Sent money to a fake investment? When the bank is liable for a scam transfer in Spain

The case, in five lines

What is brought

A contractual liability claim against your bank for failing to provide, or providing defectively, Verification of Payee (article 5c of Regulation (EU) 260/2012) and for failing to exercise the care required when faced with anomalous transactions (articles 1101 and 1104 of the Civil Code), and a tort claim (article 1902 of the Civil Code) against the bank that opened and maintained the receiving account. The refund under article 45 of Royal Decree Law 19/2018 only comes into play if your consent to the order was not genuine and informed.

Before which court

The civil section of the Tribunal de Instancia (Spain's court of first instance) where you are domiciled as a consumer, with appeal to the Audiencia Provincial (the provincial court of appeal). If your bank is an institution from another EU Member State that directs its activities to Spain, you can also sue it in Spain (articles 17 and 18 of Regulation (EU) 1215/2012); against a foreign receiving bank, with which you have no contract, that rule does not apply.

Deadline

Against your bank, a limitation period of five years from each transfer (article 1964.2 of the Civil Code); if you maintain that the transaction was incorrectly executed, you must notify the bank without delay and no later than thirteen months after the debit (article 43 of Royal Decree Law 19/2018). Against the receiving bank, a limitation period of one year from when you learned of the fraud (article 1968.2 of the Civil Code). Both periods are interrupted by a formal claim made out of court (article 1973 of the Civil Code).

Who can bring it

The holder of the account from which the money was sent, and any joint holders, acting as consumers. The claim is brought against the bank that executed your orders and, if the facts support it, against the bank that opened and maintained the receiving account. Whoever appears as the holder of that account is another possible defendant, through a separate claim for restitution.

Financial risk

There is no automatic refund. If the bank proves that it warned you that the name did not match and you went ahead, or that nothing in your orders justified stopping them, the claim will be dismissed and you will normally be ordered to pay the bank's costs. If both sides were at fault, the court may split the loss instead of placing all of it on one of them. Suing a bank in another Member State makes the case more expensive.

You gave the order: why the bank hides behind the IBAN

The bank's first answer is almost always the same: the transfers bear your security code and you ordered them. It is partly right. The immediate refund under article 45 of Royal Decree Law 19/2018, and the bank's burden of proving your gross negligence, are designed for unauthorised transactions, those a third party carries out with your credentials. When the fraudster persuades you to send the money yourself, what is known as authorised push payment (APP) fraud, the transaction is authorised even though you were deceived, because the deception came from a third party and not from the bank.

The second shield is article 59.1: where an order is executed in accordance with the unique identifier, it is deemed correctly executed with regard to the payee specified by that identifier. For years that settled the matter: the bank sent the money to the IBAN you typed, and whatever name you wrote next to it did not matter. That is why the case is not framed as a mere defective execution, but around what the bank had to check, see and do before executing the order.

First of all, it has to be established who pressed what. If it was the fraudster who moved the money from your online banking, with a remote access program or with codes you read out believing you were cancelling another transaction, it is a case of unauthorised transactions, which we cover in a separate guide. In 2025 the Tribunal Supremo (Spain's Supreme Court) held that the payment service user's consent must be genuine and informed; by that standard, approving on your phone a prompt presented to you as a cancellation can hardly count as authorising a transfer.

Verification of Payee: the new route since October 2025

Since 9 October 2025, article 5c of Regulation (EU) 260/2012, inserted by Regulation (EU) 2024/886, obliges your bank to check, before you authorise a transfer in euros, whether the payee name you entered matches the holder of the IBAN. It does so by consulting the receiving bank immediately after you enter the details and before offering you the possibility of authorising the transfer, and whatever the channel: app, online banking, cash machine or the branch itself.

The result has legal consequences. If the name does not match, the bank must warn you that authorising may send the funds to an account whose holder is not the payee you indicated; if it is a close match, it must show you the real holder's name. If your bank did not offer you the service, or provided it defectively (for example, by confirming a match that did not exist), it is liable to you and must refund the amount; if the failure lay with the receiving bank in answering the request, it is that bank that compensates yours, and not you who has to pursue it. If it warned you and you went ahead, it is not liable by this route.

What nobody tells you is how little it covers. The verification compares name and IBAN; it does not check whether the holder is honest. If the adviser gave you the exact name of the account holder, whether a person who lends out their account or a front company, the system will report a match and will have worked properly. Nor does it help if you were made to send the money to an account in your own name at a crypto exchange or a neobank, or for transfers made before 9 October 2025 or not made in euros within the Union. That is why the first thing we request is the record of what the system showed you on each order.

