Typing the code the text message asked for does not turn the transfer into an authorised transaction. Payment services legislation requires the bank to refund the customer for transactions the customer did not consent to, and the consent a third party extracts from you by posing as BBVA is not your consent to that payment. On that basis the courts and the Provincial Courts of Appeal, including the one in A Coruña, have been ordering banks to return what was taken in phishing and smishing cases where the customer had been tricked into handing over their own credentials.
That does not mean the bank refunds on its own, or always. BBVA, like any institution, may argue that the customer acted with gross negligence, and that is where the claim is won or lost. What follows is what you need to know now that the money has already left.
How the code scam works and why the money leaves so fast
The message imitates BBVA’s alerts and warns of a transfer you did not make, with figures that recur in the published warnings, 14,990 euros or 8,600 euros, and a code to «authorise» it or a phone number to «cancel» it. If you click the link, you land on a cloned page where you enter your username, password and the code you have just received. That code is the one-time key with which the scammer, operating in parallel from their own device, confirms the real transfer. If you call the number, the scammer answers, introduces themselves as the fraud department and asks for more codes, has you install a remote control app or persuades you to move your balance to a «safe account».
The technical fact that matters for the claim is that the sender of a text message can be forged. The fake message appears in the same conversation thread as BBVA’s genuine alerts, right below real notifications of card purchases. How to tell it apart before clicking is something I already explained in the article on the BBVA text or call and I will not repeat it here.
What can be recovered and from whom
There are two routes that run at the same time and do not exclude each other. The first is a refund from the bank, which does not depend on the scammer being found. It covers transactions you did not order, even if they were executed with your credentials, because authentication with a key obtained by deception is not the same as your payment order. The second is recovering the money through the criminal proceedings, when the police identify the destination accounts and the court orders them frozen, which only works if action is taken in the first few days. What the bank is obliged to refund after a cyber scam is something I covered in general terms in another article.
The situation changes if it was you who executed the transfer, convinced by the fake adviser that you were putting your money somewhere safe. There the customer did order the transaction, and the bank’s liability is argued on different grounds, with arguments about anomalous transaction detection systems and the alerts that never fired. It is a harder case, not a lost one.
That the text slipped into BBVA’s genuine thread, that the cloned page faithfully reproduced the bank’s own, and that the transaction was for an amount and to a destination with no precedent in your account are facts that weigh against the gross negligence the bank is going to allege. How the claim is framed with those facts, before whom and with what evidence, is the lawyer’s work. At the firm we conduct these claims against the bank and the criminal complaint in parallel, within our cybercrime and banking fraud practice.
The first hours decide the evidence and part of the money
Call BBVA on the number printed on your card or shown in the app, never the one in the text, state that you do not recognise the transaction and ask for your credentials, cards and linked devices to be blocked. Ask for the time of your call to be recorded. If the fake adviser had you install something on your phone, disconnect it from the internet and do not restore or wipe it, because that phone is evidence.
Do not delete the text thread or the fake message. Take screenshots of the message, of the page the link took you to if it is still open, of the account movements and of the app notifications. Keep the number you were called from and the time. If you received emails or notifications from the bank during the transaction, keep those too.
Report it to the Policía Nacional or the Guardia Civil with all of that documentation. Do not sign any bank document in which you acknowledge having authorised the transfer, and do not accept a verbal explanation that «by giving the code the transaction is yours». And do not speak again to anyone who calls claiming to be from BBVA or the police to «help you recover» the money, because the second call is part of the same scam.
The offence committed and its penalties
What was done to you is computer fraud under article 248.2.a) of the Spanish Criminal Code, which punishes anyone who, for gain and by means of computer manipulation or a similar device, obtains a non-consensual transfer of any asset. The penalty, under article 249, is six months to three years in prison when the amount defrauded exceeds 400 euros. If it exceeds 50,000 euros or the fraud affects a large number of people, article 250 raises the penalty to one to six years in prison plus a fine.
