Criminal law
Published on September 24th, 2026
Anyone who discovers that they have paid a seller who never existed, or that their account has been emptied with credentials they should never have handed over, tends to lose the first hours waiting for the bank to sort it out, when what weighs most in getting the money back is what is done that same day with the bank and with the police report. As the two routes run in parallel and neither replaces the other, I set them out with someone in mind who is in Barcelona and will have to report the matter to the Mossos d'Esquadra, Catalonia's police force.
Under the payment services rules, a transaction is authorized when the payer has consented to its execution, and without that consent it is treated as unauthorized (article 36.1 of Royal Decree-Law 19/2018 on payment services). Someone who pays a fake seller by Bizum, the Spanish instant mobile payment system, or who transfers money to the account given by somebody posing as their son, has been deceived but gave the order themselves, which places the case among authorized payments. Card charges you did not make and transfers that left your online banking without your order are, by contrast, unauthorized transactions. In between lies the most disputed ground, that of the person who read out a code over the phone believing they were talking to their bank, where everything depends on how the facts are reconstructed.
If the transaction was not authorized, the bank must refund the amount immediately and, at the latest, by the end of the business day following notification, unless it has reasonable grounds to suspect fraud and reports them in writing to the Bank of Spain (article 45.1). If the bank maintains that the transaction was authorized, it is for the bank to prove that it was authenticated and accurately recorded, and the mere record of the use of the card or the credentials does not by itself show that the customer authorized it or acted with gross negligence (article 44, paragraphs 1 to 3). The customer may have to bear up to 50 euros, and the whole loss falls on them only if they acted fraudulently or failed, deliberately or through gross negligence, in their duties to keep the credentials safe and to give notice (article 46.1). You must give that notice without undue delay and never later than thirteen months after the debit (article 43.1).
If you ordered the payment yourself, deceived, the margin is narrower, though it does not disappear. Since October 9th, 2025, for transfers in euros the bank must offer free of charge, right after the customer indicates whom they are paying and before they can authorize the order, a service that checks whether the payee's name matches the destination account and warns the customer when it does not. Where the channel asks for neither the account nor the name, as can happen when paying with a phone number, the bank must give the customer the information needed to validate the payee before authorizing (Article 5c of Regulation (EU) No 260/2012, as amended by Regulation (EU) 2024/886 of March 13th, 2024, and Article 5b(2) on its being free of charge). If the bank failed in that duty and the failure led to a defectively executed transaction, it must refund the amount without delay (paragraph 8 of the same article). That is why it matters to remember which screen you saw before confirming and to keep a screenshot if one can still be taken. As the rule names no particular service, whether a given payment falls within it is decided case by case. The sensible course is to call at once, ask the bank to seek the recall of the funds from the receiving bank and complain in writing to its customer service department, which has fifteen business days to reply (article 69.1 of Royal Decree-Law 19/2018).
The report can be filed at a Mossos station or at the duty court, and it must set out the facts in detail and point to any source of knowledge that may help clarify them (article 265.2 of the Criminal Procedure Act). Bring with you, therefore, the screenshots, the ad or the profile, and the receipt for each payment with the destination account or phone number. When you file it you are entitled to a certified copy (article 6 of Act 4/2015 on the Statute of Victims of Crime), which the bank will ask you for.
Fraud (estafa) is committed by anyone who, for profit, uses sufficient deception to lead another person into error and induces them to dispose of property to their own or a third party's detriment, and it carries six months to three years in prison (article 248 of the Criminal Code), which is what the fake seller does. With the same penalty, article 249.1 treats as fraud obtaining a non-consensual transfer by computer manipulation or a similar device and the fraudulent use of cards or other non-cash payment instruments.
If the amount defrauded does not exceed 400 euros, fraud under article 248 is punished with a fine of one to three months, unless one of the circumstances of article 250 applies or the offender has at least three final convictions for offenses of the same nature, one of them minor. With that penalty it is a minor offense, a delito leve (articles 13.3 and 33.4 of the Criminal Code), which becomes time-barred after one year (article 131.1) and at whose trial a lawyer is not mandatory (article 967.1 of the Criminal Procedure Act). Those two exceptions to the threshold were introduced by Organic Act 1/2026, in force since April 10th, 2026, and a fraud committed earlier is governed by the wording in force at the time unless the new one is more favorable, as I explain in the guide on the 2026 criminal-law reform and favorable retroactivity.
Filing a report does not make the victim a party to the proceedings. When the victim gives a statement before the judge, they are told of their right to join the proceedings and to waive or not the restitution and compensation (article 109 of the Criminal Procedure Act), and they can join as private prosecutor, the acusación particular, before the stage at which the charges are formally set out (article 110). Once the criminal action is brought, the civil action is deemed brought as well unless it is expressly waived or reserved (article 112), and the refund is claimed within the same case. The public prosecutor will claim civil liability even if the victim does not join, provided the victim does not waive it (article 108), but only someone who has joined can see what has been done in the case and ask for investigative steps (article 776.3).
Anyone who has profited without giving anything in return from the proceeds of the offense must return them up to the amount of their share (article 122 of the Criminal Code), which can reach the holder of the account that received the money without having taken part in the deception. During the investigation the judge can order precautionary measures to secure those financial liabilities (article 764.1 of the Criminal Procedure Act). It pays to ask for them early in transfer frauds, given that the money rarely stays put in the destination account.
When someone calls me after a fraud, the first thing I ask for is the exact sequence of what happened, with times. Whether the payment was authorized depends on it, and that shapes both the claim against the bank and the criminal classification. I review or expand the police report, prepare the written claim to the bank and, when the amount justifies it, join the case as private prosecutor in order to ask as early as possible for the funds to be secured. I cannot promise that the money will come back, since it has often passed through several accounts within a few hours, but I can make sure that each route is activated in time and that none is lost for not having been requested.
If this has happened to you, you can write to me with the receipts at hand, or first see how I handle criminal law in Barcelona.
Editorial responsibility: Carles Jiménez, Spanish lawyer (Barcelona Bar No. 34.946). This note was prepared with the assistance of artificial-intelligence tools and reviewed and approved by the author before publication.
Tell me about your situation and I will tell you, frankly, how I can help.
Get in touch