The text message impersonating the Social Security gives you a few hours to renew your health card before it is cancelled, and that deadline is false. The one that is genuinely running started on the day the first charge you did not order appeared in your account, and it is the period that payment services law gives you to tell the bank that the transaction was not yours. It runs from the charge, not from the day you realise you have been defrauded, and once it expires the bank is no longer obliged to refund anything, however obvious the fraud. Anyone who typed their card into the fake site weeks ago and has not looked at their statement since has that period ticking away without knowing it. On top of that there is the limitation period for the offence, which is measured in years and is not the pressing one, and the practical window for the bank to attempt a card chargeback, which is shorter and is set by the rules of the card system itself.
What the message looks like and how the fraud works
The pattern repeats with few variations. A text arrives, sometimes in the same thread as legitimate messages because the sender shows as a name rather than a number, telling you that your health card has expired or is about to and that you must renew it through a link. The link opens a page that copies the look of the official portal, with its logo and colours, and asks for your name, ID number, Social Security affiliation number and address. Then a small charge appears, one or two euros, presented as issuing or postage costs for the new card, for which you must enter your bank card number, expiry date and security code. In some versions a final screen asks for the code your bank has just sent you to “confirm the renewal”.
The small amount is the deliberate part. Nobody argues over two euros, and those two euros serve to confirm the card is live and to capture all of its details. The money goes later, through purchases and charges made by the fraudsters with that card, sometimes the same day and sometimes weeks afterwards, when the message has been forgotten. If you also typed in the confirmation code, you handed them the key to authorise one of those charges.
Variants of the same mechanism replace the expired card with a benefit awaiting payment, a refund of contributions or a debt with surcharge. The preferred target is whoever uses the health card most and deals most with the Social Security, pensioners and the self-employed, although the messages are sent in bulk and reach anyone. INCIBE, Spain’s national cybersecurity institute, and the General Treasury of the Social Security itself have published warnings about these campaigns.
Why it looks genuine
The physical health card carries an expiry date and many people are carrying an expired one, so the message matches something the recipient already suspected. The page imitates the official portal well. The charge is small, as a fee would be. The spoofed sender places the text next to genuine messages you have received from public bodies. None of those signs proves anything, and the reliable check lies in what the Social Security does and does not do.
What the Social Security never does
The Social Security, which here is the impersonated body, does not send text messages with a payment link. It does not ask for bank card details to renew any document. It does not notify debts, surcharges, refunds or benefits by text message with a payment button. Notifications from the administration arrive through the legal channels, the official electronic office, the post or in person, and a refund is paid into the account on file without anyone having to type in a card.
There is a further fact that dismantles the message. The health card you show at the health centre is issued by the health service of your autonomous community, in Galicia the Sergas, and the Social Security neither renews it nor charges for it. If you have doubts about a benefit or a debt, type the address of the official electronic office into your browser yourself, without going through the link in the text, and log in there. Whatever does not appear in your file does not exist.
Which offence it is and what the penalty is
Whoever sends this text commits fraud under article 248 of the Spanish Criminal Code. There is sufficient deception, the expired card, which causes an error in the victim and an act of disposal of property, the payment and the handing over of data, to her detriment. The penalty is imprisonment of six months to three years. If the amount defrauded does not exceed 400 euros, it is a minor offence punishable by a fine.
That 400 euro threshold is misleading if you look only at the initial charge. The two euros of the supposed renewal are not the whole loss. The later charges made with your details are also fraud and are added together, and the fact that the perpetrators run the same campaign against thousands of people weighs on the legal classification. The bank, moreover, is indifferent to the amount when it comes to its obligation to refund an unauthorised transaction.
As for where to report it, you can do so at any National Police station or Civil Guard post, in A Coruña or wherever you live, and also before the duty court. In online fraud the investigation tends to be concentrated in the court of the place where you received the deception and hold your account, regardless of where the perpetrators are. The offence does become time-barred, but that period is measured in years and is not the one that should worry you this week.
What to do right now
If you have only received the message, do not click the link, do not reply and do not delete it. Take a screenshot showing the sender, the date and the full text. That text is evidence and serves for the police report and for the notice to INCIBE, which runs a citizen helpline for these cases.
If you opened the page and entered your card, call the bank on the number printed on the back of the card or shown in the official app, never on one that appears in the text or in a later call, and ask for an immediate block. Go through the movements of that day and the following ones, including pending charges, and note down every one you do not recognise. Keep the screenshot of the text, the address of the fake page if it is still in your history, any screenshots of the page you took and the statement with the charges. Report it with all of that. Change your online banking password if you used the same one at any point.
