The mistake everyone makes when this call comes in is trying to sort it out without hanging up. The voice is your child’s, crying, saying there has been an accident or that the police are holding them, and asking for money now. You want to help and you want to understand, and while you ask questions you stay inside the call, which is exactly where the scammer needs you. Nothing that happens in that conversation can confirm it is your child, because the voice is already fake. The only valid check happens outside the call.
The second mistake belongs to the person who has already paid. Ashamed, or hoping it was a misunderstanding, they let the weekend go by before telling anyone, ring back the number that called them to demand the money, or delete the messages. Money sent by Bizum or instant transfer leaves the intermediate account within minutes, and every hour without alerting the bank and without reporting is an hour in which the trail and the evidence are lost. Our firm handles these cases, and what follows is what someone who has already been through it needs to know, with the offence and its articles.
How your child’s voice is manufactured
Voice synthesis software needs a few seconds of clean audio to generate new sentences with a person’s timbre, accent and verbal tics. That audio comes from social media videos, forwarded voice notes, a podcast or an earlier call in which someone recorded your child under any pretext. With that sample, the scammer types what they want the voice to say and the program speaks it. They can improvise if you ask something, though with a delay, which is why these calls tend to be short, full of crying and handed over to a third party, a fake police officer or lawyer, who steers the conversation towards payment.
The variants are the same scheme in different packaging. The WhatsApp message from a new number, «Mum, my phone broke, this is my new number», ending in a request for a transfer. The call with the cloned voice of a grandchild or child. The video call with the face and voice of the company’s managing director asking the bookkeeper for an urgent and confidential transfer. A manipulated video of a relative in trouble. In every case the legal mechanics are identical, someone deceives you so that you move the money yourself.
The signs that keep repeating
Extreme urgency and a reason why you cannot speak to anyone else. An unknown, withheld or foreign number, or your child’s usual number spoofed, because caller ID can be manipulated. A demand that payment be made through an immediate channel, Bizum, instant transfer, prepaid cards or cryptocurrency, to an account that is not your child’s, with an explanation of why. A caller who stops you hanging up or asks you to stay on the line while you make the payment. None of these signs proves anything on its own. Together they describe the call almost entirely.
What to do while the call is ongoing
Hang up. Call your child on their usual number, and if they do not answer, call someone who is with them or could be. Do not ring back the number that called you, and do not use any number given to you during the conversation. If your family has a pre-agreed password, ask for it; if not, ask a question whose answer is not on the internet. A scammer with a cloned voice can hold a short conversation, but does not know the name of the dog you had twenty years ago.
Send nothing until you have spoken to your child through a channel you initiated. No real emergency fails to survive ten minutes.
If you have already sent the money, the first hours
First comes the bank, through the fraud line printed on your card or shown in the app, never through a number the scammer gave you. Explain that you made a payment under deception and ask them to try to hold the transaction and to notify the receiving bank of the fraud. An ordinary transfer has sometimes not yet been executed; a Bizum or instant transfer has already arrived, but the receiving bank can freeze the account if warned in time. How much is recovered this way depends on speed.
Second, keep everything. The number that called you, the time and duration of the call as recorded on your phone, the WhatsApp or SMS messages in full screenshots showing number and date, the payment receipt with the destination IBAN or phone number, any recording if your phone made one, and a note written by you that same day with what the voice said and what was asked. Do not delete the conversation, do not block the number until you have documented it, and do not speak to them again. If they call back, and they usually do to ask for more with a new excuse, do not answer.
Third, report the crime, within days, not weeks. Where and with what, further down.
What crime it is and what penalty it carries
Whoever clones your child’s voice so that you send them money commits fraud under Article 248 of the Spanish Criminal Code. Fraud requires deception sufficient to cause error in another person and induce them to make a disposition of assets to their own or someone else’s detriment. The synthetic voice is the deception, your belief that you are speaking to your child is the error, and the Bizum or transfer you order is the act of disposition. It fits without any stretching.
The penalty, under Article 249 of the Criminal Code, is six months to three years’ imprisonment. If the amount obtained does not exceed 400 euros, the offence is a minor one punished with a fine of one to three months, although the courts add the amounts together when the same group has defrauded several people with the same method, as a continuing offence, and the result stops being minor.
