Until 12 January 2023 the Spanish Criminal Code placed under a single provision, article 248, both classic fraud, committed by deceiving a person so that she disposes of her own money, and computer fraud, in which the offender manipulates the system without deceiving anyone. Organic Law 14/2022 separated the two offences, and since that date article 248 punishes fraud by sufficient deception with six months to three years in prison, or a fine where the amount defrauded does not exceed 400 euros, while the forms in which the offender operates directly with captured credentials or card data moved to article 249, carrying the same penalty.
For anyone receiving a text or a call impersonating Revolut the distinction has consequences. If you, believing you were speaking to the bank, made the transfer or read out the code, the facts fall under article 248. If what happened is that your credentials were captured on a fake website and the account was emptied without you lifting a finger, it falls under article 249. The penalty does not change, but the way the facts are described in the complaint does, and above all so does the later discussion with the bank about whether the transaction was authorised. Revolut is the impersonated institution here and in no sense the author of the fraud.
How to recognise the text or the call
The pattern repeats with few variations. A message warns that the account has been blocked for security reasons, that there is a charge you do not recognise or that someone has logged in from a new device, and asks you to verify your identity through a link. The link is usually shortened or points to a domain that resembles the official one but is not. When opened it shows a screen imitating the app and asks for username, password and, next, the code that has just arrived by text.
In the telephone version someone presenting himself as a member of the fraud department tells you suspicious transactions are under way and immediate action is needed. From there he will ask for the confirmation code «to cancel the charge», suggest moving your balance to a «safe account» or walk you through installing an application that gives the caller remote control of your phone. The call often comes minutes after the text, so each appears to confirm the other.
Why it looks genuine
The scammer knows your name, sometimes the last digits of your card, and the text appears in the same thread as legitimate messages because the alphanumeric sender can be spoofed. The calling number can match an official one for the same reason. That data circulates through third-party leaks, purchased lists or forms you filled in elsewhere. Urgency does the rest. Someone who believes his account is being emptied at that very moment does not check domains or hang up to call back on his own.
What no bank ever does
This applies to Revolut and to any bank operating in Spain. No institution asks by phone, text or email for your full password, your PIN or the one-time code you have just received. Nor will it suggest moving your money to another account to protect it, nor tell you to install a remote-access application or read aloud what appears on your screen. The link to «verify your identity» outside the official app does not exist. If the conversation goes down any of those paths, it is the scam.
What to do right now
If you have only received the message, do not click the link, do not reply and do not call the number it contains. If you want to check whether something is wrong with your account, do so from the official app or by calling the number printed on the back of your card. Keep the text with the date and sender visible, because it may later be necessary to prove how it all started.
If you have already entered data or given a code, the order matters. Block the card and change the password from the app, and if the phone is compromised because you installed an application at the caller’s request, switch it off and use another device. Then report the transaction to the bank through the in-app chat without waiting to have every detail, because every passing hour reduces the chances of freezing the money before it leaves the destination account. Take screenshots of the entire chat conversation, of the unrecognised transactions and of any message or call received. File a criminal complaint. The complaint fixes the date of the facts and is the document the bank will ask you for.
Do not delete anything, do not wipe the phone and do not accept through the chat a closure of the matter you do not understand. If you receive another call from «security» to complete the process, it is the same organisation finishing the job.
If you have already given the credentials or made the payment
The fact that you typed the code or ordered the transfer does not mean the transaction was authorised in the sense the law uses. Payment services legislation obliges the bank to refund transactions the customer did not authorise, and an authorisation extracted by deception is precisely what is in dispute in these cases. Revolut is an institution holding a banking licence in the European Union and operating in Spain, and that legislation applies to it exactly as it does to any bank based here.
The bank may object on the ground that the customer acted with gross negligence, and that is the ground on which the claim is decided. Who has to prove what, with which documents and at what point is the technical part of the matter, and it is the part that gets ruined when raised without judgment in a chat. At the firm we practise in cybercrime and conduct claims against payment institutions, and the first thing we do in a case like this is fix the account of the facts before the chat’s automated reply fixes it for you. You can see how we work in cybercrime. On what the bank is obliged to refund I wrote in more detail in bank refund after phishing and in bank impersonation scam, what to do.
Complaint, jurisdiction and limitation
The complaint is filed with the National Police, the Guardia Civil or the duty court. You do not have to find out where the scammer is. In fraud committed remotely the courts assume jurisdiction in the place where the victim made the disposal or holds the account, so if you live in A Coruña the case is handled here.
| Conduct | Criminal Code article | Penalty | Limitation period |
|---|---|---|---|
| Fraud by deception with loss above 400 euros | 248 | Six months to three years in prison | Five years |
| Fraud by deception with loss up to 400 euros | 248, as a minor offence | Fine of one to three months | One year |
| Operating the account or card with captured credentials | 249 | The same as fraud under article 248 | Five years |
| Lending one’s account to receive and forward the victim’s money | 301, money laundering | Six months to six years in prison plus a fine; six months to two years where committed negligently | Ten years, or five in the negligent form |
Most of these cases are provisionally closed because the actual perpetrator is not identified or is beyond the reach of the Spanish courts. That closure does not affect your claim against the bank, which is independent and rests on payment services legislation, not on anyone being convicted. It does matter that the complaint is properly drafted from the outset, because an imprecise account of how the code was given or the transfer ordered turns against you when the bank reads it.
If the money passed through your account
Some people discover that their account has been used to receive and forward another victim’s money, either because they gave out their credentials or because they accepted a «task» in exchange for a commission. The bank blocks the account and the police summon them as a suspect for the offence of money laundering under article 301 of the Criminal Code, which is also punishable when committed through gross negligence. If you receive a summons of that kind, do not give a statement without a lawyer. The difference between victim and money mule is decided in that first statement.
What is at stake if you do it alone
The specific risk in this matter lies in the chat. A poorly given explanation in the first hours, acceptance of a rejection that looks final, or a complaint describing the facts in a way that fits gross negligence closes the recovery route before it begins. At the firm we report the transaction to the bank, prepare the complaint with the correct account of the facts and conduct the claim out of court and, if necessary, in court. Call +34 677 841 007 or write to us through contact. Have to hand the screenshots of the text and of the chat conversation, the statement showing the unrecognised transactions, the date and time of the call if there was one, and the complaint if you have already filed it.
Frequently asked questions
I clicked the link in the Revolut text and entered my details, what do I do right now?
Block the card and change the password from the official app, not from the link. If you installed any application during the call, switch that phone off and use another device. Report what happened through the in-app chat and keep screenshots of the whole conversation. Then file a criminal complaint. Do not delete the text or the call log, because they are the evidence of how the deception began.
If I made the transfer myself or gave the code because I was deceived, does Revolut have to refund me?
It depends on whether the transaction counts as authorised, and typing a code under deception does not settle that question. Payment services legislation requires unauthorised transactions to be refunded and the bank can only object by alleging gross negligence on the customer’s part. How each point is proved is what decides the outcome, and that is the lawyer’s job.
Is there any point in filing a complaint if the scammer is in another country?
Yes. The complaint is filed where you live, the local courts assume jurisdiction and you need the document for the claim against the bank. Even if the criminal case ends up closed because the perpetrator is not identified, the claim for the money continues through a different route.
Is it worth claiming, and do I need a lawyer for this?
If the bank has already refunded the amount through the chat, no. If the sum is small and the transaction was a purchase you confirmed yourself with correct details, it is usually not worth it either. If your claim has been rejected or the amount is significant, yes, because the dispute over gross negligence is technical and a poor initial explanation cannot be corrected later.