If they had you install a remote control app or altered the data on your phone, the offence of computer damage under article 264 and unlawful access to systems under article 197 bis may be added.
| Conduct | Criminal Code article | Penalty | Limitation period |
|---|---|---|---|
| Computer fraud up to 400 euros | 248.2.a) and 249 | Fine of one to three months | One year |
| Computer fraud over 400 euros | 248.2.a) and 249 | Six months to three years in prison | Five years |
| Fraud over 50,000 euros or against many victims | 250 | One to six years in prison and a fine of six to twelve months | Ten years |
| Computer damage to the device | 264 | Six months to three years in prison | Five years |
| Money laundering by gross negligence (the mule) | 301.3 | Six months to two years in prison and a fine | Five years |
The last row concerns you if the fake adviser had you receive money from someone else and forward it, or if you lent your account to someone for «a payment they could not make». Anyone who lets the proceeds of a scam pass through their account is liable for money laundering even without knowing where it came from, if they should have suspected it. It is a position that requires a defence from the first police summons, before giving any statement.
Where to report it and what happens if the case is shelved
The scammer usually operates from another province or from abroad, but that does not force you to litigate elsewhere. The Supreme Court’s criterion for computer fraud allows the investigation to be conducted by the court of the place where the victim held the account the money left from, so a customer in A Coruña reports it here and the case is investigated here.
The usual outcome is that the investigation identifies the destination accounts, which tend to belong to mules, and not the organiser. When there is no known perpetrator the court orders a provisional dismissal, which is neither an acquittal nor a definitive closure. The case is reopened if the perpetrator surfaces before the offence becomes time-barred, and what has already been gathered in it, the police reports, the tracing of the money and the court orders to the bank, serves the claim against BBVA, which follows its own path independently of the criminal case. The civil action against the bank, for its part, is governed by the general five-year period of article 1964 of the Spanish Civil Code, so the urgency in these matters lies in the evidence and in freezing the funds, not in the lawsuit.
What the firm does in a case like this
If you pursue it on your own, the specific risk is twofold. You may receive a «no» from BBVA on grounds of gross negligence and accept it as final, and you may let the weeks in which the money was still traceable slip by while waiting for a reply. At the firm we conduct the criminal defence of the victim, claim the refund from the bank with the technical evidence that dismantles the gross negligence argument and, if necessary, take your case to court. You can call +34 677 841 007 or write through the contact page. When you call, have in front of you the undeleted text message, the screenshots of the account movements, the time you notified BBVA, the police report receipt if you have already filed it, and any letter the bank has sent you since.
Frequently asked questions
Does BBVA have to refund me if I was the one who entered the code from the fake text?
As a rule, yes. Payment services legislation requires the bank to refund unauthorised transactions, and a transfer executed by a third party with a code they obtained from you by deception is not one you authorised. The bank may refuse by alleging gross negligence, and that is where the claim is argued. The fact that the message appeared in BBVA’s genuine thread and that the page was a copy of the bank’s works in your favour.
Do I have to report it to the police before claiming from the bank?
It is not a legal requirement for the bank to refund, but you should do it as soon as possible and submit the police report together with the claim. BBVA usually asks for the receipt, and the report is what allows the destination accounts to be frozen and whoever received the money to be investigated. You can notify the bank first, by phone, and file the report the same day.
I already called the number in the text and gave the supposed adviser more details, can I still claim?
Yes. Having spoken to the scammer does not make the transactions they carried out with your credentials authorised. What you must do is tell it exactly as it happened in the police report and to the bank, with the time of the call and the number, because hiding it and having it surface later in the bank’s records is what really damages the claim. If you made any transfer yourself on that person’s instructions, say so too, because that transaction is claimed differently.
Is it worth claiming against BBVA with a lawyer or should I do it myself?
It depends on the amount and on the bank’s response. If BBVA has refunded the sum within the first few days, you need nobody. If the amount is a few hundred euros and the bank rejects it, a lawyer’s fee may exceed what you recover, and in that case it makes sense to exhaust the bank’s internal complaint on your own. From amounts in the thousands, when the bank alleges gross negligence or when you yourself made a transfer after being deceived, the matter is decided on technical evidence and legal argument, and there it does pay off. Up to 15,000 euros the lawsuit follows the simplified verbal procedure, which is faster, and the Provincial Courts’ rulings in phishing cases have frequently sided with the customer.