Four hundred euros. That is the figure in article 249 of the Spanish Criminal Code which, when a transfer leaves your account without your consent, separates a minor fraud offence punishable with a fine of one to three months from an offence carrying one to three years, with a minimum of six months, in prison. An unauthorised transfer is one executed without the account holder’s consent, because someone got in with your credentials, cloned your SIM card or tricked you into handing over a code, and payment services legislation obliges the bank to refund the amount unless it can show fraud or gross negligence on the customer’s part. How long the refund takes has little to do with the legal deadline, which is short, and a great deal to do with what the bank decides when it closes its investigation.
Block, keep and do not reply, what depends on you alone this afternoon
Call the bank on the emergency number printed on your card or shown in the app, never the one given to you by a caller or sent in a text. Ask for digital banking access and cards to be blocked, and for the bank to request that the receiving bank freeze the funds. An executed transfer is irrevocable, but while the money has not moved out of the receiving account the destination bank can hold it and send it back, and that request only works in the first few hours.
Keep everything. The texts and emails you received, however crude they look, the call log on your phone with time and number, screenshots from the app showing the transaction and the destination account, and any application you were made to install, without uninstalling it. If the deception came from a call impersonating your bank, I cover that pattern in the article on bank impersonation scams.
Do not call the scammer’s number back, do not make any “test” transfer or any transfer “to cancel the previous one”, and do not sign any bank document in which you acknowledge having authorised the transaction or having handed over your credentials voluntarily. That signature is what is later used to refuse the refund.
Unauthorised bank transfer, what falls within the definition and what stays outside it
The law distinguishes three situations that the customer tends to experience as one. The first is a transaction executed with no involvement from you at all, because someone accessed your online banking with stolen credentials, installed remote control software on your computer or obtained a duplicate of your SIM card and received the confirmation codes. There is no argument there about whether it is unauthorised.
The second is a transaction confirmed with a code that you yourself entered or handed over after being deceived, following a call from someone claiming to be the bank’s fraud department, a text with a link to a website identical to your bank’s or an official-looking email. Consent obtained by deception is not consent, which is why these transactions are treated as unauthorised, but this is the ground on which the bank raises the customer’s gross negligence and where most claims are decided.
The third is a transfer you ordered knowing who you were sending it to, a fake seller, a supposed investment platform or someone posing as a relative. The transaction is authorised even though the reason behind it was a scam, and your position against the bank is far weaker. The main route is the criminal case against the perpetrator, and the civil route against the bank only opens if the bank itself failed in executing or monitoring the transaction. What the bank is obliged to refund in each case is developed in the article on bank refunds after phishing.
Unauthorised transfer at BBVA, Santander or any other bank, the legal deadline and the real one
The obligation is the same for every institution operating in Spain, from the large banks to payment institutions and neobanks with a European licence, because it comes from payment services legislation and not from each bank’s contract. That legislation sets a refund deadline counted in business days, not weeks, and only lets the bank depart from it in closed cases.
What actually takes time is something else. The bank opens an internal investigation, usually replies with a standard letter attributing the transaction to the customer’s gross negligence for having handed over the credentials, and from that letter onwards the formal complaint goes first to its customer service department, then to the Bank of Spain, which issues a report that does not bind the bank, and finally to the court, which is the only body that can order a refund. Each step has its own deadline and formal requirements, and how each one is framed so that the next is not lost is the lawyer’s job. At the firm we direct that claim from the first letter, so that what is said to the bank is already what the lawsuit will later rely on; what we do is set out on the banking fraud and cybercrime page.
There are cases where litigation is not worth it. If the sum is a few hundred euros and the bank has already refunded most of it, or if you knowingly ordered the transfer to a seller who turned out to be fake and the bank made no mistake of its own, the cost of the case exceeds what you can recover and the honest thing is to say so at the first consultation. When the amount is significant or the bank’s letter rests solely on “the customer handed over the credentials”, the claim has legs. The amount also changes the perpetrator’s sentence and the civil route against the bank.
