The Spanish Civil Guard has recovered more than six million euros that had been frozen following a complex fraud involving advertising and digital marketing services contracted by a Spanish company. The case, handled entirely electronically, has highlighted the growing risks associated with managing online campaigns and using privileged administrative access.
The affected company, a nationwide firm headquartered in Valencia with branches throughout Spain , discovered that its funds had been frozen due to alleged non-payments related to digital campaigns and services. Behind this scenario lay a scam that resulted in unauthorized charges of nearly eight million euros and forced the company to abruptly halt its online advertising activity , with the consequent impact on visibility and business.
A scam that begins with gaining access to an executive's email.
The fraud came to light when the company filed a complaint through the Guardia Civil's online portal, alerting them to significant sums of money blocked by a major international technology platform that managed its online campaigns. What initially appeared to be a simple billing issue stemming from non-payments ultimately revealed a planned attack on its digital infrastructure.
The Cyber ​​Command's investigation confirmed that the perpetrators had illegally accessed the email account of the executive in charge of digital marketing . Once inside, without raising immediate suspicion, they impersonated him and obtained administrator privileges on advertising accounts and other associated services, allowing them to operate as if they were the company's head.
With this privileged control, the cybercriminals began contracting advertising campaigns and digital services completely unrelated to the company's actual business . These actions, managed from the compromised account, generated unauthorized invoices and charges in the company's name , which quickly resulted in a very large sum of money lost.
Faced with a large number of unusual charges and no clear explanation of their origin, the technology platform decided to freeze the funds linked to these allegedly unpaid services . This freeze affected both fraudulent billing and legitimate campaigns, causing a complete shutdown of the company's online advertising at a time when a significant portion of its operations depended on its online presence.
Cyber ​​Command intervention and international collaboration
After receiving the online complaint, the Guardia Civil's Cyber ​​Command took over the investigation and began working in coordination with the international technology company that provided the advertising and digital marketing services. The primary objective was to determine whether the detected activity was due to internal decisions or unauthorized access to the company's accounts.
Cybercrime specialists were able to prove the fraudulent use of administrative privileges , demonstrating that the contracted campaigns and services had not been approved by the affected company, but rather managed by third parties who controlled the executive's account. This finding proved crucial in getting the technology provider to acknowledge the illicit nature of the transactions and review the freeze placed on the funds.
As a result of these joint efforts, a large portion of the withheld funds was released , an amount exceeding six million euros . Although some of the improper charges reached nearly eight million euros, the swift action of the investigators managed to limit the direct economic impact and halt the continuation of the fraud.
Beyond the financial losses, the company was forced to halt its online advertising initiatives while the situation was clarified, impacting its sales, its ability to acquire new customers, and its digital presence. According to sources close to the case, the operational priority was to regain control of the accounts , stop any irregular hiring, and restore legitimate advertising activity as quickly as possible.
The investigators have confirmed that a security breach was detected in the company's infrastructure , which has since been corrected. This breach was exploited to compromise the executive's email and login credentials. However, the Civil Guard has emphasized that there was no unauthorized access to personal data , a particularly sensitive aspect in incidents of this type.
Investigation still ongoing and focus on corporate security
The investigation remains open to fully identify the perpetrators of the fraud and determine whether they acted alone or as part of a network specializing in this type of attack on companies. It is possible that infrastructure and techniques common in organized cybercrime were used, where the primary objective is to exploit privileged access to divert investments and generate quick profits.
The modus operandi fits with a pattern that is increasingly common in crimes linked to online advertising : compromising accounts with high levels of permissions, launching campaigns or contracting services that are unrelated to the client's usual activity, and then leaving behind a large bill that is difficult to detect in real time if there are no alerts and robust internal controls.
The Civil Guard emphasizes that corporate email accounts and advertising platforms have become prime targets for cybercriminals. Controlling these accounts allows them to manipulate budgets, change billing information, introduce new services, and even divert payments to accounts under their control, all without directly compromising bank details.
In this specific case, the company's prompt response—which involved reporting the incident as soon as it detected unusual activity and account blocks —has been crucial in limiting the damage and facilitating the tracing of suspicious transactions. Investigators emphasize that delaying reporting often complicates the recovery of funds and the identification of those responsible.
According to sources within the armed forces, the experience gained in this operation will serve to strengthen protocols for combating fraud in digital marketing and improve collaboration guidelines with large technology platforms, which are increasingly involved in preventing and detecting irregular uses of their tools.
Online reporting on the rise: more than 5.500 scams on the internet
This case is significant not only because of the amount recovered, but also because it was handled entirely through online reporting via the Guardia Civil's Electronic Headquarters . This channel, operational since July 4th , has become a reliable and efficient way for businesses and citizens to report cybercrime incidents without having to physically visit a station.
Since its inception, the Cyber ​​Command has processed nearly 15.000 reports related to crimes committed in the digital environment. Of these, more than 10.000 correspond to criminal acts already handled , and within that group, more than 5.500 online scams stand out , including frauds like the one suffered by the Valencian company.
The Civil Guard emphasizes that this tool facilitates a faster response to cyber incidents by allowing the direct submission of documents, screenshots, activity logs, and other essential evidence for investigations. Furthermore, the use of the Electronic Headquarters helps to standardize information and streamline coordination between specialized units.
In parallel, the agency maintains other channels for assistance and consultation, such as dedicated phone lines for the Cyber ​​Command, to guide potential victims and answer questions about how to respond to unauthorized access or unusual charges . The general recommendation is to not normalize any suspicious activity and to seek advice as soon as possible.
The sustained increase in reports demonstrates that cybercrime has become a major focus for law enforcement . Cases like that of this advertising company highlight that criminals are targeting not only private citizens, but also companies with a significant presence in the Spanish digital economy.
Key measures to reduce risks in digital advertising campaigns
The incident has also served to reinforce the Civil Guard's message about the need to take extra security measures in digital services , especially for accounts linked to marketing budgets, payment methods, and campaign management. Combining several layers of protection is now considered essential to minimize risk.
Among the most insistent recommendations is to activate two-factor authentication on both corporate email accounts and advertising platforms. This measure adds an extra layer of protection against potential password theft, as it requires a second verification step before granting access.
It is also advisable to limit administrator permissions as much as possible and periodically review which users have them. Maintaining an up-to-date log of delegated access, deleting accounts that are no longer needed, and applying the principle of least privilege helps reduce the impact of a potential breach.
Another key guideline is to set up alerts to detect new campaigns , billing changes, or new service activations. Many platforms allow for automatic email alerts or notifications when certain spending thresholds are exceeded or when a significant change occurs in account parameters.
Finally, experts recommend frequently checking the devices and locations from which you log in , and acting immediately upon any attempt to access your account from unusual locations or devices. Closing all open sessions, changing your credentials, and proactively notifying the platform can stop an ongoing attack in time.
Cases like this demonstrate how an attack targeting a single executive's email can trigger a multi-million dollar problem when combined with excessive permissions and a lack of internal controls. The swift action of the Cyber ​​Command, collaboration with the technology company, and the use of online reporting have allowed for the recovery of a significant portion of the money and the closure of the breach. However, the rise in this type of fraud makes it clear that security in digital advertising and online marketing has become crucial for the business continuity of many companies.
