Can the money from a Bizum sent to a fraudster be recovered, and who pays it back, the bank or the fraudster? A Bizum is an instant transfer that cannot be cancelled, so the money only comes back by one of two routes. The bank returns it, as required by payment services legislation, when you did not authorise the transaction, or the fraudster returns it as civil liability arising from the offence of fraud under articles 248 and 249 of the Spanish Criminal Code. If you sent or accepted the Bizum yourself because you were deceived, the bank will refuse at first, and what has to be done today is to notify it, preserve the evidence and file a report.
The two routes are compatible and neither blocks the other. A criminal report does not prevent a claim against the bank, and a claim against the bank does not replace the report, which is also the document the bank will ask for before it looks at anything.
I have been scammed through Bizum, what to do before the day ends
Four steps depend on you alone, and each loses value with every hour that passes.
Notify the bank through an official channel, the app or the telephone number printed on your card, never a number received by message. State that the transaction is fraudulent, ask for the incident to be logged and write down the reference number, the time and the name of the person who deals with you. Bizum does not deal with users directly and refers every incident to each user’s own bank, so notifying the bank is also notifying Bizum. If the fraudster obtained passwords, codes or access to your mobile, ask in the same call for Bizum, your cards and online banking to be blocked, and change your passwords from a different device.
Save the evidence before touching anything. Take screenshots of the whole conversation, the advert or profile, the telephone number and the transaction receipt, which shows the date, the time, the amount and the abbreviated name of the recipient. Do not delete the chat or block the fraudster until everything has been captured, because in some apps deletion from the other side makes messages disappear. Export the conversation if the app allows it and keep the telephone as it is.
Cut off contact. Do not keep negotiating, do not accept a refund in exchange for a further payment, and distrust anyone who calls afterwards offering to recover the money for a fee, which is a second scam built on the first. If you suddenly lost mobile coverage before the charges, call your operator from another telephone, because your SIM card may have been duplicated.
File a report, today or tomorrow, with those screenshots. Until then, do not sign any document for the bank that describes the facts in words that are not your own, and do not accept over the telephone that you handed over your credentials if that is not what happened. What you say in that first call is recorded and the bank will use it in its reply.
A Bizum that has been sent cannot be cancelled, but the money can sometimes be frozen
Bizum runs on instant transfers. The order is irrevocable once the bank receives it and the funds reach the recipient’s account within seconds, so there is no cancel button and no cooling-off period. The only practical exception arises when the recipient is not registered with Bizum, in which case the payment remains pending and can be cancelled from the app. In a scam that almost never happens, because the fraudster has the service active.
The fact that the order is irrevocable does not mean the money is lost. Your bank can approach the recipient’s bank to request a return, but that bank cannot remove funds from its customer’s account without the customer’s consent or a court order. The authority that can order the destination account to be frozen is the investigating judge, as an interim measure to secure repayment. The measure works while the money is still there, and fraudsters withdraw it or move it on within hours. That is why notifying the bank and filing the report cannot wait.
Who gave the payment order, the question that decides whether the bank is liable
Payment services legislation distinguishes two situations that the customer tends to experience as one, and on that distinction depends whom you can claim against.
In an unauthorised transaction, someone else ordered the Bizum. A third party entered your online banking with credentials obtained through a fake link, duplicated your SIM card to receive the confirmation codes, took control of your mobile with a remote access app or used a stolen telephone. You did not consent to the payment and often find out when you see the balance. This is what searches such as “unauthorised transfer” or “money stolen from my bank account” describe. For these cases there is a legal obligation on the bank to refund, since it is the bank that provides the service and must protect it with authentication systems. The rule is the same at BBVA, Santander, CaixaBank, Abanca or any other institution operating in Spain, because it does not depend on each bank’s terms. Banks do not refund automatically and usually reply that the customer handed over the credentials, a dispute that is resolved on the facts of each case. I deal with it in the article on bank refunds after phishing.
In a transaction authorised under deception, you sent the Bizum. You paid for a product that did not exist, accepted a money request believing it was an incoming payment, or sent money to someone posing as a relative. For the bank the order is valid because it came from your device, with your credentials and by your own will, even though that will was vitiated by the deception. The bank will say that it correctly executed what you instructed and that the person responsible is whoever deceived you. In most fraudulent sales that position is correct and the route is the criminal one against the fraudster.
