A fraud committed through PayPal becomes time-barred, in criminal law, five years after the day of the payment if the amount exceeds 400 euros, and after one year if it does not reach that figure, because below that amount the Spanish Criminal Code treats it as a minor offence (articles 131, 132 and 249). Where the fraud is aggravated, for instance because the loss exceeds 50,000 euros or a large number of people are affected, the period rises to ten years. In civil law, the action to recover the money from the fraudster or from whoever must answer for it is time-barred five years after it could first have been brought (article 1964 of the Civil Code). PayPal Buyer Protection runs on its own clock, which appears in no statute because it is a term of your contract with the platform, and that clock is 180 days from the date of payment. After that PayPal will not accept a dispute, but this has no effect on the legal time limits. A criminal complaint that the court admits and directs against a specific person interrupts the criminal limitation period; a dispute opened with PayPal interrupts nothing.
With the time limits settled, what decides most of these cases is a box the user ticked in a matter of seconds.
Friends and family or goods and services, the box that decides it
PayPal lets you send money in two ways. With «Goods and Services» the seller bears a fee and the buyer is covered by Buyer Protection, which covers the item that never arrives and the item that arrives significantly different from what was advertised. With «Friends and Family» there is no fee and no protection of any kind, because PayPal treats that transfer as a gift between people who know each other. Its terms of use exclude it expressly.
Scammers know this, which is why they ask for exactly that. The excuse varies, «that way we save the fee», «my account is only a personal one», «I will give you a discount if you send it that way», but the aim is always the same, to get the money out through the door PayPal does not watch. One variant is to ask you, after paying for goods and services, to mark the order as received before it arrives, which closes the protection with the same effect.
That PayPal will not refund a personal payment does not mean the money is unrecoverable in law. It means the platform will not do it for you. Inducing you to tick that box is part of the deception and is described as such in the complaint. If the PayPal account was funded by a card, there is also a chargeback against your bank, a route separate from PayPal that does not depend on how the transfer was labelled. How that claim is framed is our work, and I set out the logic of these refunds in this article on bank refunds after phishing.
The three situations people mix up
Under «I was scammed on PayPal» sit three legally distinct problems, each with a different party responsible.
The first is the account emptied without permission. Someone got into your PayPal, using a password obtained by phishing or through a compromised device, and ordered payments you never authorised. PayPal (Europe) S.à r.l. et Cie, S.C.A. is a payment institution licensed in Luxembourg and operating in Spain, and it must answer for transactions the account holder did not authorise. The argument that always arises is whether the user was negligent, and that is where the outcome turns on how the case is put. The same rules govern banks, and I explain them in the article linked above.
The second is the buyer who paid and received nothing, or received something different. If you paid for goods and services, Buyer Protection covers the case within its 180 days. If the seller was a business, the consolidated text of the General Law for the Defence of Consumers and Users (Royal Legislative Decree 1/2007) also applies, with the fourteen calendar day right of withdrawal for distance purchases (article 102) and the rules on lack of conformity, with a three year legal guarantee from delivery (article 120). If the seller was a private individual selling through a listing, there is no right of withdrawal and the Civil Code governs. And if there was never any intention to deliver anything, the civil relationship is a fiction and what you have is fraud.
The third is the deceived seller. He receives an email that looks like it comes from PayPal saying the payment is on hold until he sends a tracking number, or a buyer overpays and asks for the difference to be returned to another account, or the buyer disputes the charge with his bank after receiving the item. The seller loses both the goods and the money. Here PayPal Seller Protection requires proof of shipment to the address shown in the transaction, and anyone who shipped elsewhere because the buyer asked him to is outside it.
What PayPal scams look like
Phishing remains the most common entry point. An email or text message warns of «unusual activity» or a «limitation on your account» and leads to a cloned page where the user hands over his password. With it the scammer orders payments, links another card or changes the email on the account. The mechanics are identical to bank impersonation, which I describe in this article.
Fake invoices and money requests have a feature that confuses many people, which is that they arrive through PayPal’s real system. The scammer opens an account, issues a payment request for a product you never bought and adds a «support» telephone number for you to call. When you call, the supposed technician asks you to install remote control software or walks you through «cancelling» the charge, which in fact means paying it. A payment request you do not recognise should be ignored and deleted, never paid and never followed up by calling the number shown on it.
