Whoever discovers that they cannot withdraw the money from their «investment account» writes first to the adviser who recruited them, then to the platform’s support desk and, when neither answers, to the CNMV, the Spanish securities regulator. None of the three will give anything back. A stock market investment scam is an offence of fraud under article 248 of the Spanish Criminal Code, almost always aggravated under article 250, and the money, which never passed through any market, sits today in a third party’s bank account. The only ones who can act on that account are the bank that executed your transfer, the bank that received it and the investigating court, which can order it frozen as a precautionary measure.
The adviser and the platform are the perpetrators, and asking them for a withdrawal only prompts an offer to release it in exchange for a further payment described as «tax» or «exit fee». The CNMV supervises the firms it has authorised and publicly warns about those it has not, but Law 6/2023 of 17 March on Securities Markets and Investment Services gives it no power whatsoever to recover an individual’s money. Its warning serves as evidence in the criminal complaint and that is where its usefulness to the victim ends. What follows is the criminal classification of what happened, what each route can achieve and what you can get done today so as not to lose evidence or more money.
Statements, chats and the computer, what to keep from today
Cut the channel. Stop taking the adviser’s calls and do not execute any further operation on the platform, even if it is presented as the last one needed to release the balance. If you installed a remote access programme at the adviser’s request, such as AnyDesk or TeamViewer, uninstall it and change your online banking and email passwords from another device. That access may also amount to the separate offence of unlawful access to computer systems.
Keep everything. The WhatsApp or Telegram conversations with the adviser, exported with dates and including voice notes. The emails with the platform. Screenshots of the investment account showing the supposed profits and the message blocking withdrawal. The exact web address, before it disappears. The receipt for every transfer with the beneficiary’s name and destination IBAN and, if you paid by card or bought cryptocurrency on the adviser’s instructions, the records of those operations. The advertisement or fake news item that led you to the initial form, if you can find it. That material is what proves the deceit, identifies the destination accounts and fixes the amount defrauded, which is what determines the penalty.
Notify your bank, in writing and dated, that the transfers were the result of a scam. The formal claim should be prepared with advice, but that notification records the moment you learned what had happened. And do not sign or send anything the platform asks for from now on, neither declarations that you traded at your own risk nor authorisations to convert funds into cryptocurrency.
The fake adviser, the platform and the destination account
The scheme varies little. An advertisement on social media, sometimes using the image of a well-known businessman or journalist, leads to a form where the reader leaves a phone number. A well-prepared «adviser» calls, proposes starting with two hundred or two hundred and fifty euros and opens an account on a platform that looks like a broker, with real-time charts and a growing balance. It often allows a small first withdrawal, which genuinely arrives, and from there the deposits increase with daily calls over several weeks. When the client asks to withdraw a significant sum, out come the tax withholding that must be paid up front, the verification that requires a deposit, the exit fee and, finally, silence.
The screen the client sees is an interface showing figures the scammer types in, with no real positions behind them. The transfers have gone to accounts held by private individuals or shell companies, frequently in other European Union countries, and from there the money has been moved on or converted into cryptocurrency within hours. That chain is what matters for recovery, because every link has an identifiable holder and a bank that received the money.
There are variants. In so-called «pig butchering» the relationship begins on a dating app or with an apparently misdirected message, and the investment appears weeks later as a friend’s tip. In another, the adviser asks the client to receive money from «other investors» in their own account and forward it, which turns them into a mule account without knowing it. The third arrives after the scam itself and I deal with it at the end.
Unauthorised brokers, Law 6/2023 and what the CNMV can do
Law 6/2023 reserves the provision of investment services in Spain to investment firms and credit institutions authorised and registered with the CNMV, or authorised in another EU Member State and notified to the Spanish regulator. Receiving and transmitting orders in shares, advising on investments or managing portfolios are reserved activities, and carrying them out without authorisation is a very serious infringement. That is what the CNMV calls an unauthorised entity and what the public calls, in Spanish, a «chiringuito financiero».
The CNMV keeps a search tool for authorised firms and a list of warnings about unauthorised ones, its own and those issued by other European regulators. Checking it before investing avoids most of these cases. Finding the broker on the list after having invested has two useful effects. It proves that the platform could not lawfully offer what it offered, which strengthens the element of deceit in the criminal complaint, and it allows you to show your bank that the beneficiary of the transfers had been publicly flagged by the regulator.
What the CNMV cannot do is order repayment or act on the destination accounts. Its complaints service is designed for clients of authorised firms that breach conduct rules, and an unauthorised broker is, by definition, not one of them. Reporting the case to it helps it warn and protect others, and that is worth doing, but the money does not come back through that door.
Stock market loss or fraud under article 248, where the line is
Article 248 of the Criminal Code defines fraud as the use of sufficient deceit to cause another person to fall into error, inducing them to carry out an act of disposition to their own or a third party’s detriment. The decisive point is that the deceit exists before the act of disposition. Whoever sets up a platform that pretends to trade on the stock market, invents profits and has never bought a single share is deceiving before receiving the first euro, and every transfer is an act of disposition induced by that error. It is fraud even if the client accepted terms and conditions or a risk warning, because the risk accepted was market risk and the market never came into it.