| Amount of the transfer | What changes under the law |
|---|---|
| Up to 400 euros | Minor fraud offence, fine of one to three months (article 249 of the Criminal Code) |
| Over 400 euros | Fraud offence, six months to three years in prison (article 249 of the Criminal Code) |
| Up to 15,000 euros | The civil claim against the bank proceeds as a verbal (summary) trial (article 250.2 of the Civil Procedure Act, following Royal Decree-Law 6/2023) |
| Over 50,000 euros | Aggravated fraud, one to six years in prison and a fine of six to twelve months (article 250.1.5 of the Criminal Code) |
| Over 250,000 euros | Four to eight years in prison and a fine of twelve to twenty-four months (article 250.2 of the Criminal Code) |
Computer fraud under article 248.2, the police report and the right court
A transfer obtained with stolen credentials or with a code extracted by deception falls under article 248.2 of the Criminal Code, which punishes as fraud anyone who, for gain and by means of computer manipulation or a similar device, obtains a non-consented transfer of any asset to the detriment of another. The sentences are those in the table, and the aggravation by amount applies to the total sum even if the money left in several transactions forming part of a single scheme.
A police report is not a legal requirement for the bank to refund, but banks demand one in practice and it should be filed the same day, at a National Police station, a Civil Guard post or the duty court, with proof of the transaction and the destination account. It allows the receiving bank to be formally requested to identify the account holder and freeze the funds, and it is what later allows civil liability to be claimed within the criminal proceedings.
Where to report is a frequent doubt, because the money usually ends up in an account in another province or another country. The Supreme Court has consistently placed jurisdiction in these frauds where the victim performed the act of disposal, so that, as a rule, the competent court is the one for the place where you were when the transaction was executed and not the one for the destination account. For a victim in A Coruña, that means investigation in A Coruña.
The offence under article 248.2 is time-barred after one year in its minor form, five years in its basic form and ten in its aggravated forms, under article 131 of the Criminal Code, and the civil action against the bank after the five years of article 1964 of the Civil Code. Those are long periods for the calendar and short ones for the evidence, because access logs and recordings of calls to the bank are not kept indefinitely.
Dismissal for unknown perpetrator, the money mule and what stays alive against the bank
The investigation usually identifies the holder of the receiving account and little more. That holder is normally a “mule”, someone who lent out their account for a commission or opened it after being taken in by a fake job offer, and whoever moved the money on from there does not appear. When the court cannot identify the perpetrator, it issues the provisional dismissal of article 641 of the Criminal Procedure Act, which is not an acquittal and is reopened if new information emerges.
Dismissal of the criminal case does not affect the bank’s obligation. They are two separate relationships, yours with the bank under the account contract and the State’s with the fraudster, and the first is claimed regardless of whether the second ends in a conviction, a dismissal or nothing at all.
If you are on the other side, because money came into your account and you forwarded it on someone’s instructions, you have a problem of your own. Article 301 of the Criminal Code punishes money laundering, and its paragraph 3 punishes the negligent form with six months to two years in prison and a fine of one to three times the sum moved, without any need to prove that you knew where it came from. Civil liability to the victim for the full amount is added to that. Anyone in that position needs criminal defence before giving a statement, not after.
“Your transfer was not authorised by the issuing bank”, the notice that describes the opposite case
That message means that you ordered a transfer and your own bank stopped it, usually because its fraud prevention systems flagged a new payee, an unusual amount or access from an unknown device. No money is lost and no unauthorised transaction has taken place, there is an order on hold that is released by confirming it through the bank’s official channel. If the hold is kept in place without explanation and causes you a loss, for example a payment falling due, that loss can be claimed.
Frequently asked questions
How do I report an unauthorised transfer?
By calling your bank’s fraud number printed on your card or shown in the app, never a number supplied by a third party, and asking in that same call for access to be blocked and the funds to be frozen at the receiving end. Then file a police report the same day and notify the bank in writing, keeping the incident number and all evidence of the deception.
If I entered the password or the SMS code myself after being deceived, is it still an unauthorised transaction or is it treated as gross negligence?
As a rule it remains an unauthorised transaction, because consent obtained by deception is not consent. The bank usually labels it gross negligence in order to refuse the refund, and whether that label holds depends on the specific circumstances of the deception and on how they are evidenced before the bank and before the court, which is the lawyer’s job.
With the bank’s letter in hand, the next step and who takes it
If the transaction happened today, the step is yours and it is the one in the first section, block, keep and report. If you already have the bank’s letter refusing the refund, or weeks have gone by with no reply, the next step is the formal claim, and it should be the lawyer who takes it, because what is written in it fixes your position before the Bank of Spain and the court, and what is left out cannot be recovered later. At the firm we conduct the victim’s criminal defence and direct the civil claim against the bank; what we do is set out under banking fraud and cybercrime, and you can put your case to us on +34 677 841 007 or through our contact page.