Overpayments and fake refunds target the seller. The buyer pays more than agreed, claims a mistake and asks for the excess to be returned by bank transfer or to a different PayPal account. The original payment then turns out to be unauthorised or made with a stolen card, PayPal reverses it and the seller is left without the excess he returned and without the product.
Fake technical support combines all of the above with a phone call. In the more elaborate versions the scammer opens with real account details obtained from an earlier data breach, and with a manipulated voice or video.
What the Criminal Code says and with what penalties
Article 248 of the Spanish Criminal Code, as worded by Organic Law 14/2022, punishes as fraud anyone who, for gain, uses sufficient deception to cause another to err and induces him to make a disposal of property to his own or another’s detriment. The seller who takes payment and ships nothing, the fake technician who guides you through «cancelling» a charge, the buyer who has an overpayment refunded that never existed, all fit that description.
Article 249 covers computer fraud, committed through computer manipulation or a similar device to obtain an unconsented transfer of assets. It is the offence that applies when someone enters your PayPal account and orders payments from it. That access, on its own, also falls under article 197 bis, which punishes with six months to two years in prison anyone who accesses another person’s computer system without authorisation.
The penalties under article 249 are six months to three years in prison where the amount defrauded exceeds 400 euros, and a fine of one to three months where it does not, which is the minor offence case. Article 250 raises the penalty to one to six years in prison and a fine of six to twelve months where certain circumstances apply, among them a loss exceeding 50,000 euros or a fraud affecting a large number of people, which happens often when a single fake shop or a single listing has deceived dozens of buyers across different provinces.
Alongside the penalty, criminal proceedings allow the civil liability arising from the offence to be claimed (articles 109 and following of the Criminal Code), so the return of the money is sought within the same case without a separate civil action against the convicted person.
What a criminal complaint achieves and where to file it
The complaint is filed with the National Police, the Civil Guard or directly at the investigating court. As to which court investigates, the Second Chamber of the Supreme Court has applied, since its non-jurisdictional plenary agreement of 3 February 2005, the ubiquity doctrine, under which the offence is deemed committed in every place where any element of it took place. In practice, a resident of A Coruña defrauded by someone operating from another province or from abroad can file here, because the deception happened here and the money left from here.
What a complaint achieves, and what no PayPal dispute can, is that a judge orders PayPal to disclose the identity of the holder of the receiving account, the IP addresses, the devices used and the bank to which the funds were withdrawn. If the money is still in transit, the court can order it frozen. The complaint also serves as evidence before PayPal and before the bank, and allows your case to be joined with those of other victims of the same fraudster, which changes the classification of the offence and the attention the investigation receives.
Whether it is worth reporting a small amount has a simple answer. Yes, because PayPal scams are committed at scale and your complaint over 80 euros may be the one that allows another forty victims to be added to the file, and because without a complaint the routes that depend on it stay closed.
What to keep from the first minute
Evidence of online fraud disappears quickly, sometimes because the scammer deletes the listing and the account and sometimes because the victim, in the anger of the moment, deletes the conversation. Before anything else, keep the following.
The PayPal transaction ID and a full screenshot of the payment details showing the date, the amount, the recipient and, above all, whether it was sent as goods and services or as a personal payment. The listing, the shop or the seller’s profile, with its web address, dated screenshots and any contact details shown. Every conversation, kept in the app where it took place and with nothing deleted, because an isolated screenshot is worth less than the complete exported thread. The emails received, with their headers, both the genuine ones from PayPal and those imitating PayPal. The card or linked bank account statement. If there was unauthorised access, the list of logins and devices PayPal shows in the account settings, captured before the scammer alters it. Which of these ends up deciding the case is something I discuss in this article on electronic evidence.
There are also three things to do in the first hours. If the account has been compromised, change the password, switch on two-step verification and check the email addresses and phone numbers linked to it, because the usual method is to add a secondary email in order to regain control later. Tell the bank that issued the linked card or holds the linked account, without waiting to hear from PayPal. And pay nothing further to anyone, no «release fees», no «customs charges», no «verifications», because the second request for money is the same fraud continuing.
