The Iranian connection to a multi-million dollar sports betting fraud, which targeted La Liga and Qatar World Cup games

This past May, the Spanish National Police dismantled a sports betting scheme. The investigation — conducted by the National Police Center for Integrity in Sports and Betting (CENPIDA) — now finds that the trail behind this scam leads to Iran.

From messages exchanged on the Telegram app, investigators determined that the criminal network used this platform to obtain the codes that allowed it to illegally intercept satellite television signals before the images of soccer matches were broadcast (during what are known as “broadcast delays”). This allowed for fraudulent bets to be made, which allegedly defrauded gambling houses of millions of dollars.

The Spanish police detected the use of this sophisticated and innovative system in matches from the last World Cup — held in Qatar at the end of 2022 — and from La Liga’s matches last season. The system was also used in matches played by the German Bundesliga and in various soccer competitions in Asia and South America. Interpol and the European Union Agency for Law Enforcement Cooperation (Europol) have issued notifications to warn of this form of fraud, which was undetected until recently.

Interpol has issued a “purple notification” to the authorities in 196 countries. This communication explains the modus operandi of particular criminal organizations, so that the police can take “preventive measures.” In this case, Interpol “strongly” recommends that “any information about investigations” in which this system appears — which, the police organization emphasizes, is being used by “criminal organizations with high technological sophistication” — be shared, according to an internal document. In the same sense, Europol has asked the police in EU member states to share “any relevant cases” that they discover which involve this fraud. Europol emphasizes that, before it was dismantled, the network managed to obtain “millions of euros of illicit profits.”

In Spain, the investigation remains open. Around 20 people have already been arrested. This includes one man identified by the police as the alleged ringleader, Bogdan Vorovenci — a Romanian citizen with no criminal record, who resides in the small town of Cabanillas del Campo — and Juan Gayá Salom, one of the main sports betting tipsters in Europe, who has thousands of followers on social media. The main people involved are accused of various offences: belonging to a criminal organization, corruption between individuals in the sports field, defrauding gambling operators, document falsification, currency counterfeiting and money laundering.

Operation Mursal began in 2020, after CENPIDA detected suspicious online bets in international table tennis competitions… a socially-distance sport that continued to be played during the pandemic. The investigation — led by Judge María Tardón, of the National Court — first focused on Yavor Ivanov Andreev, a Bulgarian citizen and former table tennis player who lived in Spain. Through him, investigators reached Vorovenci. The two men allegedly exchanged information to bet on rigged sports competitions around the world. The investigation revealed that, in addition to the bribing of players (there are six soccer players from Romanian League III teams charged for these events), the plot used two innovative systems to take advantage of broadcast delays to make fraudulent bets

The delay between the images of the matches reaching gaming operators’ screens is between 20 and 120 seconds, according to the Europol document. By taking advantage of this lag, the criminal network was able to make dozens of winning bets. In the more sophisticated of the two systems, the network used satellite dishes — more than seven feet in diameter — which were installed in the home of the alleged ringleader. They managed to intercept the images captured by the cameras from the stadiums before they reached the television production studios to be broadcast.

To do so, the scammers used codes (known as feeds) with which they circumvented the coding of the television signal and, thus, managed to receive it in advance on their own computers. Afterwards, both the ringleader and other members of the scheme engaged in live-betting — in which the odds that are paid out change value very quickly — on which team was going to score the next goal, take a corner, or receive a card.

These codes were supposedly obtained from an Iranian Telegram channel called Hack Sat Feed (a short form of Hacker Satellite Feed), where users share them illegally. In its notification, Interpol highlights that, through this system, the network managed to “get ahead of the signal received by the gaming operators” and “bet on circumstances or events of which it already knew the outcome, eliminating chance and consummating the scam.” Investigations by the Spanish National Police have found evidence that these scammers applied the same signal interception to soccer matches in Asian and South American leagues, as well as in ATP tennis matches.

The second method used was to send one of its members to the stadium where a match was being played —– a novel figure that the Spanish police have baptized as “the announcer” — to report by phone, in real-time, about what was happening on the field. The investigation indicates that the network used this system in several matches at the last World Cup. Among them, Cameroon-Switzerland and Portugal-Ghana on November 24; Cameroon-Brazil on December 2; and Poland-France and England-Senegal the next day. To do this, the plot placed a person in Qatar. The identity of this “announcer” is still unknown.

Five “announcers” in Spain

This system was also used in a qualifying match for the World Cup, when Australia and Peru played on June 13, 2022. Australia ultimately won on penalty kicks. The Spanish National Police have also found signs of this scam having been applied to five La Liga games last season. Specifically, the matches were Betis-Almería and Villarreal-Osasuna, played on October 16 and 17, 2022; Seville-Valencia, on the 18th of the same month; Celta-Getafe, on October 24; and Sevilla-Real Sociedad, on November 9. The network also used “announcers” to bet on two Copa del Rey (“King’s Cup”) matches in Spain and one match in the Bundesliga, Germany’s professional league: the Berlin-Wolfsburg Union game, held on September 18, 2022. Agents have identified five of the “announcers” who were used in the Spanish matches.

In its report, Europol highlights that, to place bets online without triggering alerts from gambling houses and the police, “the criminal network used a large number of stolen identities.” On other occasions, they use what the European agency calls “facilitators (or “mules,” in the jargon of the Spanish police) to create betting accounts, [place bets] and collect the profits on behalf of [the criminal network].” The investigation has not yet revealed the amount of money that the criminals managed to pocket, although the first police estimates point to millions of dollars that were hidden in bank accounts around the world and in cryptocurrency wallets.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition