Bank fraud: Spanish customers lose thousands with no way to recover their money
Victims of bank scams are unable to get banks to reimburse money stolen through sophisticated deceptions. A European ruling requires funds to be returned, but financial institutions shield themselves by claiming the operations were authorised.
Customers caught in scams that banks do not cover
According to elpais.com, Laura Marchena applied for a bank loan and ended up paying for twelve years for 26,000 euros that she never actually received. A fake BBVA employee contacted her, warning her of a supposed fraud attempt and offering her a pre-approved loan that she was supposed to take out and then repay in order to block the scam. She obtained the money instantly and began making transfers to an account provided by the scammer, but stopped before completing them when she needed to leave with her son. The following day she confirmed with BBVA that it was a scam and only lost 6,000 euros of the total.
The bank refused to reimburse the 26,000 euros. "The bank told me that a law had come out saying that if the customer authorises a money transfer, they could not recover it, that it was my fault," Marchena explains. She currently pays a monthly instalment on a loan for money she never used, reliving the deception she fell victim to every month.
Sophisticated scams that mimic official communications
Bank scams have reached massive proportions. Criminals employ multiple tactics: notifications about pending packages, unauthorised purchases, attempts to take out loans in someone else's name, or family members in urgent need of money. In some cases they possess real data about the customer; in others, they manage to have their messages appear alongside official communications from banks and companies. The most effective approach is to convince the victim to voluntarily hand over the money.
Marta Estarellas received a message that appeared to be from Correos requesting one euro to receive a pending package. The URL was identical to the official one. Upon entering her card details, she was registered on Apple Pay on a foreign device, from which purchases totalling 1,139 euros were made. She discovered the fraud when her card was rejected due to insufficient funds.
Bankinter refused to reimburse her, arguing that the transactions were made through Apple Pay with authorisation from an Apple device. "I do not have and have never had an Apple mobile phone," Estarellas responds. The bank maintains that she approved the purchases and will not take responsibility for the scam.
Million-euro losses across Europe
Payment fraud reached 4.2 billion euros in the European Economic Area during 2024, according to data from the European Central Bank (ECB) and the European Banking Authority (EBA). In fraudulent transfers, customers bore 85 per cent of the losses. In Spain, fraud involving cards and transfers was the main reason for complaints admitted by the Bank of Spain in 2025, representing almost 28 per cent of the total.
Banks have stepped up campaigns reminding customers that they never request access codes to applications or digital platforms. However, as deceptions become increasingly sophisticated and scammers operate en masse, the debate is shifting towards the institutional responsibility of financial institutions.
A European ruling changes the rules
A recent ruling by the Court of Justice of the European Union (CJEU) strengthened consumer protection by ordering that financial institutions immediately return money lost to fraud, even if they consider the victim acted negligently in providing access codes. Previously, some banks rejected claims by arguing that the user had failed to meet security obligations.
Now that the courts require immediate reimbursement of amounts lost to scams, financial institutions take refuge in determining whether the operations were truly authorised. This distinction becomes a new barrier for many victims who cannot get banks to acknowledge shared responsibility in increasingly sophisticated scams.
Source: Google News ES — Crime (es)