The call to CaixaBank to block the account looks like a minor formality, the same one you make when a card is left in a taxi. It is in fact the notification that payment services legislation requires from the customer before the bank is liable for a transaction he did not authorise, and whatever the operator writes down at that moment becomes the first version of the facts CaixaBank will have in front of it when it decides whether to refund the money or to argue that you were negligent. Someone who calls in a panic and sums it all up as “I gave them the code”, without explaining that he did so because the message sat inside the bank’s genuine thread and a person claiming to be its fraud department was asking for it, has already recorded the argument that will be used against him. Call as soon as you can, but tell the whole story and in order.
What exactly has happened
The text you received impersonated CaixaBank and sent you to a page imitating the bank’s online banking. The templates change every few weeks, but the substance repeats. A warning that the account has been blocked, a supposed transaction you do not recognise and must cancel, a new device that needs verifying or an invitation to install a security app. In the combined variant, after you enter your details on the fake site the phone rings and someone presenting himself as a CaixaBank employee calmly asks for the codes you are receiving in order to “cancel” the suspicious operations. Those codes are what the fraudster is using at that very moment to authorise them. How to recognise the message or the call before clicking is covered in another article and I will not repeat it here.
One technical detail matters a great deal for what follows. In a large share of these cases the fake text appears in the same conversation thread as CaixaBank’s genuine messages, right below the last real alert about a charge or an access code. The technique is known as “SMS spoofing”, it forges the sender so that the phone groups the message with the legitimate ones, and no customer has any means of detecting it. Keep that thread exactly as it is, because it is the proof that the deception arrived wrapped in the bank’s own channel.
What you ended up providing changes the risk
If you only opened the page and closed it without typing anything, the real risk is low. A fake site does not steal data merely by loading in an up-to-date browser, so the sensible course is to watch your transactions for a few weeks. It is a different matter if the link downloaded a file or asked you to install something.
If you entered your online banking username and password, the fraudster can see your accounts and attempt operations that require a second confirmation. Change your credentials from the official app or at a branch, never through the link you received, and check whether a new device or payee has been registered.
If you provided card details, the usual pattern is online purchases or recurring charges over the following days. The card is blocked and replaced, and each subsequent charge is claimed as an unauthorised transaction.
If you also gave the confirmation code sent by text, or approved a notification in CaixaBank Sign because the caller asked you to, the transaction is recorded by the bank as authenticated with your credentials. That is the fact on which CaixaBank will build its refusal, because from its records the transfer appears to have been ordered by you. I explain below why that does not settle the matter.
If you installed an app you were told to install, assume the phone is compromised. Programs of that kind read confirmation texts and can hide the bank’s notifications. Disconnect the phone from the internet and, once the evidence I describe next has been preserved, restore it to factory settings.
The first hours
The money almost always leaves by instant transfer or by Bizum to third-party accounts, the so-called mules, who move or withdraw it within hours. That is why the first call to CaixaBank, on the number printed on your card or shown on the official website and never the one in the text, has to be made as soon as you spot the charge. Ask for the account and cards to be blocked, for online banking access to be cancelled and for the bank to try to recall any transfers not yet settled at destination. Ask for the incident number too. Without it, proving later when you gave notice becomes difficult. If the money went out through Bizum, this article explains what can and cannot be recovered on that channel.
What you must not do is delete anything. Keep the text with the sender number visible and the full thread, take screenshots of the fake page if it is still live and note the web address, the exact time of each step and the number that called you. Download the statement showing the fraudulent transactions. If the phone has the malicious app installed, do not restore it until all of that is saved on another device. INCIBE’s free 017 helpline can guide you on the technical side.
Then file a report with the Policía Nacional or the Guardia Civil with that documentation. A police report is not a legal requirement for the bank to refund, but in practice CaixaBank asks for it, and only the court can require the receiving banks to disclose the holders of the destination accounts and freeze whatever remains in them.
Is CaixaBank obliged to refund your money
As a general rule, yes. Payment services legislation obliges the bank to refund the amount of any transaction the customer did not authorise, and it is the bank that has to prove otherwise. The exception customer service departments work with is gross negligence on the user’s part, and in smishing cases the bank’s standard reply is that you voluntarily handed your credentials and the confirmation code to a third party and thereby breached your duty to keep them safe.
That reply is not the end of the matter. Gross negligence is not any slip, but a very marked lack of care, and both the Banco de España in its criteria for these files and the courts have been drawing a line between someone who hands over his credentials unprompted and someone who does so deceived by a message arriving in the bank’s official thread, followed by a call that completes the performance. Sender spoofing weighs in your favour precisely because it removes the signal a reasonable customer would have relied on to grow suspicious. Along with the principal, you claim the fees, overdraft interest and other costs the fraud has caused you.