Between the two extremes there is a zone in which the bank’s reply does not close the matter. It covers the person who orders the payment following instructions from someone impersonating their own bank, by a call or a message that appears in the same thread as the bank’s genuine alerts. It also covers transactions which, by amount, time or recipient, bear no resemblance to the normal use of the account. There the question is whether consent was real and whether the bank’s controls worked, and the classification of the transaction as authorised is no longer obvious.
At that point the firm examines the transaction receipt, the way the deception took place and the bank’s reply, and where there are grounds we bring the bank fraud claim while the criminal case runs in parallel.
Reverse Bizum, fake sale, impersonated relative or duplicated SIM, which group your case belongs to
The “reverse Bizum” exploits the fact that the app allows money to be requested as well as sent. The fraudster poses as the buyer of something you are selling and, instead of paying, sends you a money request for the agreed amount. The notification looks like that of an incoming payment, you accept it and the money leaves your account. The Banco de España has warned of this practice in its notices to bank customers. It is a transaction authorised under deception, because you pressed accept.
The sale of a non-existent product occurs on second-hand platforms and social media. The seller asks for payment by Bizum before dispatch, sometimes as a deposit, and disappears. This is also an authorised transaction. It matters to keep the advert and the profile, because they allow your report to be linked to those of other buyers deceived with the same text. The general steps are covered in the article on what to do after a Bizum scam.
In the impersonation of a relative, a message from a new number claims to be a son or daughter who has lost their mobile and needs an urgent payment. In the fake public body or fake prize, a refund, a grant or a gift is announced, and a prior Bizum is requested for expenses or a money request is sent disguised as a credit. A refund never requires you to accept a request or to pay first. Both are authorised transactions.
Impersonation of the bank lies in the intermediate zone described above. A call from the supposed security department alerts you to a suspicious charge and asks you to confirm codes or move the money to a “safe account”. Depending on what happens in that call, the payment will have been ordered by you under deception or by the fraudster with the codes you read out, and that difference is relevant. I cover it in the article on bank impersonation scams.
SIM duplication and the theft of credentials through a fake link are unauthorised transactions. The fraudster acts from their own device, registers Bizum on it or enters your online banking, and you take no part in the order. These cases add an offence of unlawful access to computer systems and are the ones that fit best within the bank’s obligation to refund.
Prevention comes down to three rules. To receive money by Bizum you never have to accept anything or enter credentials, because the money arrives by itself. A code received by SMS is not read out to anyone, including a person who claims to be calling from the bank. A Bizum payment to a stranger has the same protection as handing over cash.
Fraud under articles 248 to 250 of the Criminal Code, and what changes above 400 euros
Article 248 of the Criminal Code defines fraud as the use, for gain, of deception sufficient to cause another person to make a mistake and induce them to dispose of assets to their own or another’s detriment. This is the offence applied to the fake sale, the reverse Bizum and the impersonations, in which the victim pays by mistake. Article 249 punishes as fraud non-consensual transfers obtained through computer manipulation and the fraudulent use of cards or any other non-cash payment instrument, which is where SIM duplication and access to online banking with stolen credentials belong.
The amount determines the seriousness of the offence, the procedure and the limitation period.
| Case | Article of the Criminal Code | Penalty | Limitation period |
|---|---|---|---|
| Fraud of up to 400 euros | 248 | Fine of one to three months | One year |
| Fraud of more than 400 euros | 248 | Imprisonment of six months to three years | Five years |
| Non-consensual transfer by computer means or fraudulent use of payment instruments | 249 | Imprisonment of six months to three years | Five years |
| Aggravated fraud, among other cases where it exceeds 50,000 euros or affects a large number of people | 250.1 | Imprisonment of one to six years and fine of six to twelve months | Ten years |
| Money laundering through gross negligence by the person who lends their account | 301.3 | Imprisonment of six months to two years and fine of one to three times the amount | Five years |
Up to 400 euros the act is a minor offence, dealt with in a simple trial, with no prior judicial investigation and punished with a fine. Above that figure it is a less serious offence, preliminary proceedings are opened, there is a judicial investigation and the penalty is imprisonment.
Anyone searching for “Bizum scam 100 euros” tends to conclude that nothing will be done for that amount, and the Criminal Code says otherwise. Article 74 allows the frauds committed by the same person against several victims using the same method to be treated as a single continuing offence, and in property offences the penalty is set by reference to the total loss. Twenty reports of 100 euros against the same telephone number add up to 2,000 euros and cease to be a minor offence. Your report, however small, is what makes that sum possible.
A criminal conviction includes civil liability. Articles 109 and following of the Criminal Code oblige the convicted person to return what was defrauded and to compensate the losses, so the judgment that convicts them is also the title on which to collect.
