The civil action to demand from Santander the money that left your account without your authorisation is time-barred after five years, under article 1964 of the Spanish Civil Code, and that period runs from the day you were able to claim, which in practice is the day you saw the charges. The offence of computer fraud committed against you is time-barred after five years from commission where the maximum sentence does not exceed three years’ imprisonment, and after ten years where the amount makes it aggravated fraud. With those margins, nobody loses the right by arriving late at court. The problem lies elsewhere. Payment services legislation sets its own, considerably shorter, period for notifying the bank that the transaction was not yours, and whether the refund can be demanded as a legal obligation or has to be fought for as damages depends on meeting it. Which period applies in your case and how you prove you met it is the first thing we review at the firm when someone comes in with this problem.
If what you need is to know whether the message on your phone is from the bank or not, that is covered in bank impersonation scams, what to do. This article starts afterwards, with the money already gone.
What happened to you has a name in the Criminal Code
The link in the text took you to a page imitating Santander’s. You entered your username and password, probably also a signing key or a code sent to your phone, and with that data someone ordered transfers, Bizum payments or card payments from your account. That is computer fraud under article 248.2.a) of the Spanish Criminal Code, which punishes anyone who, for gain and by means of computer manipulation or a similar device, obtains an unconsented transfer of any asset to the detriment of another. The prior deception of you does not alter the classification, it reinforces it.
The penalty is set by article 249. Where the amount defrauded exceeds 400 euros, imprisonment of six months to three years. Below that figure it is a minor offence punishable by a fine. Where the loss exceeds 50,000 euros, article 250 applies and the sentence rises to between one and six years’ imprisonment plus a fine, and above 250,000 euros to between four and eight years. If they installed something on your phone or altered data on the device in order to do it, the offence of computer damage under article 264 may be added, and if they accessed your online banking with the stolen credentials, unlawful access to systems may also apply.
| Scenario | Provision | Penalty | Limitation period for the offence |
|---|---|---|---|
| Computer fraud up to 400 euros | Arts. 248.2.a) and 249 CC | Fine of one to three months | One year |
| Computer fraud above 400 euros | Arts. 248.2.a) and 249 CC | Six months to three years’ imprisonment | Five years |
| Fraud above 50,000 euros | Art. 250.1.5 CC | One to six years’ imprisonment and a fine | Ten years |
| Fraud above 250,000 euros | Art. 250.2 CC | Four to eight years’ imprisonment and a fine | Ten years |
| Receiving and forwarding the money without knowing its origin | Art. 301.3 CC (negligent money laundering) | Six months to two years’ imprisonment and a fine | Five years |
The last row is not for you as the victim but for the person whose account received your money. I explain it further down because sometimes that person is an acquaintance, and sometimes it is the victim themselves, used by the same gang in a second phase.
The first hours matter more than the lawsuit
Money sent by instant transfer or Bizum takes seconds to arrive and minutes to leave again towards another account. What you do in the two or three hours after noticing weighs more than any legal argument later.
Call Santander on the number printed on the back of your card or on the official website, never on the one in the text, and ask them to block cards, online banking and any pending transactions. The bank can attempt to recall transfers not yet settled at the receiving institution, and that only works if requested immediately. Note the time of the call and the name or number of the operator who dealt with you.
Do not delete anything. Not the text, not the browser history, not any later messages or calls you received. Take a screenshot of the full message thread with date and time visible, because if the fake text appears in the same thread as Santander’s genuine messages, that fact is relevant to the claim and disappears the moment you change phones or restore the device. Santander maintains an address for forwarding suspicious emails, «phishing@gruposantander.es», and it is worth using, but it does not replace formal notification to the bank that the transaction was not yours.
Do not change your passwords from the same phone on which you clicked the link until you are sure nothing has been installed. If the link asked you to download an app or showed you a screen you do not recognise, the phone is both evidence and a risk. Keep it switched off or in flight mode and use another device for everything else.
File a report with the Policía Nacional or the Guardia Civil with the statements showing the charges. You can report at your local station even if the money ended up in an account in another province or another country. Ask for a stamped copy, because you will need it against the bank.
At the firm, when someone calls us that same day, the first thing we do is put the notification to the bank in writing and secure the evidence on the phone and in the statements before it is lost. That is part of the work we do in cybercrime and banking fraud.
The bank is obliged to refund, with one exception it will try to apply
Payment services legislation requires the bank to refund the amount of transactions the customer did not authorise. That is the rule. The exception is where the bank proves the customer acted with gross negligence or fraudulently, and in fake text cases Santander invokes that exception with a formula repeated in almost every response we have seen. It says the transaction was correctly authenticated with the customer’s personal credentials and the code sent to their phone, and that handing those credentials to a third party is gross negligence.
