” she tells EL PAÍS over the phone. While this was happening, Koivu — or whoever it was — began to build an artificial friendship. Besides talking about SEO, product visibility, and commissions, she also included anecdotes about her dog and partner. Every click from Sánchez was a small mechanical gesture that brought her closer to her fees. Until the limited edition items appeared, something like special products promising 30% commissions but requiring the full value upfront. She hesitated, but they had always returned the money. When she realized it, she had transferred a total of 40,408 euros. “I didn’t think I would fall for something like this, I verified everything,” she laments.
They call themselves part-time work platforms. They impersonate real company names, offer contracts and salaries up to 3,500 euros. What follows is a spiral of promises and deposits that lead nowhere. It’s not a single scheme, but several organized networks dedicated to deception. When a fraudulent offer uses real data, whether logos, tax IDs, or names, the trap is no longer in what is seen but in what is not verified. This range of methods does not change the nature of the crime; in the Penal Code, a scam remains a scam regardless of the modality. “It can take the form of la estampita, phishing, or identity theft,” adds lawyer Borja Adsuara, an expert in digital law.
It is very difficult to talk about just one offense because in the field of cybercrime — which amounts to 468,801 cybercrimes registered in Spain — it is common for several to overlap simultaneously, according to Adsuara. Added to this is a structural problem: most cases are not even reported. A study by the Spanish Journal of Criminological Research found that the reporting rate is only 20%. The rest remains an opaque figure whose scope is unknown.
The National Cybersecurity Institute (Incibe) receives thousands of inquiries related to online scams every year. Although they do not have data to confirm whether this specific type of fraud is increasing, they emphasize to EL PAÍS that a good part of the inquiries about fake job offers are linked to fraudulent cryptocurrency investments. For this entity under the Ministry of Digital Transformation, the main vector lies in “various social engineering tactics” designed to lead the victim from initial trust to sending money.
“At first, I transferred out of conviction, then I did it just to try to recover the money,” Sánchez explains. The patterns are always the same: they start with trivial tasks and offer small real rewards at the beginning as bait. In a legitimate job, Incibe stresses, the economic flow is always from the company to the worker. The money never goes the other way. According to Statista, the global cost of cybercrime will increase from 9.22 trillion dollars in 2024 to 13.82 trillion dollars in 2028, a trend that reflects the growing scale of these practices worldwide.
The architecture of digital deception
The search for answers led Sánchez to get lost for hours on the Internet, jumping from forum to forum in search of an explanation that never came. It was her husband who found the Association of Financial Fraud Victims (Victifin), which is dedicated to spreading awareness of this type of crime: “Call here, see what they tell you,” he suggested.
Jessica González, spokesperson for Victifin in Gipuzkoa, knows this journey well. She founded this nonprofit group after her husband was scammed investing 41,500 euros on the Investing Pro website, a scam operation that was illegal because it was not authorized by the National Securities Market Commission (CNMV) nor by the Bank of Spain. “Now I’m making a lot of content on social media because they use the same channels,” González says.
Scammers use Telegram or WhatsApp to create groups where supposed workers celebrate earnings, share screenshots, and congratulate each other. In the group Sánchez fell into, names like Jason Toh, Giulia D’Amore, Flora, or William James appeared. They could be anyone… or no one. The intention is always to sow the feeling that others were already earning and that, by just keeping up with the group, she could integrate into that community that seemed to advance effortlessly.
The same script also trapped Rafael Langarita. His story matches point by point this type of scam. This 46-year-old research and development engineer admits that curiosity played a bad trick on him twice. “You never think anyone is capable of doing this,” he says, still surprised by how easily the con artists gained his trust. He was not a regular or professional investor, but he did have the habit of trying small opportunities that came to him via messaging or social networks.
“A company supposedly registered with the CNMV contacted me via WhatsApp,” he points out. Capital Interactive Brokers — which deliberately imitates the American firm Interactive Brokers, one of the global investment giants — asked for a minimum deposit of 1,000 euros that over time rose to more than 9,000 and that he never recovered. The second scam came through Telegram, via a voice call generated with artificial intelligence. They offered him a job at the scam operation SwiftPayExchange to give likes to social media posts in exchange for rewards of one euro via Bizum. He started investing 10 euros and ended up losing 400 in total.
On November 30, Paula Sánchez walked into a police station. She carried her phone full of screenshots, fake contracts, and unknown IBANs. She also carried something harder to bear, shame. “I feel like an idiot,” she admits. ReSee did not respond to information requests sent by EL PAÍS. On the review platform Trustpilot, the company posted a notice distancing itself from any related activity: “ReSee.com and our official activity are not associated with any hiring service, cryptocurrency activity, or external training or human resources platforms.”
Interactive Brokers has dedicated an entire section of its website to warning about these practices. An alert that almost always arrives when everything else has already happened. “Now it’s very clear to me and I don’t understand how I wasn’t able to see it at the time,” Langarita expresses. However, there are basic checks to verify the legitimacy of an offer, such as looking for the company’s website, cross-checking information, and contacting their customer service. Small verifications that can prevent a suspicion from ending in fraud. “We seek justice and for everything to come to light. We want these scams to be known, understood, and prevented,” González adds.
The responsibility of social networks
Adsuara reminds that many of these fraudulent platforms are sustained thanks to the participation of the users themselves. His argument is that those who join manipulated review systems, fake ratings, or schemes promising immediate benefits are contributing, even if they don’t realize it, to an ecosystem that harms others. “They are participating in something illegal and that can lead other users to make decisions based on false data,” he warns.
This mechanism moves, almost always, through the same channels. They are encrypted messaging groups where scams circulate unchecked. On platforms like Instagram, however, there is another layer of responsibility, as established by the Digital Services Act (DSA), which has not yet been implemented in Spain. Although these tech companies are not responsible for the content users post (that responsibility lies with those who upload it), they must respond when something illegal is disseminated. “They are obliged to act and if they don’t, they can be sanctioned,” he points out. The European Commission is responsible for enforcing these obligations under the DSA.
“It is becoming more sophisticated and these are professional services of a mafia in many cases outside Spain. The police can’t reach there and it is harder to pursue,” adds the lawyer. Sánchez’s last move was another gesture, this time backward. She filed a claim with the bank to reverse all the transfers. “I have little hope of recovering the money,” she admits.
Your Help in Cybersecurity is a national, free, and confidential service that the Government of Spain makes available to minors and their environment, the general public, and companies, through phone 017, WhatsApp (900116117), Telegram (@INCIBE017), and web form.