How that claim is drafted, what exactly is requested and what is done with CaixaBank’s reply when it arrives is lawyer’s work, and it is what we do at the firm within our cybercrime and banking fraud practice. What I wrote about bank refunds after phishing in general applies to this bank as well.
The offence committed against you
What has happened to you is computer fraud under Article 249 of the Spanish Criminal Code, as worded since the 2022 reform, which punishes anyone who, through computer manipulation or by using someone else’s card data, obtains a non-consensual transfer to another’s detriment. The penalty is six months to three years’ imprisonment. If the amount defrauded does not exceed 400 euros, it is a minor offence punishable with a fine of one to three months. Where the amount exceeds 50,000 euros, or the fraud affects a large number of people, which is the norm in mass text campaigns, the aggravated offence under Article 250 applies, with one to six years’ imprisonment and a fine of six to twelve months. If you were made to install an app that interfered with the phone’s operation, the offence of computer damage under Article 264, carrying six months to three years’ imprisonment, may also apply.
| Conduct | Criminal Code article | Penalty |
|---|---|---|
| Computer fraud up to 400 euros | 249 | Fine of one to three months |
| Computer fraud over 400 euros | 249 | Six months to three years’ imprisonment |
| Fraud over 50,000 euros or affecting many victims | 250 | One to six years’ imprisonment and a fine of six to twelve months |
| App that alters or takes control of the phone | 264 | Six months to three years’ imprisonment |
The holders of the accounts where the money lands are liable too. Even if they claim they merely lent their account in exchange for a commission, courts frequently convict them of money laundering, including the negligent form that Article 301 punishes with six months to two years’ imprisonment and a fine.
You can report the matter in A Coruña even if the destination account is in another province or the fake site’s server is abroad. In these frauds the courts generally fix jurisdiction where the victim held the account and the loss occurred. The offence is time-barred after five years in its basic form and after one year for the minor offence under 400 euros, so there is time, but digital evidence and the money trail do not wait that long.
What happens if the criminal case is shelved
It happens often. If the investigation fails to identify the perpetrators, because the destination accounts belonged to untraceable mules or the trail is lost abroad, the court orders a provisional stay. That does not mean the case is over for you. The stay leaves your claim against CaixaBank intact, since it rests on payment services legislation and not on anyone being convicted, and it preserves the civil action, which is time-barred after five years under Article 1964 of the Civil Code. What you must watch is that the claim to the bank was lodged in time and in proper form while the criminal case was running, because waiting for the outcome of the police report before starting to claim is the most expensive mistake we see.
Claiming on your own or with a lawyer
If you claim on your own, the concrete risk is that your first submission contains an admission of precisely what the bank needs in order to speak of gross negligence, and that this version follows you through every later stage with no chance to correct it. At the firm we act for victims of banking fraud from the first communication to the bank through to litigation if needed, and we also handle the police report and the appearance as private prosecutor in the criminal case. You can call us on +34 677 841 007 or write to us through the contact page. When you do, have to hand the screenshots of the text with the full thread, the statement showing the transactions, the time you notified CaixaBank with the incident number and, if you already have it, the bank’s written reply.
Frequently asked questions
I clicked the link but did not type anything, am I at any risk?
If you only loaded the page and did not enter data or install anything, the risk is low. Check that the phone has not downloaded any file, change your access password from the official app as a precaution and watch your transactions over the following weeks. Until there is a charge, there is nothing to claim.
I gave the confirmation code that arrived by text, do I lose the right to a refund?
Not automatically. CaixaBank will argue that by providing the code you authorised the transaction or were grossly negligent, but gross negligence requires a very marked lack of care and the bank has to prove it. That the code was given under deception, in a call that followed a text slipped into the bank’s official thread, is a circumstance in your favour. Each case depends on how it happened and how it is told.
Do I have to report it to the police for CaixaBank to refund my money?
The law does not require it, but in practice the bank asks for a copy of the report and without it the claim becomes harder. In addition, only through the court can the holders of the destination accounts be identified and any remaining funds frozen. Report it with the evidence you have kept and ask for a stamped copy.
Do I need a lawyer to claim against CaixaBank or can I do it myself?
It depends on the amount and on the bank’s reply. If CaixaBank refunds the money within the first few days, which does happen with small card charges, you need no one. If the sum is a few hundred euros and the bank refuses, weigh whether the fees are worth it before going further. From a few thousand euros upwards, or once the bank has replied in writing alleging negligence, a claim properly framed from the start is what separates recovering the money from not recovering it, and there a lawyer is worth having.