The bank saying so does not make it so. Gross negligence is a concept shaped by the Bank of Spain in its criteria on phishing and smishing complaints, by the provincial courts in litigation against this and other banks, and by the Supreme Court, which in 2025 characterised the bank’s liability for unauthorised transactions as quasi-strict. What matters is when the code was given, what the screen said when it was given, whether the fake message sat in the bank’s genuine thread, whether the transaction fitted the customer’s usual profile and whether the bank had the means to detect the pattern and did not activate them. There are also cases in which the courts have sided with the bank, usually where the customer gave several successive codes over the phone despite the bank’s own message warning not to share them, or signed transactions whose details were in front of them.
How that claim is presented, what is said and what is not, and in which forum it is brought is the lawyer’s work, and it is where the case is won or lost. In bank refunds after phishing I set out the general framework without reference to any particular bank, and the specifics of instant payments are in Bizum scams, what to do.
The police report, the court and what happens when the case is shelved
Reporting is not a legal requirement for claiming against the bank, but in practice Santander asks for it and the courts take note of its absence. It also opens the only route to identifying the holder of the destination account and tracing the money, because only a judge can order that.
Territorial jurisdiction in these frauds is resolved by what is known as the ubiquity doctrine. The offence is deemed committed both where the deception takes place and where the loss materialises, which allows the court of the place where you hold the account, in our case A Coruña, to investigate even if the perpetrator is in Madrid or outside Spain. It is worth insisting on this, because an investigation close to the victim makes it easier to join the proceedings and follow them.
The usual outcome, however, is that the case ends in a provisional dismissal because the perpetrator has not been identified. Destination accounts belong to intermediaries or sit with foreign institutions that do not reply, and the court shelves the file. That dismissal does not affect your right against Santander. The obligation to refund arises from payment services legislation and the account contract, not from the conviction of the fraudster, and it can be enforced with the criminal case shelved. If the case continues and the holder of the receiving account is identified, civil liability can be sought in the same proceedings alongside the sentence and, in some situations, the bank’s liability as a civilly responsible party. Which route is appropriate depends on the amount, on what the bank has replied and on what the phone shows.
If the money ended up in an acquaintance’s account, or in yours
Gangs operating with fake texts need accounts in Spain to receive money and get it out. They obtain them through easy-job adverts, offers to «handle payments» for a commission, or by asking the victim themselves, in a second call, to «move the money to a safe account». Whoever receives those transfers and forwards them or withdraws them in cash is liable for money laundering. If they knew what they were doing, for intentional laundering, with six months to six years’ imprisonment under article 301.1. If they did not know but should have suspected, for negligent laundering under article 301.3, with six months to two years’ imprisonment and a fine.
This matters for two reasons. If you recognise the holder of the receiving account, they may be a deceived individual against whom, nonetheless, action can be taken to recover the money. And if you yourself, after the first drain, followed the instructions of whoever called claiming to be from Santander and moved funds, you are on both sides of the file at once. In that case the criminal defence has to be conducted from day one, not when the summons arrives.
What you risk by doing it alone
The specific risk of claiming without a lawyer in this kind of fraud is accepting the bank’s account of events. The customer who receives Santander’s letter saying they handed over the credentials usually writes the money off, or replies on their own admitting facts later used to classify their conduct as gross negligence. The second is worse than the first, because it turns a viable claim into a lost one.
At the firm, in a case like this, we secure the evidence on the phone and the notification to the bank, bring the claim in the forum that fits the amount and the response received, and conduct the prosecution in the criminal case where identifying the perpetrator or the recipient of the money makes it useful. You can call us on +34 677 841 007 or write through the contact page, and you will find what we do in this area under cybercrime and banking fraud.
When you call, have to hand the statement showing the charges and their dates, the screenshot of the text thread, the time of your call to the bank and what you were told, the stamped copy of the police report if already filed and, if Santander has replied to you in writing, that reply in full. With that, a first opinion can be given on the same call.
Frequently asked questions
I clicked the link in a fake Santander text and my account was emptied, does the bank have to refund me?
As a rule, yes. Payment services legislation obliges the bank to refund transactions the customer did not authorise, and clicking a link is not authorising a transfer. The bank only escapes liability if it proves you acted with gross negligence, and that depends on the specific circumstances, not on the fact that credentials were entered.
Do I have to report to the police before claiming against Santander?
It is not a legal requirement, but it is advisable to do it the same day. The bank asks for it, the courts take note of whether it exists and it is the only route for a judge to identify the destination account and order measures over the money. You can report at your local station even if the money went to another province or country.
Santander has replied that I gave the code and will not refund anything, what do I do?
Do not reply admitting facts and do not write the matter off. That response is the bank’s standard one and does not close the claim. Keep the full letter, do not wipe the phone and consult a lawyer before writing anything, because what you say in that reply will be used later.
Is it worth claiming with a lawyer or better to let it go?
It depends on the amount and on what happened. Below a few hundred euros, or if the bank has already refunded most of it, the lawyer’s cost may exceed what is recovered, and in that case I will tell you so. Above that figure, and especially if the bank alleges gross negligence or if you moved funds after the first charge, claiming with a lawyer is the difference between recovering the money and absorbing the loss.