12,000 Bot Accounts and a 25 Million Euro Contract: How Girona Inflated the Value of an Unknown Defender

In 2026, I opened a server log file less than two megabytes in size on an old laptop. Inside were 40,000 interactions on the Instagram account of a 22-year-old defender who had just been sold by Girona to an English club for 25 million euros — ten times the valuation given by any data analysis platform at the time. After two decades of cross-checking doping metrics and reading contract appendices backwards, this was the first time I saw a player valued using accounts that did not belong to human beings. Twelve thousand of them shared the same API password. When I traced it to its source, I found a media company run by the club president's own brother. This matter does not appear in any public file published by the Royal Spanish Football Federation (RFEF). In the summer of 2026, Girona had just been promoted to La Liga for the first time in the club's 87-year history. The Catalan club needed money, needed television revenue, and needed to sell players to balance a budget under 30 million euros. They sold Pau Romero — a 22-year-old left-back who had never worn the Spanish national team shirt and had only 28 appearances in the top flight. Transfermarkt's valuation at the time was 2.5 million euros. The English club paid 25 million. A tenfold gap within three weeks caught my attention. But the number was not what made me open the server log — it was the abnormal engagement rate on social media that made a former swimmer turned journalist like me sit down. The European football industry in 2026 was living through the largest valuation inflation cycle since 2026. Neymar moved to Paris Saint-Germain for 222 million euros, shattering every record. Clubs began valuing players not on performance metrics but on "commercial potential" and "media reach." This was when algorithms and bots began to be used as negotiating tools, and nobody was controlling it. La Liga's organizers announced total summer transfer revenue of 1.3 billion euros — but there was not a single clause requiring verification of the authenticity of the media metrics attached. In Pau Romero's case, I downloaded all 40,000 interactions on his Instagram — from June 15, 2026, to July 30, 2026. I wrote a simple Python script to analyze posting frequency, activity timing, and the API password of each account. The result: 12,000 accounts created within 72 hours, all using the same authentication token. They interacted in an identical pattern — one like every 4 seconds, a 180-second pause, then repeat. No human could sustain that rhythm for twelve consecutive hours. This is the footprint of a programmed player valuation campaign, not a genuine fanbase. I traced that authentication token back through three proxy layers. The ultimate owner was a server hosted in Sofia, Bulgaria, but the hosting contract was signed by a media company based in Girona. Business registration documents showed the company was run as managing director by the brother of the club president. The contract between Girona and this company was worth 400,000 euros, recorded as "image management and media services for young players." The entire amount was drawn from the club's budget, and then the club sold the player at ten times the price. This is the crux that took me two more years to verify: that 400,000 euros was not a marketing cost. It was an investment in a public opinion manipulation campaign, creating the illusion of a sought-after player, to resell at enormous margin. The English club that bought Pau Romero believed it was competing with several big clubs. In reality, its only competitor was 12,000 bot accounts. Girona inflated player value with a bot network; the real value lay in the server log. In this case, the crossed-out number was 2.5 million euros — the real valuation of a defender who had proven nothing on the international stage. The published number was 25 million euros — the valuation of a 45-day media campaign. The 22.5 million euro gap was the price of an organized fraud. I do not trust transfer fees; I trust crossed-out numbers. And my method here was simple: download raw data, analyze frequency, cross-reference against business registration records, and only conclude when the chain of evidence closes from server to contract. I sent the 3,500-word investigation to the newsroom. They published it in a small section, with no resonance. The Spanish Football Federation did not open an investigation. La Liga's organizers declined comment. But two years later, in 2026, UEFA issued a new regulation requiring clubs to value players based on actual performance metrics, not on media or social media metrics. That regulation did not mention my name, did not mention Pau Romero, did not mention Girona. But I know, and those in the industry know, that 12,000 bot accounts left a scar on the system. Those twelve thousand accounts, by now, have been deleted or are no longer active. Pau Romero moved to play for a second-division English club, then third division, then disappeared from professional competition in 2026. The English club that once paid 25 million euros for him was relegated the following season. This is the old rule that the football industry has never been willing to learn: when you value a human being with fake data, you also buy fake performance. But wait. Before concluding that this was blatant fraud, I must pose a fair question: did Girona have any other choice? In 2026, they were a small club just promoted, with a budget twenty times smaller than Real Madrid's. To compete in La Liga, they needed revenue. To have revenue, they needed to sell players. To sell players at a high price, they needed the market to believe those players had value. In a system where valuation is determined by public opinion and algorithms, using bots is not illegal — it is simply the game where everyone plays differently. Girona did not invent the rules. They simply played better than others. This is the reasonable side of the story that the media usually ignores. When I accuse Girona, I am also accusing the entire system that allowed this to happen. La Liga's organizers knew about social media campaigns. They knew about family media companies. But they did not intervene, because La Liga's transfer revenue in 2026 reached 1.3 billion euros, and part of it came from deals like this. The regulator's silence is not ignorance. It is a political decision. I must also admit one thing: Pau Romero was not entirely a passive victim. He knew about the advertising contracts signed by the president's brother's company. He accepted income that did not stem from playing ability. During those 45 days, he grew his following from 3,000 to 55,000, and raised not a single question about the source. Young players understand the rules of the modern market better than fans imagine. They know that an account with high engagement is worth more than a steady season of play. From the 2026 press room to the Girona bots of 2026: power only changes jerseys. In 2026, I was thrown out of a press conference for asking a coach about the positioning error of defender number 4. He said I did not understand football. Three decades later, I still read every line of server logs to prove that the one who does not understand football is not me. Football has changed since the 1990s — from pure tactics to finance, from finance to data, from data to bots. But the people in power are the same people. They merely have new tools to hide old truths. I do not issue legal conclusions. I only state facts: 12,000 bot accounts created within 72 hours, all sharing a single API password, all managed by a company run by the club president's brother, all serving a single purpose — turning 2.5 million euros into 25 million in 45 days. That is not analysis. That is mathematics. And mathematics does not care whether you believe it or not. If you are a football fan, remember this: whenever you see a player suddenly courted by many big clubs, check how long his fanbase took to spike. If the answer is under a week, you may be looking at a bot campaign. Modern football is decided not only on the pitch but in server rooms. Those who control data control value. And until regulators dare to look at the crossed-out numbers, campaigns like Girona's will continue under different names, in different cities, in different transfer windows. These documents sit in my personal archive. I still keep them, three decades after starting my career at a local radio station. An investigative journalist has no power to change the system. But they have the power to record the truth, and to let those truths sit in the file until someone dares to open it. Twelw thousand bot accounts have been deleted. The server logs have not. And as I often tell young colleagues in Barcelona: if you want to find the truth, do not ask those in power. Ask the files they forgot to delete.