Two things you must not do. Do not deal with anyone who calls you in the following days claiming to be from the bank or the Social Security to “help” with the fraud, because with the details they already hold that second call is very convincing and that is where the large sums are lost. And do not sign any document at the branch in which you acknowledge having provided your details voluntarily or negligently without it first being read by someone who knows what that paper means for your claim.
If you gave your ID and affiliation number but did not reach the payment screen, no money has been taken, but they have your identity. With it they may try to take out contracts in your name or prepare a bank impersonation call. Report it anyway, so that there is a dated record, and watch your post and your account for the following months.
Recovering the money, two charges that are not the same
There are two kinds of charge on your statement and they are not claimed in the same way. The payment for the supposed renewal was ordered by you, with your card, on a site you believed to be official. Legally it is an authorised payment made under deception, and the legal refund obligation that payment services law places on the bank does not cover that charge, because the bank executed what you ordered. What is available against the bank is a card chargeback, a mechanism that depends on the rules of the card system and has to be requested properly and in time. Against the perpetrators, the route is criminal.
The later charges, the ones the fraudsters made with your details, are different. You did not order them, so they are unauthorised transactions and the bank is under a legal obligation to refund them, subject to the notification period that is already running from the moment they appeared in your account. If one of those charges was confirmed with the code you typed into the fake site, the bank will plead gross negligence to avoid refunding it, and that is the ground on which the claim is won or lost depending on how it is framed. I have covered it in bank refunds after phishing and in what to do after a bank impersonation scam.
| Charge | Who ordered it | What is available |
|---|---|---|
| Small payment for the supposed renewal on the fake site | You, under deception | Authorised payment made under deception. Card chargeback and criminal claim against the perpetrators |
| Later charges made with the captured details | The fraudsters | Unauthorised transaction. Legal refund obligation on the bank, with a notification period running from the charge |
| Charge confirmed with the code you typed into the fake site | The fraudsters, using a code of yours | Unauthorised transaction, but the bank will plead gross negligence and the claim needs to be framed with care |
How that claim to the bank is put together, with which documents, in what order and on what grounds, is the lawyer’s job. At the firm, when someone arrives at this point, we go through it charge by charge, settle what is claimed from the bank and what goes into the police report, and handle it as part of our work in cybercrime.
What happens if the criminal case is shelved
It is common. The perpetrators operate from abroad, with numbers and pages that last hours, and the court ends up ordering a provisional dismissal for want of a known perpetrator. That closes nothing that matters to you. The claim against the bank is independent of the criminal proceedings and remains alive. The report stays in the system and, if the perpetrators are later identified in another investigation, your case is reopened and joined to it. The provisional dismissal does not prevent you from bringing a prosecution either if those responsible surface.
Doing it on your own carries a specific risk. The bank usually replies with a form and a standard refusal on grounds of negligence, and whoever accepts it or lets the notification period lapse loses the refund of charges the law recognised as theirs. At the firm we review the movements, distinguish which charges can be claimed from the bank and which go down the criminal route, file the claim and the report and, if necessary, take your case to court, within our cybercrime practice. You can call +34 677 841 007 or write through contact. When you call, have to hand the screenshot of the text with sender and date, the statement with the charges marked, the date and time you blocked the card and the bank’s written reply if you already have it.
Frequently asked questions
Can I get my money back if I was the one who paid on the fake site?
The payment you ordered is an authorised payment made under deception and the bank is not obliged by payment services law to refund it, but a card chargeback exists and the perpetrators can be pursued through the criminal courts. The charges the fraudsters made afterwards with your details are unauthorised transactions and the bank is under a legal obligation to refund them if they are notified in time.
I gave my ID and affiliation number but not my card, what do I do?
No money has been taken, but they have your identity and can use it to take out contracts in your name or to make a very convincing bank impersonation call. Report it so there is a dated record, watch your account and your post for months and distrust any later call that knows those details.
How do I know whether I really owe a debt or have a pending benefit with the Social Security?
By logging in yourself to the official electronic office, typing the address into your browser without using the link in the text. Whatever does not appear in your file does not exist. The Social Security does not notify debts or refunds by text with a payment link and the health card is renewed by the regional health service.
Is it worth hiring a lawyer for a two euro scam?
If the loss stopped at the initial payment and the bank blocked the card before any further charges, it is not worth it, reporting it and keeping the paperwork is enough. It is worth it when there are later charges the bank refuses to refund on grounds of negligence, because there the amount is usually larger and a properly framed claim has a real prospect of success.