The dispute form your bank hands you when you challenge a charge is the step that decides whether you get back the money from a fake investment paid by card. If the transaction is declared as a service that a fraudulent merchant never provided, it enters the Visa or Mastercard chargeback process and the amount can return to your account; if it is ticked as a transaction you do not recognise, the bank answers with the authentication you yourself completed on your phone and the dispute is over before it starts. Online investment scams follow one script, an unlicensed platform takes a first deposit by card, displays fictitious profits on a dashboard and demands further payments before authorising a withdrawal; it is the offence of fraud under articles 248 and 249 of the Spanish Criminal Code, and the money is pursued down two separate roads, the card dispute and the criminal complaint.
This afternoon and without a lawyer, the card, the screenshots and the platform dashboard
Block the card you paid with and ask for a new one. The platform keeps the details and further charges often keep appearing, sometimes under a different merchant name, while you still believe you are negotiating the withdrawal.
Before they cut off your access, log into the dashboard and take screenshots of the balance they show you, the deposit history, the screen that makes the withdrawal conditional on a fee, and the name of the company at the foot of the website. Download the card statement with every charge, its date, its amount and the merchant name exactly as it appears, which almost never matches the platform because it collects through a payment processor.
Do not delete the chats with the “adviser” or the emails, export the conversations with their dates and keep the phone numbers. If they had you install AnyDesk, TeamViewer or another remote-control application, uninstall it and change your bank and email passwords from a different device.
Do not pay the tax, the liquidity fee or the verification they demand to release the balance; no Spanish tax is paid to a broker. And do not sign any document they send you, because it usually contains a statement that the service was properly provided, drafted to be shown to your bank.
The fake broker, the 250 euro deposit and the tax to withdraw
The advert arrives through a social network, with the face of a celebrity or a television programme. Once you leave your phone number in the form, someone calls presenting themselves as an adviser for a cryptocurrency, forex or stock platform and suggests starting with 250 euros, a figure repeated so often that it has become a search term in its own right. That first deposit is taken by card and appears immediately on a dashboard with a chart that goes up.
For weeks the adviser calls daily, shows profits that do not exist and asks you to increase the position, sometimes from your own computer through a remote-control application. When the client tries to withdraw, the dashboard demands an advance payment, capital gains tax, an exit fee or an anti-money-laundering verification, and whoever pays discovers that the withdrawal is still blocked and another payment is needed. The dashboard is a web page that shows whatever the fraudster wants, and the money left Spain with the first transaction.
What Law 6/2023 says when the broker is not on the CNMV register
Law 6/2023 on Securities Markets and Investment Services reserves the provision of investment services to firms authorised and entered in the registers of the Comisión Nacional del Mercado de Valores, the Spanish securities regulator. Anyone soliciting clients without that authorisation is what the CNMV itself calls a “chiringuito financiero”, an unauthorised firm, and the regulator publishes warnings naming the platforms it receives complaints about, alongside those issued by supervisors in other European Union countries.
If the platform appears in a warning, you hold an official document proving that the merchant could not provide the service it charged for, and that carries weight both in the card dispute and in the criminal complaint. If it does not appear, that does not make it legitimate; these platforms change names every few months and the warning arrives after the first victims.
The terms you accepted when registering, with their submission to the courts of Cyprus or the Marshall Islands and their no-refund clause, do not strip you of the protection that the consolidated Spanish Consumer Protection Act and Law 7/1998 on general contract terms give anyone contracting as a consumer with a foreign company. Against deceit, that contract is simply one more piece of evidence of the deceit.
Card, transfer or cryptocurrency, the payment method sets what can be recovered
You authorised the card payment to the platform, with your code and your phone. That distinguishes it from an unauthorised transaction, one made by a third party with your details after phishing, for which payment services regulation imposes a refund obligation on the bank, as I explain in when the bank must refund money after phishing. In an investment scam the bank executed your own instruction, and the road to recovering the charge runs through a dispute under the Visa and Mastercard rules, which cover the merchant that takes payment and does not deliver the service.
You also ordered the transfer yourself, as happens in bank impersonation scams. You can ask your bank to request a recall from the receiving bank, and the outcome depends on the money still sitting in the destination account, which rarely happens after a few hours because it is moved through intermediary accounts until it leaves the European Union.
Cryptocurrency sent to the fraudster’s wallet cannot be reversed. If you bought the coins by card on a legitimate exchange and then sent them yourself to the address you were given, a chargeback against the exchange fails, because the exchange did provide its service. What remains is tracing within the criminal case and the cooperation of the exchange that received the funds, if it is identified and answers court requests.
| Payment method | Route to recovery | What can be achieved | The clock that runs |
|---|---|---|---|
| Credit or debit card | Visa or Mastercard chargeback for services not provided | Refund of the charge if the dispute succeeds | Deadline set by the scheme, counted from each charge |
| Bank transfer | Recall request to the receiving bank | Refund only if the money is still in the destination account | Hours, until it is moved |
| Cryptocurrency to the fraudster’s wallet | Tracing and court requests within the criminal case | Seizure if the wallet holder is located | Limitation period of the offence, five or ten years |
| Any method | Criminal complaint with civil liability | Conviction and restitution if the offender is identified and has assets | Five-year limitation period, ten if aggravated |
The Visa and Mastercard chargeback, private rules with their own clock
The chargeback is not in any Spanish statute. It is a set of card-scheme rules binding the issuing bank and the merchant’s bank, which allows a charge to be reversed when the merchant did not deliver what it charged for or turned out to be fraudulent. Your bank files the dispute as an intermediary, the merchant’s bank can contest it and the scheme decides. That is why how it is presented, and with which documents, matters.
