Colombian, Mexican, Costa Rican, Ecuadorian, Guatemalan, Honduran, and Peruvian citizens have been contacted through video calls offering attractive and fast services to process visas amid the restrictions imposed by the Trump administration.
On the other side of the screen appear supposed consular officials, who offer visa procedures for which they charged between 500 and 2,000 dollars, about 6 million Colombian pesos. But authorities managed to establish that the ‘foreigners’ are actually members of a criminal network that uses a sophisticated artificial intelligence program to alter voices and faces.
The email and the Turk
The purpose is that when a potential client checks, they find those same faces on official pages and proceed with money transfers.
A week ago, in an operation by the Dijín of the Police, in collaboration with the Prosecutor’s Office, the Colombian Aerospace Force, and the United States Homeland Security Investigations (HSI) agency, 5 of the cybercriminals from the network were captured and 3 raids were carried out on properties in Ibagué (Tolima) that were used as operation centers. And although at that time neither names nor pending arrests were known, EL TIEMPO investigated and established that there is a fugitive leader and a Turkish citizen involved.
“Using the DeepFace method, they altered their faces and accents during video calls (…). To attract their victims, the criminal network had designed and managed more than 100 fake profiles on different social networks,” said Colonel Elver Vicente Alfonso Sanabria, Director of Criminal Investigation and Interpol, about the modus operandi of the network.
And EL TIEMPO obtained parts of the file indicating they are looking for the Turk, the one in charge of selling and operating the software.
Even, in one of the hearings, before the 5th Municipal Criminal Court with Guarantee Control Function of Ibagué, where the detainees began to be processed, prosecutor Diana Alexandra Cortés spoke of an email mentioning the Turk.
At that hearing appeared Johanna Paola Murillo Vásquez, Diana Milena Murillo Vásquez, and María Jimena Cruz Tovar, detained during the raids.
The email is from a citizen who claimed to live in Ibagué and was aware that the network members used an apartment in the east of the city – which matched an intelligence inquiry by the Air Force – and two houses in the Varsovia neighborhood to carry out the scams.
“In the La Quinta shopping center, there is a place where a Turk attends who sells VPN equipment and programs to work on this. They also manage a group on Whatsapp and Facebook where they have posted job offers abroad, but it’s all pure nonsense,” said prosecutor Diana Cortés, who read the email during the hearing.
The fugitive
EL TIEMPO investigated and established that besides the Turk, whom authorities are trying to locate, the husband of one of the detainees fled through the roof when the authorities arrived.
“Upon reaching the third level, it was observed through the roof of adjacent properties that there was a broken tile and an individual was seen moving quickly across the roofs, which is why a chase in flagrante delicto was initiated”, explained the prosecutor.
Although residents of the area said the subject fled towards a nearby wooded area, authorities were unable to capture him.
EL TIEMPO investigated and established that Johanna Paola Murillo, one of the detainees who attended the procedure at that house, told authorities that the one who fled is her husband, Diego Valencia Bonfante.
Investigators found 17 phones, three computers, a tablet, and documents with names, ID numbers, account numbers, Bank of America checks, and cash.
Even permanent residence cards, naturalization certificates, and U.S. social security documents.
Members of the network were charged with crimes of personal data violation, aggravated personal falsification by use of artificial intelligence, illicit use of communication networks, falsification of private documents, trafficking of counterfeit currency, and trafficking, manufacturing, or possession of narcotics; and administrative measures were imposed on the other two detainees.
(Consult all articles from EL TIEMPO’s Investigative Unit here)
Now, authorities are trying to locate both the Turk accused of selling the programs in a shopping center in Ibagué and Valencia Infante, the fugitive.
And there is information that another call center is still operating and that offers to travelers continue.
INVESTIGATIVE UNIT
u.investigativa@eltiempo.com
@UinvestigativaET
Follow us now on Facebook
Read more World Cup 2026: schedules and confirmed artists for the unprecedented halftime show of the final
Read more The final pulse of the 2026 World Cup: Spain and Argentina want to shout champion! Time and TV