When PayPal says no
Every article in circulation on this subject ends at the PayPal Resolution Centre, as if a dispute closed in the seller’s favour were the end. It is not.
Buyer Protection and the duty to refund unauthorised transactions are different things and are claimed differently. The first is a term of the contract you accepted with PayPal, and like any contractual term it can be enforced in court if the platform applies it wrongly. The second is a legal duty that does not depend on PayPal’s terms and is pursued by a different route. Which route suits each case, and with what arguments, is decided with the transaction records in hand. For amounts up to 15,000 euros the civil route is the verbal procedure, whose threshold was set by Royal Decree-Law 6/2023, in force since 20 March 2024, and since Organic Law 1/2025 a prior attempt at settlement must be evidenced before the claim is filed.
Running in parallel to that is the chargeback against your bank where the payment came from a card linked to PayPal. These are independent claims, on different legal grounds, and they can be pursued at the same time. The order in which they are raised, the argument against an allegation of negligence and what is asked of each party are strategic decisions that depend on the case and that we assess at the firm with the documents in front of us.
The question of who to claim against therefore has three simultaneous answers. Against the fraudster, through the criminal courts and with civil liability claimed within the case. Against PayPal, if there was an unauthorised transaction or if it misapplied its own protection. Against the bank, for a chargeback if you paid by card. None of these rules out the others.
What happens when the case is shelved
It is common for a complaint to end in an order provisionally staying proceedings because the perpetrator has not been identified (article 641 of the Criminal Procedure Act). That is not an acquittal and closes nothing definitively. The case can be reopened if new information emerges, and it often does when another court identifies the same person in another fraud. Meanwhile, the criminal stay has no effect on the claim against PayPal or the chargeback against the bank, which continue on their course, and it does not close the five year civil action either.
If the money passed through your account
There is a risk almost nobody warns about. Anyone who agrees to receive a payment from a stranger into his PayPal in order to forward it to another account for a commission is acting as a money mule, and article 301 of the Criminal Code punishes money laundering with six months to six years in prison, with a negligent form in its third paragraph punished with six months to two years in prison and a fine. Anyone who has received an unexpected payment together with a request to return it to a different account, or who has accepted a «job» consisting of moving money, needs to take advice before touching that money, not afterwards.
What to bring to the firm
To assess a case we need the transaction details with the ID, the history of any PayPal dispute and its outcome, the complete conversations, the emails with headers, the linked card or account statement, the police report if already filed and, if the account was compromised, the login record. With that, a first reading tells us which route has mileage and which does not.
At the firm we handle fraud committed through payment platforms both in the criminal courts and in claims against the institution and the bank. If you have been scammed on PayPal, you can visit our cybercrime page or get in touch so that we can review your case.
Preguntas frecuentes
Can I get the money back if I sent it as friends and family or is there nothing to be done?
Not through PayPal, because that type of transfer is excluded from Buyer Protection under the service’s own terms. Outside PayPal there are routes. Inducing you to pay that way is part of the fraud under article 248 of the Spanish Criminal Code, and with a complaint the court can identify the holder of the receiving account. If the money came from a linked card, a chargeback against your bank is also available.
What do I do if PayPal has closed the dispute in the seller’s favour?
The Resolution Centre’s decision is not the last word. There is a formal complaint to PayPal, then to the supervisor that oversees it and, if necessary, to the court, because Buyer Protection is an enforceable contractual term. In parallel you can ask your bank for a chargeback if you paid by card and file a criminal complaint for the fraud. It is worth gathering the complete dispute history before taking the next step.
Is it worth reporting if the amount is small?
Yes. Below 400 euros the fraud is a minor offence, but these scams are committed at scale and your complaint can be joined with those of other victims of the same fraudster, which aggravates the offence and changes the investigation. The complaint is also what allows the court to ask PayPal for the recipient’s identity and serves as evidence before PayPal and before the bank.
Who do I claim against, the fraudster, PayPal or my bank?
All three at once, because they are independent claims. The fraudster is prosecuted in the criminal courts and the refund is claimed within the same case. PayPal is claimed against if there was an unauthorised transaction or if it misapplied its own protection. The bank is asked for a chargeback if the payment came from a linked card. None of these routes rules out the others.