The deadline is set by the scheme and runs from the date of each charge, not from the day you realised it was a scam. It is measured in days and runs out within a few months, and because the deposits were staggered, each has its own cut-off and the earliest expire first. Clients usually take months to accept that they will never be paid out, so by the time they complain the first payments are already lost and only the rest remains.
The bank’s customer service department usually replies that the transaction was correctly authenticated and no refund is due. That reply answers a question nobody asked; the dispute does not turn on whether you authorised the payment, it turns on a merchant that charged without providing the service and without authorisation to provide it. How that claim is framed, under which dispute category and with what evidence, is the lawyer’s job, and what goes into the first submission conditions the merchant bank’s response.
At the firm we prepare the card dispute alongside the criminal complaint, because both draw on the same documents and the CNMV warning and the police report carry weight in the bank’s file; I explain this on the bank fraud page.
Basic fraud, aggravated above 50,000 euros and continuing offence
Article 248 of the Criminal Code defines fraud as sufficient deceit that leads another person to carry out an act of disposal to their own or a third party’s detriment, and a dashboard with invented profits is that deceit. Article 249 punishes it with six months to three years in prison when the amount defrauded exceeds 400 euros; below that it is a minor offence carrying a fine of one to three months.
Article 250.1.5 raises the penalty to one to six years in prison and a fine of six to twelve months when the amount defrauded exceeds 50,000 euros or a large number of people are affected, and these platforms meet the second condition even if they only took 3,000 from you. Article 250.2 raises it to four to eight years in prison when the amount exceeds 250,000 euros. Because the deposits were made one after another under the same deceit, article 74 allows them to be treated as a continuing offence and the sums added together.
The holder of the account that received the transfers, the money mule, is liable for money laundering under article 301, including its negligent form with six months to two years in prison, and is often the only person identified in Spain. A conviction carries the civil liability of articles 109 and 110 of the Criminal Code, restitution of the money, which is collected against the convicted person’s assets and whatever the court managed to freeze during the investigation.
Reporting in A Coruña a platform registered in Cyprus or Vanuatu
You can file a complaint at any National Police station, any Guardia Civil post or the duty court. Jurisdiction lies with the court of the place where the deceit or the act of disposal took place, the ubiquity criterion the Supreme Court applies to fraud committed at a distance, so the case opens before the investigating court of your own city even if the company is in Cyprus and the server in Vanuatu.
The complaint alone rarely returns the money. What returns it, when that happens, is action within the case, requests to the receiving bank and the exchange, freezing of balances and identification of the mule account holder. To ask for any of that you must be joined to the proceedings as a private prosecutor under articles 109 and 110 of the Criminal Procedure Act, and early, because the court does not investigate on its own motion what nobody points out. Measures in another European Union country go through the European Investigation Order under Law 23/2014; outside the Union, letters rogatory take years and many go unanswered.
The time limit for reporting is the limitation period, which article 131 of the Criminal Code sets at five years for basic fraud and ten for the aggravated form. If no offender is identified, the court orders the provisional dismissal of article 641 of the Criminal Procedure Act, which does not close the matter and is reopened when new information appears, for example the dismantling of a network operating the same platform.
The recovery call, the scam that follows the scam
Months later you will receive a call or an email from someone claiming to be a law firm, a fund recovery agency, a refunds office of the CNMV or an international body, or the platform’s liquidator. They know your name, the amount lost and the adviser’s name because the list of victims circulates among the same organisations. They will tell you your money has been located and that releasing it requires paying a bond, unblocking costs or opening a cryptocurrency wallet where you will “receive” the funds.
No public body charges to return money and no balance held abroad is released by paying a fee. It is another fraud under article 248, aimed at someone who has already shown they pay. A genuine law firm charges for its work and will not ask you to deposit money with a foreign entity to unblock anything.
Frequently asked questions
Can I get my money back from an online investment scam, and when is that realistic?
It is realistic when you paid by card and the dispute is filed within the deadline set by the card scheme, or when the transfer has not yet left the destination account. With cryptocurrency sent to the fraudster’s wallet, recovery depends on the criminal case locating the holder, and that rarely happens. The earliest deposits expire before the later ones, so every week counts.
Exactly what offence is it, and what is the penalty for fraud with fake investments?
It is the offence of fraud under articles 248 and 249 of the Spanish Criminal Code, punishable with six months to three years in prison when the amount defrauded exceeds 400 euros. If it exceeds 50,000 euros or affects a large number of people, article 250 raises the penalty to one to six years in prison, and to four to eight years when it exceeds 250,000 euros.
The oldest charge sets the date, what needs doing now
The next step is to file the dispute over the card charges before the oldest ones expire and, in the same week, the criminal complaint with the statement, the dashboard screenshots and the CNMV warning if there is one. The dispute is drafted by the lawyer, because its category and its evidence decide whether the merchant’s bank contests it, and the complaint is prepared with a view to joining the proceedings later as a private prosecutor. At Perseus & RC Abogados we handle both, and the claim against the bank when its customer service department rejects the dispute; you can see what we do under fraud and cybercrime, and write to us through contact or call +34 677 841 007.