Bank phishing in Spain: claiming unauthorised payments from the bank

If you have been the victim of fraud or phishing and payments you never ordered have appeared on your account, the immediate question is whether that money can be claimed back from the bank. The answer turns on one legal concept: gross negligence.

What an unauthorised payment transaction is

Where someone impersonates a trusted organisation to obtain credentials, card details or a confirmation code, and transfers or purchases the account holder never ordered are then executed, we are dealing with unauthorised payment transactions.

That classification triggers a regime of its own: Royal Decree-Law 19/2018 of 23 November on payment services.

Gross negligence: the concept that decides

Almost every phishing claim turns on a single point, and it is not whether there was deception — that is rarely in dispute — but whether the account holder was grossly negligent.

The law does not define it by a closed list, but it does fix what it is measured against: the obligations in article 41, of which there are only two:

1. To use the payment instrument in accordance with the terms governing its issue and use, which must be objective, non-discriminatory and proportionate, taking all reasonable steps to keep the personalised security credentials safe. 2. To notify the loss, theft, misappropriation or unauthorised use without undue delay.

There is no third obligation. And "gross negligence" is not the same as "having made a mistake": it is a more demanding standard, assessed in the light of how the deception was carried out, how sophisticated it was and the specific circumstances of the case.

Who has to prove what

Article 44.1 provides that where the user denies having authorised a transaction that has already been executed, it is for the bank to prove that that transaction was authenticated, accurately recorded and entered in the accounts, and was not affected by a technical breakdown or some other defect in the service.

Article 44.2 adds that the bank's record of the use of the payment instrument is not necessarily sufficient to prove that the transaction was authorised by the payer, or that the payer acted fraudulently or failed, intentionally or through gross negligence, to meet the obligations in article 41.

And article 44.3 completes the reasoning:

• "Corresponderá al proveedor de servicios de pago […] probar que el usuario del servicio de pago cometió fraude o negligencia grave." (It is for the payment service provider to prove that the user committed fraud or was grossly negligent.)

If the bank maintains that there was gross negligence, it is the bank that must establish it.

How far the account holder is liable

As a rule, article 46.1 caps at 50 euros the losses the account holder may bear in respect of transactions arising from a lost, stolen or misappropriated payment instrument, with exceptions that remove even that amount.

That cap disappears, and the holder bears all the losses, where they acted fraudulently or failed, intentionally or through gross negligence, to meet the obligations in article 41.

The same article contains two rules worth knowing:

• Where the bank does not require strong customer authentication (article 46.2), the holder bears financial consequences only if they acted fraudulently.
• Where the transactions were carried out remotely using only the payment data printed on the instrument itself, the holder is wholly exempt, save for fraud or gross negligence in meeting their safekeeping obligations, provided they gave notice without delay.

And after notification, article 46.3 excludes any financial consequence for the holder, save for fraudulent conduct.

What to do in the first few hours

The decisions taken in the first few hours shape the whole of the later claim.

• Tell the bank immediately and ask for the account to be blocked. This is one of the two obligations in article 41, and it is worth having a record of the time.
• Change the compromised passwords, and those of any other account where they are reused.
• Delete nothing. The message, the email, the number that called, the screenshots of the fake site and the app notifications are what later makes it possible to argue about the gross-negligence classification.
• Report the facts to the Mossos d'Esquadra, the Policía Nacional or the Guardia Civil.
• Ask the bank in writing for the detail of the transactions and of how each one was authenticated. Article 44.4 requires that documentation to be kept for at least six years and supplied to the user on request.
• INCIBE runs a free, confidential cybersecurity helpline, 017, with technical guidance on what to do and how to preserve the evidence.

Time limits

Notice must be given without undue delay once the holder becomes aware of the transaction and, in any event, within a maximum of thirteen months from the date of the debit (article 43.1). That time limit does not apply where the bank failed to provide or make available the information about the transaction.

The two routes

The claim against the bank is the one that seeks the money back: a letter to the customer service department and, if that does not resolve it, a complaint to the Bank of Spain's Conduct of Entities Department and, where appropriate, civil proceedings. The Bank of Spain's ruling is not binding on the bank and does not replace court proceedings, but the procedure is free of charge and the report carries weight afterwards.

The criminal complaint pursues whoever committed the fraud, not the bank. In practice the perpetrator rarely surfaces, but the complaint fixes the account of events from the outset, evidences the holder's diligence and goes into the civil claim as evidence. If you decide to report the matter, you can also read about the rights the law gives the victim of a criminal offence.

What we review before claiming

• How the contact came about and what details the account holder actually gave.
• Which transactions were executed, in what order and with what authentication method.
• Whether the bank applied strong customer authentication and what its records show.
• When the facts were reported and how that communication was documented.
• What answer the bank has given, and on what basis.

From there we decide whether the claim has legs and by which route, before anything is filed.