When money leaves your account without your instruction, it is not for you to prove that you did not give it. Spanish payment services law places that burden on the bank, which must prove that the transaction was properly authenticated and recorded and, if it wants to refuse a refund, that you acted fraudulently or with gross negligence. The fact that its records show your credentials or the code sent to your phone is not enough on its own, and the law itself says so.
I handle these claims myself. I am Luis Jurado Cano, a lawyer registered with the A Coruña Bar Association under number 6317, at Perseus & RC Abogados, and when a case has to go to the civil courts I prepare it with Ana Reza, managing partner of the civil department. In scams that impersonate a bank the money is usually recovered sooner from the bank than from the fraudster. What applies to any fraud is on the main fraud page, and the investigation of the cybercrime itself on the cybercrime page.
Unauthorised, or authorised under deception
The first thing I look at is who gave the order. If someone got into your online banking, used your card details, sent a Bizum from your app or obtained a duplicate of your SIM card to receive your codes, you did not authorise the transaction, even if the fraudster used your credentials. The bank must refund it immediately, and at the latest by the end of the next business day. If the bank did not ask for strong authentication, the double check with a code or your fingerprint, it can only make you bear the loss if you acted fraudulently.
Banks tend to blur one point. If you did not make the transfer and only read out over the phone the code you received, the order was given by the fraudster, and it is still an unauthorised transaction. I describe that script in the fake Abanca phone call and in scams impersonating your Spanish bank.
It is different if you made the transfer yourself because the supposed bank employee convinced you that your money was at risk and had to be moved to a safe account. Then you authorised it, and the claim against the bank is harder but not closed. We look at whether the bank let through a payment completely out of line with how you normally use your account, whether the fake message landed in the same text thread as the bank’s real ones, and what the bank did when you called. At the same time, a criminal complaint allows the holder of the receiving account to be identified, and that person can be ordered to repay even if they did not organise the fraud.
How we claim against the bank
Report every transaction you do not recognise to the bank, in writing and without delay. The law requires this without undue delay and sets an outer limit of thirteen months from the debit, but any delay will be held against you long before that. Anything done with the stolen card or credentials after your report is at the bank’s expense, unless you acted fraudulently.
Next comes the formal complaint to the bank’s customer service department, which must answer every point within fifteen business days, or one month at most in exceptional cases. In that complaint we ask for the technical records of each transaction, which the bank must keep for at least six years and hand over on request. If the answer is no, or never comes, there is the Bank of Spain’s complaints service, whose report is not binding, or a lawsuit. In court the burden of proof really bites, because the bank has to produce those records and use them to explain how each payment was authenticated. There is more in does a Spanish bank have to refund my money after phishing.
Evidence not to delete
Do not delete the text message or the chat, because a fake message sitting among the bank’s genuine ones is one of the best pieces of evidence you will have. Screenshot your call log with the time and the number shown on screen. Download the statement with the transactions you do not recognise and keep the app notifications, the bank’s emails and every reply you receive. Write down now, while you remember, what you were told, what you did and when, because that account is later checked against the bank’s records.
Where we are
Rúa Torreiro 13, 3.º C, 15001 A Coruña, Spain. Phone +34 677 841 007. If you live elsewhere, we can go through your statement and messages by video call, in English.
Related reading
- Does a Spanish bank have to refund my money after a phishing scam?
- Online scam in Spain, how to recover the money and what the bank must refund
- Scams impersonating your Spanish bank by text or phone call
- They call ‘from Abanca’ and ask you to move your money
- Revolut text or call saying your account is blocked
Frequently asked questions
I gave the fake bank employee the code from the text message. Will I get my money back?
Possibly. If the fraudster made the transaction using the code you read out, you did not give the order and it counts as an unauthorised transaction. The bank can only refuse if it proves serious carelessness on your part, and giving a code to someone posing as your own bank, in a call designed to look genuine, is not automatically that. We need to see the text message and how the call went.
I sent a Bizum payment to a fraudster. Can I recover it?
A Bizum payment you sent yourself cannot be cancelled, because it is credited within seconds. The phone number that received it is linked to an account with a named holder, and once there is a criminal complaint the court can identify that person and order the money returned. If someone else sent the Bizum from your app without your instruction, the claim goes against your bank like any unauthorised transaction.
My SIM card was duplicated and my account emptied. Who do I claim against?
Your bank first, because the transactions were made by someone else using the codes sent to your number. We also look at how the phone company handed over the duplicate SIM and what checks it carried out, because that can create liability too. Write down the exact time your phone lost signal.
The bank says it was my negligence and will not refund anything. Is that the end?
No. A first refusal is common and leaves other routes open. The bank must prove gross negligence, and Spanish law says that the mere record of your credentials being used is not enough. After a refusal you can complain to the Bank of Spain or go to court, where the bank will have to show how each transaction was authenticated.
How long does the bank have to refund a transaction I did not make?
The law requires an immediate refund, and at the latest by the end of the next business day after you report it. The bank may only hold it back if it has reasonable grounds to suspect fraud by you and reports those grounds in writing to the Bank of Spain. If that does not happen, complain in writing straight away and keep proof of when you reported it.