The operation
On 9 November 2026 the Guardia Civil and Portugal's Guarda Nacional Republicana announced Operación Malabis, a Europol-coordinated operation that dismantled a wholesale counterfeit network run from Verín and Xinzo de Limia in Galicia, with its logistics base moved to northern Portugal. Six people were arrested and are in pre-trial detention. More than 109,000 counterfeit items were seized, with a market value above €10 million.
The network was estimated to turn over about €20 million a year selling imitation clothing, footwear and accessories wholesale. The investigation ran 18 months.
The numbers
- 109,000+ counterfeit items seized
- €10 million+ estimated market value of the seized goods
- ~€20 million estimated annual illicit revenue
- 6 arrested, all in pre-trial detention
- 186 officers deployed — 147 Guardia Civil and 39 GNR — coordinated by Europol
- 12 searches: 4 in Verín, 2 in Xinzo de Limia, 1 in A Gudiña, 5 in Portugal
- ~80,000 items seized in Spain and 22,083 in Portugal, over 50 tonnes of material
- ~30 leading brands affected, with items simulating retail prices of up to €790 for garments and €350 for sneakers, per La Región's gallery of the seized goods
- 80% of payment collected cash on delivery; the rest by cheque, transfer or Bizum
The goods were manufactured predominantly in Asia and sold through independent shops and street-market stalls across Spain, using their own vehicles alongside express couriers.
The QR code is the story
At a press conference in Ourense on 10 November, the Guardia Civil stressed that the quality of the counterfeits was the distinguishing feature. Textiles, finishes, logos and branding had been copied precisely enough that forensic analysts needed detailed textile analysis to confirm fraud. Some of the garments carried not only accurate labelling but QR codes pointing to the brands' own websites.
These were not codes lifted from one product but cloned codes that emulated the originals closely enough to redirect perfectly to the official sites of around thirty affected brands — the very pages a consumer would visit to check a sneaker.
A cloned QR code that lands on your own official product page turns your authentication system into the counterfeiter's best tool: the scan succeeds, the page loads, and the fake is confirmed as real by the brand's own infrastructure.
If the verification destination is public and predictable, scan-the-QR-and-see-if-it-works stops being a test of authenticity. A consumer scanning a cloned code gets a working page from the brand's genuine domain. The check passes — but it confirms the code resolves, not that it was issued to this unit.
That is the line between a shared code and a serialised one. A code unique per unit, validated server-side against a record of what the brand actually shipped, cannot be satisfied by a copy that reaches the right website, because the payload will not match the unit in hand.
The number that does not add up
The 109,000 items carry a €10 million market value — roughly €90 each on the face of it. But the Portuguese side reported its haul separately: 22,083 garments worth an estimated €259,688.50, about €12 each, according to the GNR's own account of the operation.
So €90 is not what these fakes are worth — it is what the high-value end is worth. The bulk of the volume is cheap apparel sold by the piece.
Source and caveats
The operation ran under a European Investigation Order issued by Spanish judicial authorities, with Europol support. The €10 million and €20 million figures are police estimates of illicit market value and turnover, not measured losses to rights holders. It remains open. The brands were not named; the figure given is around thirty leading brands.
Key takeaways
- More than 109,000 counterfeit items worth over €10 million were seized in Spain and Portugal, from a network turning over an estimated €20 million a year.
- 186 officers and 12 simultaneous searches across the border, coordinated by Europol through a European Investigation Order.
- Some fakes carried cloned QR codes that redirected perfectly to the brands' official websites, so the consumer's own verification step became a pass for the counterfeit.
- The headline averages about €90 per item, but the Portuguese haul of 22,083 garments was valued at roughly €12 each — the money sits in a minority of high-value goods.
- The mix was about 80% apparel, 20% sneakers and 1% perfumes and sunglasses, sold through small shops and street markets.
What this means for a brand owner
- Do not let the QR resolving stand as your authentication proof. If the destination is a public page on your domain, a cloned code will reach it. Verification has to ask your server whether this code was issued to this unit.
- Make the code unique per unit. A serialised identifier turns a copied label into a mismatch rather than a working link.
- Watch for the signal the clones create. One serial scanned from many places, or more scans than units shipped, is what a copied code produces. A shared code produces no signal at all.
- Look at where your fakes are sold, not only where they are made. This network reached Spain through bazaars, market stalls and independent retailers, so a takedown aimed only at online listings would miss most of the revenue.