Where a Bizum scam is reported, at a police station, online or at court
The report can be filed at any Policía Nacional station, Guardia Civil post, regional police force or duty court. No lawyer or court representative is needed and it costs nothing. Policía Nacional and Guardia Civil also accept online reports for certain acts, including fraud committed over the internet, and depending on the channel and the method of identification it may be necessary to attend afterwards to sign. If your screenshots are in order, filing in person allows you to hand them over on the spot so that they are included in the police file.
You can report in your own town even if you do not know where the fraudster is. In fraud cases the Supreme Court applies the ubiquity criterion, under which the offence is deemed committed in any of the places where one of its elements occurred, and the court that first deals with the matter has jurisdiction. The place where you made the payment and suffered the loss is one of them. The case may later be transferred to the judicial district where the perpetrator is located or where other reports are being joined.
What happens next depends on whether there is an identifiable perpetrator. Article 284 of the Criminal Procedure Act allows the police not to forward the file to the court when there is no known perpetrator, subject to exceptions, and to keep it at the disposal of judges and prosecutors. If it reaches the court and the investigation identifies no one, the case is provisionally dismissed under article 641 of the same Act. That dismissal is provisional. The case is reopened if new information appears within the limitation period, and in the meantime the report remains useful against the bank and for your case to be joined with others against the same perpetrator. A report that properly identifies the transaction, the telephone number and the destination account goes further than a generic account.
You only have the fraudster’s telephone number, how a person is traced
A Bizum leaves more of a trail than it seems. The recipient’s telephone number is linked to a bank account, and that account has a holder whom the bank identified when opening it, because anti-money laundering legislation requires it to. You cannot obtain that information and your bank will not give it to you, because it is protected. The court can require the bank to disclose the holder’s identity, the account movements and the onward destination of the money, and can require the operator to disclose who holds the line.
The outcome of those enquiries varies. Sometimes the holder is the fraudster. At other times it is an intermediary who has lent their account, or a person in whose name an account was opened with stolen documents. The profile on the sales platform, the email address and the connections from which the advert was posted are further lines of enquiry that the court can request from the companies holding that data. They are lost over time, because the data is not kept indefinitely.
If the Bizum was collected by an intermediary or by someone with nothing to pay with
A person who receives the proceeds of a scam in their account and forwards them in exchange for a commission is what is known as a money mule. They have usually been recruited through a fake job offer or by an acquaintance asking for a favour. For the victim, the mule is often the only person identified, and the mule is liable. They may be convicted as a participant in the fraud if they knew the origin of the money, or of money laundering under article 301 of the Criminal Code, paragraph 3 of which also punishes gross negligence with imprisonment of six months to two years and a fine of one to three times the amount. The courts assess whether an ordinary person would have been suspicious of a task consisting of receiving money from strangers and passing it on.
Article 116 of the Criminal Code makes those criminally responsible for the offence civilly liable. Where there are several, they are jointly and severally liable among themselves within their class, principals with principals and accomplices with accomplices, and secondarily liable for the shares of the others. In practice, the victim can pursue the convicted person who has assets, even if that person kept only a small commission.
Collecting is another matter. If the convicted person is insolvent, the judgment recognises the debt but does not pay it, and it will be necessary to wait until they have income or assets that can be seized. Enforcement of civil liability can remain open for years, and a convicted person who wants their prison sentence suspended or their criminal record cancelled has an interest in paying. This is one of the reasons why it is advisable to be a party to the proceedings.
If you are the one who has received a Bizum from a stranger who then asks you to return it to a different number, do not forward it. Tell your bank so that the return is made through the bank to the account of origin. If you have already moved someone else’s money, consult a lawyer before giving a statement, because your position in the case may be that of a suspect.
When the bank replies that it will not refund anything
The bank’s refusal is the reply of an interested party. The bank is deciding its own case and its customer service department is not a court. Further routes exist after that refusal, one before the supervisor and another before the civil courts. The Banco de España examines whether the bank acted in accordance with the rules and good practice, but its report does not oblige the bank to pay. The authority that can order the bank to return the money with interest is a civil judge, in proceedings which, up to 15,000 euros, follow the oral trial procedure known as juicio verbal.
Neither the criminal report nor the dismissal of the criminal case prevents that claim. They are separate liabilities. The fraudster’s arises from the offence, and the bank’s, where it exists, from its obligations as payment service provider. In cases of unauthorised transactions the usual course is to pursue both at once.
