If you have paid a web shop that does not exist, the first step is with the payment channel and the second is the criminal complaint for fraud under Article 248 of the Spanish Criminal Code. The order matters. Money sent by bank transfer or Bizum leaves the receiving account within hours, and a card chargeback is easier to process while the merchant still appears active in the card system. Anyone who spends the first day preparing the complaint and leaves the bank for later usually finds there is nothing left to freeze. Conversely, anyone who goes to the bank without first saving screenshots of the website is left without evidence the moment the shop vanishes, and these shops vanish within days. What takes five minutes, and comes before everything else, is documenting the purchase with screenshots of the product page with the address visible, of the legal notice if there is one, of the payment receipt and of every email received.
What can be seen before paying
The warning signs every guide repeats are true, but some have stopped being useful. The padlock and https no longer distinguish anything, because certificates are free and every fake shop has one. What does distinguish is what the law requires a seller to publish. Article 10 of Law 34/2002 on information society services requires any website that sells to display, permanently and accessibly, the name or company name of the owner, its address, an email address, its tax number and, for a company, its registration details at the Companies Register. A shop with no legal notice, or with a notice giving an address in another country, a tax number that does not add up or a company name that does not appear in the Register, is breaching an administrative rule and, above all, announcing that there is nobody behind it to claim against.
Then comes the domain. A whois lookup, offered by several free services, returns the creation date, and a shop with thousands of reviews created three weeks ago is a contradiction. Prices far below the market on every item, clumsy translation, product photos that turn up on other websites when searched with Google Lens and, above all, a payment method that cannot be reversed, whether transfer only, Bizum to an individual or cryptocurrency, complete the picture. Reviews are looked for outside the shop, and the lists of fraudulent websites published by INCIBE, the Spanish National Police or consumer associations have limited value, because the domain is shut down and reopened under another name before the list is updated. A shop not appearing on those lists says nothing in its favour.
A fake shop and a real shop that fails to deliver
These are different situations with different routes. If there is no identifiable company behind the website, the order never ships and the contact email stops answering, it is fraud and the routes are the payment channel and the criminal complaint. If there is a real company, with a verifiable tax number and address, that has taken the money and does not deliver, or delivers something else, it is a consumer matter governed by the consolidated text of the General Law for the Protection of Consumers and Users, approved by Royal Legislative Decree 1/2007. Article 66 bis of that text sets a maximum delivery period of thirty calendar days unless another has been agreed, and if the seller fails to deliver after a demand with an additional period, the consumer may terminate the contract and demand a full refund. If the product arrives but is not what was offered, the lack of conformity rules in Articles 114 and following oblige the seller to repair, replace, reduce the price or refund. And in any distance sale there is the right of withdrawal under Article 102, fourteen calendar days from receipt with no reason required, a period that extends to twelve months when the shop failed to inform the buyer of that right, which is almost always the case with websites of this kind.
There is a grey area, and it is the most common one. Shops with a real company behind them, often outside the European Union, that sell a product which exists but is of far lower quality than advertised, with two-month deliveries and a returns policy requiring you to ship the parcel back to Asia at your own expense. Consumer law applies there in theory and is hard to enforce in practice, and a card chargeback is usually the only route that produces a result. Knowing which of the three situations you are in determines who you claim against and under which rule.
Fraud under Article 248 of the Criminal Code
Setting up an online shop to collect payment for orders that will never be shipped is fraud under Article 248 of the Spanish Criminal Code, which punishes anyone who, for gain, uses sufficient deception to mislead another person into a disposal of assets to their own detriment. The website is the deception, the payment is the disposal and the loss is the amount collected. The sentence depends on the amount and on how many people fell for it, and that last factor works in the victim’s favour, because a fake shop rarely deceives a single person and the sum of all the complaints is what moves the case into the aggravated offence.
| Case | Provision | Sentence | Limitation period |
|---|---|---|---|
| Fraud of up to 400 euros | Article 249.2 | fine of one to three months | one year |
| Fraud above 400 euros | Article 249.1 | six months to three years in prison | five years |
| Above 50,000 euros or a large number of victims | Article 250.1 | one to six years in prison and a fine of six to twelve months | ten years |
| Above 250,000 euros | Article 250.2 | four to eight years in prison and a fine of twelve to twenty-four months | ten years |
Limitation periods are those of Article 131 of the Criminal Code and run from the day the offence was committed, in practice from the payment. A sixty-euro purchase reported two years later is no longer prosecuted. Alongside the person running the shop there are usually others with liability of their own. The accounts receiving the transfers and Bizum payments almost never belong to the fraudster, who uses individuals recruited to lend their account for a commission, and anyone who does that is liable for money laundering under Article 301 of the Criminal Code, including in its negligent form, even without knowing in detail where the money came from. That matters to the victim, because the holder of the receiving account is identified and is in Spain, and the claim for the money is often directed against that person when the main offender cannot be found.
What is left depending on how you paid
The payment method decides more than anything else. With a card there is the chargeback, the card schemes’ mechanism for purchases where the goods are not received or the merchant turns out not to exist, and in addition the payment services rules oblige the bank to refund unauthorised transactions, which matters because a fake shop keeps the card details and often uses them later for charges you never made. I wrote about what the bank is obliged to refund in this article on phishing refunds, and how that claim is framed so that it succeeds is the lawyer’s job.