The position changes when the broker is authorised, the orders are executed and the money is lost because the price falls. There is no offence there. There may be a breach of the conduct rules in Law 6/2023, for example if a complex product was sold to a retail client without assessing its appropriateness, and that is pursued before the firm, before the CNMV and, where appropriate, in the civil courts seeking annulment of the contract or compensation. Different again is the genuine manager who receives money to invest it and later diverts it, who is liable for misappropriation or unfair administration.
Nor is this the computer-based form of fraud in article 249.2, the phishing type, in which a third party uses the client’s credentials or manipulates the system to order a transfer the client never consented to. In an investment scam the client orders the transfers personally, deceived but aware of ordering them. The difference matters in dealings with the bank, because an authorised operation made under deceit is treated differently from an unauthorised one.
Penalties under article 250 by amount and abuse of credibility
Article 249 punishes basic fraud with six months to three years’ imprisonment when the amount defrauded exceeds 400 euros, and with a fine of one to three months below that figure. Article 250.1.5 aggravates the penalty when the fraud exceeds 50,000 euros or affects a large number of people, and article 250.1.7 when the offender exploits their business or professional credibility or abuses a personal relationship with the victim. The fake adviser who presents himself as an analyst at a firm, with a corporate website and weeks of dealings, falls within this last case even if the amount is smaller. In both cases the penalty is one to six years’ imprisonment and a fine of six to twelve months, and if the fraud exceeds 250,000 euros article 250.2 raises it to four to eight years and a fine of twelve to twenty-four months.
| Amount and circumstances | Criminal Code article | Penalty | Limitation period |
|---|---|---|---|
| Up to 400 euros, no aggravating factors | 249 | Fine of one to three months | One year |
| Over 400 euros, no aggravating factors | 249 | Six months to three years’ imprisonment | Five years |
| Over 50,000 euros, or abuse of professional credibility | 250.1.5 and 250.1.7 | One to six years’ imprisonment plus fine | Ten years |
| Over 250,000 euros | 250.2 | Four to eight years’ imprisonment plus fine | Ten years |
Successive deposits are not judged separately. Article 74 of the Criminal Code classifies as a continuing offence a plurality of acts carrying out a single plan and, in property offences, sets the penalty according to the total loss. Whoever transferred two hundred and fifty euros on the first day and forty thousand over three months has suffered a continuing fraud for the total, and the total decides the bracket. The limitation period, under article 131, depends on the maximum penalty for the offence, and in these cases it is almost always ten years. That margin is enough to file a complaint, but the chance of locating the money is measured in days.
Criminal complaint, private prosecution or civil claim
The criminal route is the main one and is opened by a complaint before the National Police, the Guardia Civil or the court, or by a formal private prosecution known as a «querella». The complaint brings the facts to the authorities’ attention and is enough to open proceedings. The querella, which requires a lawyer and a court agent, makes the victim a party from the outset and allows them to request specific measures, including freezing the destination accounts and identifying their holders, and to appeal the court’s decisions. With accounts at several banks and money on the move, being a party from day one changes what the court does and when it does it. Someone who merely filed a complaint can join later, but the time that has passed is usually the time the receiving account has used to empty itself.
The civil action is also pursued within the criminal proceedings unless expressly reserved. Articles 109 to 116 of the Criminal Code oblige the offender to restore, repair and compensate, and article 116 makes principals and accessories jointly and severally liable within their class, so the judgment fixes the sum to be repaid and allows it to be enforced against the assets of any of those convicted, including mule account holders convicted of money laundering. Article 589 of the Criminal Procedure Act allows the investigating judge to require security and order the seizure of the suspect’s assets to secure those liabilities, and article 13 covers the urgent precautionary measures of the first phase, including freezing balances.
A civil claim for payment makes sense against someone who is identified and has assets in Spain, and it is the route taken against the bank when the payment services claim has been exhausted without result. Against an anonymous scammer with accounts abroad it is useless, because there is nobody to sue and nowhere to enforce. The usual order is criminal first, to identify and freeze, and civil against the bank in parallel or afterwards, depending on what the investigation reveals.
The bank recall, the court freeze and the mule account
The money left your account by transfer or card and entered someone else’s. There are three points at which to try to stop or recover it.
Your own bank is the first. Payment services legislation requires repayment of unauthorised transactions and also regulates, with qualifications, the bank’s liability for transactions the client did order. The transfers in an investment scam were ordered by you, which places the case on different ground from phishing. Even so, a claim is possible, especially if the bank failed to react to transactions plainly anomalous for your profile, if the beneficiary had already been flagged by the CNMV, or if you paid by card and a chargeback is available. On what basis and at what moment it is raised is the lawyer’s work and changes with the bank, the payment method and the timeline of the transactions. In the article on bank refunds after phishing I explain the phishing scenario, which is the one most readers have in mind.