Which route is appropriate, in what order and with what evidence is a decision taken with the documents in hand, and it shapes the outcome, because what is asserted in the first written submission is fixed for everything that follows. That part is the lawyer’s work.
Time limits for reporting and claiming, and why they should not be run down
The time limit for reporting is the limitation period of the offence, governed by article 131 of the Criminal Code. Fraud of up to 400 euros is time-barred after one year, fraud of more than 400 euros after five years, and aggravated fraud under article 250 after ten. The period runs from the day the act was committed and is interrupted when the proceedings are directed against a specific person, so a report against an unknown perpetrator does not stop it by itself.
Those are the maximum periods, which do not coincide with the useful ones. Connection data, recordings and the money itself disappear much earlier, and a report filed after six months arrives at an empty account.
As regards the bank, notice must be given as soon as you become aware of the transaction, without delay. The legislation also sets a time limit for claiming unauthorised transactions, the calculation of which should be reviewed by a lawyer in each case. It should not be run down, because delay in giving notice is one of the arguments banks use to refuse a refund.
The civil action against the person who received the money where there is no criminal conviction, based on article 1902 of the Civil Code, is time-barred one year after the injured party became aware of the loss. That period does not run while criminal proceedings on the same facts are open.
One hundred euros or three thousand, what it costs, how long it takes and when a lawyer is worth it
Filing a report is free and does not require a lawyer. Nor is one mandatory in the minor offence trial that corresponds to a fraud of up to 400 euros, where the public prosecutor conducts the prosecution and claims repayment on your behalf unless you have waived it. Above 400 euros, the injured party can simply give a statement and leave the prosecution to the public prosecutor, or join the proceedings as private prosecutor with a lawyer and a court representative, which allows them to see the case file, propose enquiries, apply for accounts to be frozen and appeal a dismissal.
The proceedings move far more slowly than the scam. A minor offence with an identified perpetrator can be tried within a few months. An investigation with requests to banks and operators, accounts at several institutions and several injured parties lasts considerably longer, and article 324 of the Criminal Procedure Act provides for an investigation period of twelve months which the judge may extend. The civil claim against the bank has its own timetable.
For a fake sale of 80 or 150 euros paid voluntarily, hiring a lawyer is not worth it. The fees would exceed the amount defrauded, and the reasonable course is to file a good report, provide the screenshots and let the police and the prosecutor act. The calculation changes when the transaction was unauthorised, even if the amount is moderate, because there is a solvent party against whom to claim. It also changes when the amount is significant and the destination account is identifiable, because joining the proceedings and freezing the account in time decide whether anything is collected. And anyone who appears as the holder of an account that has received money from other victims needs a defence from the first summons, whatever the figure.
Frequently asked questions
I have been scammed through Bizum, what can I do?
You can claim the money by two compatible routes, the criminal one against the fraudster and the claim against the bank. The first is always available and obliges the convicted person to return what was defrauded. The second depends on who ordered the payment, and has a legal basis when you did not authorise the transaction. A Bizum already sent cannot be cancelled.
What should I do if I have been scammed through Bizum?
Notify your bank today through an official channel and ask for the incident to be logged. Save screenshots of the conversation, the profile, the number and the receipt without deleting anything, cut off contact with the fraudster and file a report at a police station, Guardia Civil post or duty court. If passwords or codes were stolen, block Bizum, cards and online banking.
How long do I have to claim against the bank and to file a report?
To file a report you have one year if the amount defrauded does not exceed 400 euros and five years if it does, which are the limitation periods under article 131 of the Criminal Code. You must notify the bank as soon as you become aware of the transaction, without delay. The legal time limit for claiming against it is calculated by the lawyer in each case, and waiting always works against you.
If I was the one who accepted or sent the Bizum under deception, do I lose the right to a refund from the bank?
You do not lose it automatically, but the bank will treat the payment as authorised and will refuse at first. In a fake sale that reply is usually correct and the person liable is the fraudster. If whoever deceived you was impersonating your own bank or the transaction was anomalous, the bank’s liability can be argued and should be assessed by a lawyer.
Notifying the bank and filing the report are for you to do, and both should be done today, before the money leaves the destination account. The next step is to assess whether the transaction was authorised or not, bring the claim against the bank and join the criminal proceedings to apply for the account to be frozen. That is for a lawyer, who should be involved before the bank replies in writing. At Perseus & RC Abogados, with offices in A Coruña, we act for those harmed by bank fraud and cybercrime. You can write to us through the contact page or call +34 677 841 007.