Sending back through Bizum money that a stranger claims to have transferred to you by mistake, without first checking inside the app that the credit actually exists, is the reaction that does the victim the most harm, because it turns the fraud into a payment ordered by you with your own PIN. Spanish payment services rules oblige the bank to refund operations the customer did not authorise, but a transfer that you keyed in and confirmed is an authorised operation even if the reason behind it was a deception, and the bank knows it. From that moment the money can only be recovered by going after the person who received it, which is a slower and less certain route. The same happens when you accept a payment request believing you are receiving a credit. The first minute decides which box the case falls into, so I will start with the three forms this scam takes.
The request that looks like a transfer
Bizum allows two operations between individuals, sending money and requesting it. When someone requests money from you, a notification appears on your phone with the requester’s name and the amount, and to complete it you have to open your bank’s app and confirm with your PIN or fingerprint. The scammer exploits the fact that the notification for a request and the notification for a credit look alike. He poses as a buyer of something you are selling, tells you he has already sent the Bizum, and at the same time fires off a request for the same amount. The victim, in a hurry to close the sale, taps accept convinced they are collecting the money and in fact pays it. Once confirmed, the operation is authorised for all purposes, because the account holder ordered it, and payment services rules do not oblige the bank to refund it.
The credit sent by mistake that you are asked to return
The second variant relies on good faith. You receive a message from a stranger saying they sent you a Bizum by accident and asking you to send it back. Two situations can arise, with opposite legal consequences. If the credit does not exist and you return the amount without looking, you have made an authorised payment to a scammer and we are back in the previous case. If the credit genuinely exists, the money may come from the account of another victim who has been emptied out, and forwarding it to the number they give you, which is not the originating one, makes you the link that moves that money. The check is always the same. Open the bank’s app, see whether the movement is there, and if it is, return it only through the refund function on that same movement, which sends it back to the account it came from. Never through a new transfer to the number they provide.
Keeping money genuinely received by mistake also has consequences. Whoever receives what is not owed to them is obliged to give it back, and knowingly appropriating it may fall under article 254 of the Spanish Criminal Code, which punishes appropriating another person’s property received by mistake with a fine of three to six months, or one to two months if the amount does not exceed 400 euros. The practical rule is that the money goes back to whoever sent it and through the same channel, and that if something does not add up you call the bank before moving anything.
Sales between private individuals
On second-hand platforms the scheme hits both sides. The seller receives screenshots of a Bizum that never left, or the disguised request I have just described. The buyer is asked to pay by Bizum outside the platform, giving up the protection the platform offers, and the item never arrives. In both cases there is a completed fraud under article 248 of the Spanish Criminal Code, because there is sufficient deception, error on the victim’s part and an act of disposal of assets to their own detriment. What changes is the evidence, which here is usually the conversation, the listing, the profile and the phone number linked to the Bizum.
Why it works
The deception requires no technical knowledge and that explains how widespread it is. It works on three levers. The first is the confusion between requesting and sending, which Bizum does resolve on screen but which escapes anyone reading in a hurry. The second is urgency, because the buyer “has to leave” or the sender of the mistaken credit “needs that money today”. The third is the good faith of someone who does not want to keep what is not theirs. None of the three has anything to do with the security of the system, which has not failed, and that is why the bank will treat these operations as authorised.
What your bank will never ask you for
Alongside these variants circulate messages impersonating Bizum or your bank, and they follow a recognisable pattern. They speak of a blocked account, an unrecognised charge, a login from a new device or a pending identity verification, and they include a shortened link or a domain that is not the official one. In these cases Bizum is the impersonated entity, and no conduct is attributable to it. No Spanish bank asks by phone, text message or email for your full access code, the SMS code sent to confirm an operation, for you to move money to a supposed safe account or to install a remote-control app on your phone. If you are asked for any of those things, hang up and call the number on the back of your card or inside the official app. If you already handed over your credentials and Bizums you did not order left your account, the legal picture changes completely, as I explain below.
What to do in the first hours
What you do today does not replace the lawyer, but it conditions what the lawyer can achieve afterwards.
- Call the bank on its official number and report what happened. Ask them to block access if you gave out credentials and to log your call with date and time.
- Delete nothing. Keep screenshots of the full conversation, the listing, the other party’s profile, the Bizum notification and the operation receipt with its reference, which appears in the movement details.
- Write down the phone number the money went to. That is the piece of data that identifies the receiving account.
- Stop talking to the scammer. Do not accept any further request or negotiate partial refunds, which is usually the prelude to a second charge.
- Do not reset your phone or change handset until that evidence is saved somewhere else.
- Report it as soon as the material is together, within the same week.
When the bank must refund the money
Bizum is a payment system between bank accounts and does not hold your money, so the claim is addressed to the bank where you hold your account. Whether it refunds or not depends on a single question, whether the operation was authorised by you.
If a third party obtained your credentials through a fake message or call and Bizums you did not order left your account, these are unauthorised operations, and payment services rules oblige the bank to refund them. The bank will dispute whether there was authorisation and how carefully you acted, and that is where most of these cases are decided. I deal with that dispute in more detail in the article on what the bank must refund after phishing and the one on bank impersonation scams.
If you were the one who confirmed the transfer or accepted the request, even though deceived, the operation is authorised and that legal refund obligation does not apply. What remains is the criminal route against whoever received the money and the civil liability claim within those proceedings, together with examining whether the receiving bank or your own breached any duty in executing the operation. How each of those claims is framed, with which documents and in what order, is the lawyer’s job. At the firm we act for victims of payment fraud and we file the claim against the bank at the same time as the criminal complaint, because each feeds the other, within our cybercrime practice.