With a bank transfer or Bizum the picture is worse, because you authorised the transaction and the bank is not obliged to reverse it. What remains is for the receiving bank to freeze the balance if it is still in the account, which only happens in the first hours, and then criminal and civil action against the holder of that account. PayPal has its own buyer protection, on its own terms, which does not cover payments sent as friends and family, and fake shops ask for precisely that option. Cash on delivery limits the risk to the cost of the empty parcel they sometimes send to justify the charge, and with cryptocurrency recovery is, in practice, non-existent.
At the firm, when payment was by card and the bank has said no, or when it was by transfer and the receiving account has been identified, we run the claim and the criminal action from our cybercrime practice.
Where to report it and what happens next
The complaint is filed at any National Police station or Guardia Civil post, which pass it to their technology crime units, or directly at the duty court. In internet fraud the courts have settled on jurisdiction lying where the victim made the payment, in practice their home, so you report where you live even if the shop is in another province or another country. You need to bring the screenshots of the website and the order, the payment receipt showing the receiving account or merchant, the emails received and, if there is one, the bank’s reply. Without the receiving account details the complaint is shelved quickly, because it is the only thread that can be pulled.
The shelving of the case deserves plain words. When the offender is not identified, the court issues a provisional dismissal under Article 641 of the Criminal Procedure Act, which is neither an acquittal nor a final closure, and which is reopened if new information appears, often when another victim reports in another province and the cases are joined. The criminal shelving has no effect on the chargeback, which runs through a separate channel, and the complaint itself is the document the bank and the card scheme ask for in order to process it. That is why you report even knowing the investigation will probably reach nobody. You should also expect the second scam. A few days after the first, a call usually arrives from someone claiming to be the bank, the police or a funds recovery company, with genuine details of your purchase because the same fraudster holds them, asking for a fee or for access in order to return your money. I wrote about that variant, the bank impersonation scam, here.
What you can do today and what you must not do
Keep everything and delete nothing. Screenshots with the website address and the date visible, the confirmation email with its full headers, the payment receipt and the message history with the shop are the evidence, and the website will be gone within a week. How that evidence is preserved so that it holds up is covered in this article on electronic evidence. If you paid by card, cancel it, because the number is now in third-party hands. Do not pay any additional amount requested for “customs”, shipping insurance or releasing the order, which is the usual way of extracting a second payment. Nor should you give anyone who calls your passwords, SMS codes or access to your computer, or sign or accept by email any waiver in exchange for a voucher or a future shipment. Writing a review or flagging the shop on a list helps the next buyers, but returns nothing to you, so do not stop there.
If the fake shop is using your brand
The other victim of these websites is the business whose name, logo and photos are copied. The owner of a registered trade mark holds the exclusive right under Article 34 of Law 17/2001 on Trade Marks, which allows it to prohibit use of the sign and demand removal of the domain and its content from the registrar and the hosting provider, and it can also join the criminal fraud proceedings as an injured party, because the damage to its reputation and the complaints from customers who never bought from it are its own loss. What is urgent in that case is documenting the copy and warning customers before the complaints under its name multiply.
When the firm is needed
Anyone claiming on their own tends to lose in two places. They accept the bank’s refusal as final when it is not, and they file a complaint without the receiving account or the screenshots, which is shelved within weeks. At the firm we analyse which payment method you used and who can be pursued, frame the claim against the bank or the card scheme, file the complaint with the full evidence and, where the account holder is identified, direct the claim for the money against that person, from our cybercrime practice. You can call +34 677 841 007 or write through the contact page. Have to hand the payment receipt with the date and destination, the screenshots of the website, the emails with the shop and, if you already claimed from the bank, its written reply.
Frequently asked questions
Can I get my money back if I paid a fake online shop by bank transfer or Bizum?
It depends on speed and on whether any balance remains in the receiving account. You authorised the transaction, so the bank is not obliged to reverse it, and what remains is to ask for the balance to be frozen if it is still there, which only works in the first hours, and then to bring criminal and civil action against the holder of that account, who is usually an identifiable person in Spain who lent their account for a commission.
Where do I report a fake online shop and what do I need to bring?
At any National Police station, Guardia Civil post or the duty court where you live, because in internet fraud jurisdiction lies where the victim made the payment. Bring the screenshots of the website and the order, the payment receipt showing the receiving account or merchant, the emails with the shop and the bank’s reply if you have already claimed.
How long do I have to report a purchase from a fake online shop?
Fraud above 400 euros is time-barred five years after the payment, and the aggravated offence after ten. If the amount does not exceed 400 euros it is a minor offence and is time-barred after one year. The deadline that really matters is a different one, because the balance of a transfer can only be frozen in the first hours and a card chargeback has its own time limits, so the complaint and the claim are filed in the first days.
Do I need a lawyer to claim for a purchase from a fake online shop?
For a purchase under one or two hundred euros paid by card, no. Ask your bank for a chargeback and file the complaint with the screenshots and the receipt, and that is usually enough. A lawyer is worth it when the bank has refused the refund and the amount justifies it, when you paid by transfer or Bizum and the receiving account has been identified, or when there are several victims and it pays to group the complaints. If you paid in cryptocurrency or to an account outside Europe and the amount is small, the honest answer is that the lawyer’s fees will exceed what can be recovered.