The defence in these cases sometimes argues that the victim was careless and the deception was not sufficient. Courts measure the deception against the specific victim and the means used, and a voice synthesised to sound like your child is designed precisely to defeat the diligence of any parent.
The article changes depending on who orders the payment. If the deception leads you to order it, it is classic fraud under Article 248. If what they obtain through the call are your credentials or a code and they make the transfer themselves without your consent, it is computer fraud under Article 249.1.a), in the wording in force since January 2023 under Organic Law 14/2022, which punishes the unauthorised transfer of an asset obtained through computer manipulation. The penalty is the same, but the difference between a transaction you ordered and one you did not consent to has consequences for the claim against the bank, which is why the facts should be fixed properly from the report onwards.
When the amount defrauded exceeds 50,000 euros, or the fraud has affected a large number of people, aggravated fraud under Article 250 applies, with one to six years’ imprisonment and a fine. The networks making these calls rarely stop at one victim, which is why individual reports that look small in isolation serve to build the larger case.
Two offences people ask about generally do not apply. Usurpation of civil status under Article 401, punishable with six months to three years, requires someone to pass themselves off as another person fully and continuously, not to use their voice in one call. And pretending to be a police officer or lawyer during the same call may add usurpation of public functions under Article 402, but in practice what is prosecuted is the fraud, which absorbs the harm.
You can report even if you did not pay. If you hung up in time, there is attempted fraud under Articles 16 and 62 of the Criminal Code, with the penalty reduced by one or two degrees, and your report adds the number, the voice and the script to an investigation that probably already exists.
Where to report and what to bring
The report can be filed at any National Police station or Guardia Civil post, or directly at the duty court. It need not be your local station, although it helps for the reasons I give on jurisdiction. Bring your identity document, the payment receipt, the message screenshots with number and date, your phone’s call log and the note of what happened. If your child can come with you and confirm they did not make the call, better, because their statement closes the first question any investigator raises.
The report can be filed without a lawyer, and for small amounts that is reasonable. Where the lawyer makes the difference is in what comes next, in making sure the report describes the transaction in a way that works against the bank, in asking the court from the outset for what needs to be requested from telecoms operators and banks, and in making sure the injured party is not left outside the proceedings.
Recovering the money, two routes that do not exclude each other
The first is the criminal proceedings. Whoever is convicted of fraud is civilly liable for the loss, Articles 109 and following of the Criminal Code, and the judgment will order them to repay what was taken. The problem is that the actual perpetrator, the person who made the call, often never appears. What usually does appear is the holder of the account you sent the money to, the so-called money mule, a person in Spain who lends or sells their account to receive and forward other people’s money. That person can be convicted of money laundering under Article 301 of the Criminal Code, including in its negligent form, and be civilly liable for the amount that passed through their account. It is frequently the only assets within reach.
The second route is the bank. Payment services rules oblige banks to refund transactions the customer did not authorise. When you ordered the transfer yourself under deception, whether the case fits within that obligation or within other grounds for the bank’s liability is a legal question resolved case by case, and one we study at the firm with the account movements, the warnings the bank did or did not give and the way the transaction was authorised. In this other article I cover in more detail what the bank is obliged to refund after a cyber fraud. How that claim is framed, and against which entity, is the lawyer’s job.
You can also reserve the civil action, Article 112 of the Criminal Procedure Act, and claim separately against the holder of the receiving account. That claim does not follow the route of the order for payment procedure, which is designed for documented debts, because here there is no acknowledgement of debt of any kind. It is brought as an action for the harm caused or for unjust enrichment, and the evidence has to be prepared differently.
If the scammer called from abroad or from a withheld number
Reporting still matters, for concrete reasons. The investigation follows the money, not the number, which is almost always fake or rented, and the money passes through an identifiable Spanish or European account. Jurisdiction is not an obstacle either. The Spanish Supreme Court, when resolving disputes between courts in frauds committed remotely, has consistently assigned the investigation to the court of the place where the victim made the disposition, the place from which you ordered the payment. A call from another country does not force you to litigate abroad. And the report is what allows telecoms operators and banks to be asked for the data that identifies the mule and, sometimes, the person behind them.