The offence and its penalties
Bizum fraud is punished under articles 248 and 249 of the Spanish Criminal Code with imprisonment of six months to three years. If the amount does not exceed 400 euros it is a minor offence punished with a fine, and it remains prosecutable. When the amount exceeds 50,000 euros, or the fraud affects a large number of people, aggravated fraud under article 250 applies, with imprisonment of one to six years and a fine. The amount also sets the limitation period, which is fixed by article 131 of the Criminal Code.
| Conduct | Criminal Code article | Penalty | Limitation period |
|---|---|---|---|
| Fraud of up to 400 euros | 248 and 249 | Fine of one to three months (minor offence) | 1 year |
| Fraud of more than 400 euros | 248 and 249 | Imprisonment of six months to three years | 5 years |
| Fraud of more than 50,000 euros or with many victims | 250 | Imprisonment of one to six years and a fine | 10 years |
| Keeping a Bizum received by mistake of up to 400 euros | 254 | Fine of one to two months | 1 year |
| Keeping a Bizum received by mistake of more than 400 euros | 254 | Fine of three to six months | 5 years |
These are the periods for the offence. The claim against the bank has its own, shorter ones, and letting them run out while waiting to see what happens with the criminal complaint is a frequent mistake.
Where to report it and what happens next
The complaint is filed with the National Police or the Guardia Civil, or directly with the duty court. Fraud committed remotely can be investigated by the court of the place where the victim ordered the payment or holds their account, so someone living in A Coruña reports it here even if the scammer operates from another province. The court orders the receiving bank to disclose the identity of the holder of the account the Bizum went to, and that is the first and sometimes only solid lead. With small amounts the case is handled as a minor offence, which has its own procedure.
When the account holder is not identified or is out of reach, the usual outcome is a provisional dismissal. That dismissal is not an acquittal and does not close the door, because the case can be reopened if new information appears within the limitation period, and it does not affect the claim against the bank, which follows its own path. The same logic applies in corporate fraud, as I set out in the article on CEO fraud and when the bank must refund.
The person whose account received the money
The holder of the receiving account is rarely the brains behind the fraud. It is usually someone who has lent out their account or agreed to receive money and forward it in exchange for a commission, known as a money mule. Towards the victim, that person is civilly liable to return the amount received, and criminally may answer for money laundering under article 301 of the Spanish Criminal Code, even in its negligent form if it cannot be proven that they knew where the money came from. This matters to the reader for two reasons. If you are the victim, an identified mule is an asset against which to direct the claim even if the main scammer never surfaces. If you have been offered payment for receiving and forwarding money, or asked to return a credit “sent by mistake” to a number other than the originating one, you are one step away from being investigated rather than being the complainant.
What is at stake if you handle it alone
The specific risk in this scam is that the victim’s own account of events works against them. Telling the bank that “I sent the money back” or “I accepted the Bizum” without further precision immediately makes the operation authorised and closes off the legal refund route, when the facts sometimes support the opposite or allow the claim to be directed at whoever received the money. Losing the screenshots, deleting the chat or reporting without the operation reference leaves the case without the evidence that identifies the recipient. And letting the bank claim deadlines run out while waiting for the criminal case leaves you without the fastest route.
At the firm we review how the operation was executed, classify whether it was authorised or not, file the claim against the bank and the criminal complaint with the evidence in order, and act as private prosecutor so that civil liability is recovered from the holder of the receiving account. You can call +34 677 841 007 or write through the contact page, within our cybercrime practice.
When you call, have to hand the date and time of the transfer or acceptance, the amount, the phone number the money went to, the operation receipt with its reference, screenshots of the full conversation and of the listing if there was one, and the date on which you reported the facts to the bank. With that, whether or not there is a refund route can be gauged in the first conversation.
Frequently asked questions
Can a Bizum that has already been sent be cancelled?
No. A Bizum is an immediate payment between accounts and once confirmed it cannot be unilaterally revoked. Only the person who received it can return it using the refund function in the app. If they do not, the amount is claimed from the bank where the operation was not authorised by you, and through the criminal route against the recipient where it was.
If I receive a Bizum by mistake and do not return it, can I be reported?
Yes. Whoever receives what is not owed to them is obliged to give it back, and knowingly keeping it may constitute the offence in article 254 of the Spanish Criminal Code, punished with a fine of three to six months or one to two months if it does not exceed 400 euros. The return is made from the bank’s app on that same movement, so that it goes back to the originating account, and never through a new transfer to a number given to you by a stranger.
Is it worth reporting a Bizum scam of 50 or 100 euros?
Yes, even if you do not expect to recover the money quickly. At that amount it is a minor offence punished with a fine, it remains prosecutable for one year, and the complaint allows the court to identify the holder of the receiving account, who usually accumulates dozens of identical complaints. Without a complaint that account keeps operating and the claim against the bank loses force.
Do I need a lawyer to recover the money or is a claim to the bank enough?
It depends on how the money left. If a third party used your credentials and you ordered nothing, the claim against the bank has a solid legal basis and needs to be framed properly from the very first letter, because what you say there conditions everything that follows, and that is where a lawyer pays off. If you confirmed the transfer or accepted the request, the bank is not obliged to refund and everything goes through the criminal route against the recipient, where the lawyer’s role is to recover civil liability. If the amount is small and the recipient cannot be found, paying fees is not worth it, and reporting the facts to the police and the bank is enough.