Maksym starts crying when, during a police search, his phone is unlocked through a brute force attack, a method that finds the password by trying all possible combinations. A cybercrime specialist police officer collected all the information from the device live, before he could erase it. Maksym, 40 years old and nicknamed The Master, is the leader of a criminal group investigated for laundering money on a large scale by making fraudulent bets in online gambling houses. His group impersonated the identities of 240 people in Spain who didn’t even know they were playing in their name. When they went to file their Income Tax returns, they saw that the Tax Agency was claiming amounts of up to 7,000 euros for online bets they had not made. The police arrested him last June, along with 11 other people. Maksym and five members of his group, all Ukrainian nationals except for one Russian, have been in pretrial detention since then.
Read more Trump says the United States will “take Cuba almost immediately”
“When people see that the Tax Agency is claiming amounts of money ranging from 3,000 to 7,000 euros, they get very nervous,” says Inspector Mónica, specialized in crimes related to sports and betting, who prefers to be identified only by her first name, and one of the investigators in the operation in which Maksym was arrested. The Ministry of Consumer Affairs launched a protocol in April 2024 for those in that situation to report it. The information from these cases is key for investigators because they can find patterns and identify the networks that impersonated them. As happened in the case of The Master. Until last August, more than 10,000 identity theft complaints had been recorded throughout Spain. In April, May, and June, the Income Tax filing period, new complaints are expected.
The investigation into The Master’s group, named Operation Sunflowers, is still ongoing, pending consultations with different countries such as Slovenia, Mexico, or Brazil. So far, they are attributed with laundering 4.7 million euros and the fraudulent use of around 5,000 identities of people from 17 different nationalities. They worked for several organizations, and one of the countries from which they received money was Ukraine, according to sources from the investigation.
Maksym had been in Spain since 2018. He lived in Valencia with his family and led a comfortable life. His children attended private school, he had “a nice car,” but tried not to draw attention. Over time, The Master gathered friends aged between 35 and 45 who eventually settled in Alicante and Valencia. With training in computer science and a passion for football, investigators believe the group could have been involved in this illegal activity for “15 to 20 years.”
They placed small bets in different betting houses, both in Spain and other countries, but did so at full speed. “They could place 500 bets at once,” says the inspector from the National Police Center for Integrity in Sports and Betting (Cenpida). To achieve that multiplier effect, they used 22 bots, programs designed to perform automatic and repetitive tasks, which in this case were hosted on devices similar to small modems. “The leader creates the structure for himself and for another organization,” police sources explain. “If they needed identities, they asked the boss, and they also talked to him about cash deliveries.”
The stolen identities were used to open bank accounts to start playing online, and the winnings were received in another account, in another country, and even in cryptocurrencies. “It wasn’t about winning, but about moving it from one place to another,” clarifies Inspector Mónica. The crime was already in the scam they committed against the betting house — they placed thousands of simultaneous bets at low stakes to minimize risks and ensure constant profits — but the money could also come from other criminal acts, such as drug trafficking. The leader charged a 3.5% commission on the money he moved, according to the investigations.
Maksym and his group tried to relate in almost family-like circles. They had the help of at least two older women. One of them watched the bots when they were traveling and was called to give instructions to restart them when something went wrong, such as the lights that turned on not being the right color. Another was assigned to cut SIM cards to disable them. They handled up to 4,000 physical bank cards and 400 bank accounts. “They burned the cards very quickly, reported them lost, and then requested a new duplicate with a different number to continue committing crimes,” they recount.
The suspects did not need large spaces to have those bots. In the homes, numerous mobiles were found, each with the identity of the person it was linked to, in case someone called to make a check. They seized 88 mobiles and 20 computers.
Stolen identities: the raw material
The group members experimented with ways to obtain the identities with which to open bank accounts, the essential raw material for their criminal activity. In 2022, they turned to relatives or acquaintances. The following year, they started buying packages of stolen identity data on social networks, such as Telegram. According to the investigations, they had services that provided them with forged physical ID cards and even videos or selfies of people with a document that included the data of the impersonated identity. That image was used to open the bank account they then used to place bets. They even took care of the plastic thickness so that artificial intelligence detectors would not trigger alarms. They also had help from Russia to bypass problems with betting houses. They could be shown how to bypass a QR code or pass an authentication.
This system was disrupted after Spain implemented the protocol to detect identity theft. Then they took it a step further. They started bringing women from Ukraine to apply for protection and then open bank accounts for them. “They didn’t know their names would be used to play in online gambling houses,” explains Inspector Ana, from the Central Unit of Immigration Networks and Document Falsifications (UCRIF Central), the other unit that handled the operation.
The UCRIF agents in Málaga were struck by the control a woman exercised over a group of Ukrainian women requesting protection at one of the Spanish Government’s aid points for Ukrainian refugees (CREADE). They suspected a situation of sexual exploitation, so they followed them and saw that, as soon as the permit was processed, they were taken to the bank. The organization paid all expenses: they picked them up, took them to the hotel, and once the necessary procedures were done, returned them home. The circuit lasted barely three days. Investigators have recorded up to 55 cases of women coming from the most affected areas of the war conflict. The Ukrainian police were present in the operation, and eight searches were conducted in the country.
Since the betting and immigration agents were investigating the same targets, they formed a joint team, which has allowed addressing Maksym and his group’s criminal activity from different police specialties.
The arrest was expedited when they began talking about leaving Spain and settling in the United Arab Emirates. They complained about having to pay too many taxes and the delay of Social Security in attending to one of the older women. They had already bought some houses in Spain to launder money, put in the names of third parties, and also in Thailand. “Working in an integrated way and with the support of Europol and Interpol means that this type of organization also has a red spotlight in other countries,” highlights Inspector Ana, who also prefers to be identified only by her first name. “That allows taking them out of the circle,” she adds.