If the perpetrator is not identified within a few months, the court will usually order a provisional dismissal, Article 641 of the Criminal Procedure Act. Provisional means the case is reopened if something new appears, and with these networks it often does, because an arrest in another province for the same method draws in the earlier reports. Meanwhile, the dismissal does not prevent the claim against the bank or the civil action against the account holder.
The limitation period for the offence, Article 131 of the Criminal Code, is five years for basic fraud, ten if it is aggravated fraud under Article 250 and one year if it is a minor offence because the amount does not exceed 400 euros. It runs from the day of payment. It is not a deadline for reporting, but reporting late greatly reduces what can be recovered.
Your child’s voice also belongs to your child
Your child is an injured party even if not a single euro was taken from them. Their voice is personal data and, when used to identify them, biometric data, with the reinforced protection data protection rules give to those categories. Organic Law 1/1982 protects name, voice and image against unconsented uses, and the Spanish Constitution guarantees in Article 18 the right to one’s own image. Fitting a scam call within the civil wrong of unlawful intrusion is debatable and rarely worthwhile on its own, but your child’s status as an injured party matters for the criminal proceedings, because it allows them to give evidence, join the case and ask for an investigation into where the audio came from.
If your child is a minor, those holding parental authority act on their behalf, Articles 154 and 162 of the Civil Code. Data protection law requires parental consent to process the data of children under fourteen, which opens the door to demanding that the platform remove the videos the voice may have come from and to going to the Spanish Data Protection Agency if it does not comply. Claiming compensation from the social network for the fraud is a different matter. The platform did not make the call or clone the voice, and the rules governing its liability limit it to what it knows about and fails to remove. In practice that route does not succeed and I do not recommend it as a strategy for recovering the money.
If they used you as a mule
Sometimes the fraud has a second chapter. After defrauding you, or in exchange for a supposed refund, they ask you to receive money in your account and forward it. Whoever does so becomes the visible link in the chain and can end up charged with money laundering under Article 301 of the Criminal Code, punishable with six months to six years’ imprisonment, or in its negligent form, six months to two years, where they should have suspected the origin of the money. Receiving money from a stranger and forwarding it in exchange for keeping a percentage is the definition of that offence. If you have been offered something like this, do not do it, and if you already have, speak to a lawyer before the police summon you.
Reducing your voice footprint and talking about it at home
Prevention fits in one paragraph. Fewer public videos with your children’s voices, private profiles, voice notes that are not forwarded to open groups. A family password that is never written in any chat. An understanding that no one in the family asks for money over the phone without the other person calling them back. And telling the older members of the household, who are the preferred target, with the concrete instruction to hang up and call.
At Perseus & RC Abogados, in A Coruña, we handle voice and identity fraud cases from the criminal report through to the claim against the bank and the civil liability of whoever received the money. If it has happened to you, contact the firm with the documentation of the call and the payment; the sooner it is reviewed, the more can be done.
Frequently asked questions
Can I recover the money if I made the transfer or the Bizum payment myself?
Yes, in many cases, through two routes that do not exclude each other. The civil liability of the person convicted in the criminal proceedings, which usually reaches the holder of the account that received the money, and the claim against the bank, whose scope depends on how the transaction was authorised and on what the bank did. The fact that you ordered the payment yourself does not close the door, but it makes the analysis case by case.
What crime does someone commit by cloning my child’s voice and what is the penalty?
Fraud under Article 248 of the Spanish Criminal Code, with six months to three years’ imprisonment. If the amount does not exceed 400 euros it is a minor offence punished with a fine, and if it exceeds 50,000 euros or affects many people it is aggravated fraud under Article 250, with one to six years’ imprisonment.
Is it worth reporting if they called me from abroad or from a withheld number?
Yes. The investigation follows the money trail, which passes through identifiable accounts, and the competent court is the one for the place where you made the payment, so you do not have to litigate outside Spain. If the perpetrator is not identified, the case is provisionally dismissed and reopened when new information appears, which happens frequently with these networks.
Can my child report it even though no money was taken from them?
Yes. Their voice is protected personal data and their identity has been used to commit a crime, so they are an injured party and can give evidence and join the proceedings. If they are a minor, their parents act on their behalf. They can also demand that the platform remove the videos the audio was taken from.