Then comes the receiving bank. Your bank can send a recall request to the beneficiary’s bank, which only succeeds if the balance is still there and the holder does not object, which in practice means acting within hours. The court, at the request of the prosecutor or of the victim as a party, can require the receiving bank to identify the holder and freeze the balance, and when that bank is in another EU Member State the request goes through judicial cooperation, slower but effective.
That leaves the mule account holder. In most of these cases the first recipient is a private individual who lent their account for a commission or who was in turn deceived into receiving and forwarding. Article 301 of the Criminal Code punishes money laundering with six months to six years’ imprisonment and a fine of one to three times the value of the assets, and paragraph 3 punishes the negligent form, that of someone who should have suspected and did not, with six months to two years. That person is identified, usually lives in Spain and is civilly liable for what passed through their account. It is often the recovery route that eventually produces results. If you were the one the adviser asked to receive and forward other people’s money, the same provision reaches you, and the complaint must be drafted so that your position as a victim is clear from the start.
At the firm, with the receipts and the timeline on the table, we decide which of the three points to start with and before which court to file the querella, because the balance can only be frozen while it is still in the destination account. That is the work of our cybercrime and bank fraud practice.
The broker abroad, the A Coruña court and limitation periods
That the platform claims to be based in Cyprus, Estonia or London does not prevent a complaint in Spain. Supreme Court case law on long-distance fraud accepts as the place of commission the place where the victim carried out the act of disposition, the place from which the transfer was ordered, in addition to the place where the money was received. A resident of A Coruña can file before the investigating courts of A Coruña and the investigation will normally proceed here. When several victims file in different judicial districts against the same platform, the cases end up consolidated in one of them, and sometimes in the Audiencia Nacional if the organisation and the number of victims justify it.
That the perpetrator is abroad complicates conviction, while the classification of the offence and the civil liability remain the same. European Investigation Orders allow data to be requested from EU banks, and cooperation with third countries exists even if slow. In practice, convicting whoever runs the organisation from abroad is the exception, and recovery depends more on speed in freezing and on the recipients identified in Spain than on catching the mastermind.
There are two deadlines. The limitation period for the offence, between five and ten years in these cases. And the deadline for the claim against the bank, much shorter, set by payment services legislation, which requires notifying the bank immediately and filing the claim without delay with the approach already decided. Letting months go by waiting for the platform to reply is the most common way of losing that second route without noticing.
The provisional dismissal and the call from the fake recovery agent
Many investigations into investment scams end in a provisional dismissal because the perpetrator has not been identified. That dismissal is not final. It is issued while no new evidence emerges and the case is reopened if another investigation identifies those responsible or the account holders come to light. Meanwhile the claim against the bank remains alive, because it does not depend on anyone being convicted, and so does the civil action against the identified mule account holder. The dismissal shifts the matter to those other fronts.
Recovery fraud deserves a separate warning. Victims’ details circulate among the same groups, and it is common that weeks after the platform shuts down someone calls presenting themselves as a lawyer, an asset recovery company, an official of the CNMV or the court, or your own bank, and claims to have located the money. They ask for an advance payment, a fee or an insurance premium to release it, or for remote access to your computer to «verify the account». No court, regulator or bank charges in advance to return money, and a real lawyer identifies themselves with a name and bar registration number that can be checked with the relevant bar. If you receive one of these calls, keep it as evidence that your details are still in the group’s hands and pay nothing. These fake recovery agents often borrow the language of bank impersonation scams, which I describe in this other article, to sound informed.
Frequently asked questions
Is losing money on the stock market with a broker always fraud, or only when there was prior deceit?
Only when there was prior deceit. Article 248 of the Spanish Criminal Code requires deceit preceding the act of disposition that leads the victim into error. If the broker is authorised by the CNMV, the orders were executed and the price fell, there is no offence, and any claim is civil or before the regulator. If the platform pretended to trade and never invested anything, it is fraud from the first transfer.
What is the penalty for an investment scam, and does it change depending on how much money was taken?
It changes with the amount. Basic fraud under article 249 carries six months to three years’ imprisonment if the sum defrauded exceeds 400 euros. If it exceeds 50,000 euros or the offender abused their professional credibility, article 250 imposes one to six years plus a fine. Above 250,000 euros, four to eight years. Successive deposits are added together as a continuing offence.
The querella and the bank claim, in that order
The step that comes now is filing the querella with the request to freeze and identify the destination accounts and, in parallel, addressing the claim to the bank on the basis that fits your case. Both are prepared by the lawyer with the receipts and the timeline you have kept, and both lose value with every week the balance keeps moving. At Perseus & RC Abogados we act as private prosecutor and handle the bank claim in investment scams from A Coruña. You can call +34 677 841 007 or write through our contact page, and we respond as promptly as we can. More on our cybercrime and bank fraud and criminal law practices.