When the bank could have spotted the scam: its duty of care

Beyond Verification of Payee, the route is breach of contract. Article 1101 of the Civil Code requires compensation from whoever is negligent in performing their obligations, and article 1104 defines that negligence as the omission of the care required by the nature of the obligation and corresponding to the circumstances of the persons, the time and the place. A bank that holds a customer's savings and executes their payments is not a letterbox: the customer's age and their usual way of using the account are part of those circumstances.

Ley 10/2010 on the prevention of money laundering reinforces the argument. Its article 6 requires transactions to be scrutinised to check that they match the customer's profile, and article 17 requires special attention to any transaction or pattern of behaviour that is complex, unusual or without an apparent economic or lawful purpose, or that shows signs of simulation or fraud. That law protects the public interest and breaching it does not, on its own, give a right to compensation, but it shows that the bank had the means and the duty to spot the anomaly. And in 2025 the Tribunal Supremo, in a case of transactions carried out by third parties, held that a bank which disregarded the warning information it had received and failed to adopt measures that would have allowed fraudulent manoeuvres to be detected had provided its service defectively.

The signals that carry weight are specific: the first international transfer you have ever made, the emptying of a deposit built up over years, several orders in a row to new payees in different countries, or the daily limit raised the same day, all the more so if the payee appeared in the public warnings of the CNMV (Spain's securities regulator) about unauthorised investment firms. The bank's call, if there was one, is evidence both ways: asking whether the transaction is yours is useless in this scam, because the honest answer is yes; the diligent thing is to ask what it is for and who asked you to make it. This is the most contested route, with no uniform approach by the courts to transfers ordered by customers themselves, and where both sides were at fault the court may split the loss.

The bank that opened the receiving account can also be liable

You have no contract with the bank that received the money, so the claim lies in tort under article 1902 of the Civil Code: whoever by act or omission causes damage to another, through fault or negligence, is obliged to repair the damage caused. The fault has to be found in how the bank opened and monitored the account. Ley 10/2010 requires it to verify with reliable documents the identity of whoever opens it and prohibits it from keeping accounts in fictitious names (article 3), and requires it to find out whether its customer is acting on their own behalf or for third parties (article 4), which is exactly what someone who lends their account to a network does not do: what is known as a money mule account.

The courts tend to require more than a formal breach of those rules: a clear lack of care and a direct link with your loss. The case is won with facts such as an account opened online with a false document, that of a student who receives dozens of transfers from strangers in a week and forwards them within minutes to an exchange, or a bank that had fraud alerts from other victims before your transfer and blocked nothing. And timing counts: if your money was still in the account when the recall request arrived and the receiving bank let it leave, that is where the causal link lies.

Two warnings change the strategy. The first is the time limit: one year from when you learned of the fraud (article 1968.2 of the Civil Code), which runs while you wait for an answer from your bank, the Banco de España (Spain's central bank) or the police, and which is interrupted by a burofax (a certified letter with proof of content) to the receiving bank (article 1973 of the Civil Code). The second is the forum: if the receiving bank is in another EU Member State, articles 17 and 18 of Regulation (EU) 1215/2012 do not protect you, because there is no contract; it is sued where it is domiciled (article 4) or where the harmful event occurred (article 7.2), and whether that place is Spain is argued case by case. Suing whoever appears as the account holder is another route, with rules of its own.

Time limits and the precondition for suing: not the same for both banks

With your own bank, the first written step is a complaint to its customer service department, which must answer within fifteen business days of receiving it; only in exceptional situations may it send a holding reply that explains the delay and states when the final answer will arrive (second additional provision of Royal Decree 736/2019). If it does not answer in time or the answer does not satisfy you, that complaint meets, for you as a consumer, the precondition for suing under Organic Law 1/2025 (seventh additional provision). That is why it is drafted as if it were the lawsuit itself: with every legal ground and the exact amount.

With the receiving bank, that shortcut does not work. The seventh additional provision refers to a complaint to the business with which you contracted, and you have no contract with the receiving bank. What is needed is the prior attempt at negotiation required by article 5 of Organic Law 1/2025, whether negotiation between lawyers, a confidential binding offer, mediation or conciliation, with what is negotiated matching what is later asked of the court; without it, the claim is not admitted. It is not needed, however, to apply for preliminary inquiries or for interim measures before filing the claim (article 5.3).

Going to the Banco de España is optional. A decision of its complaints service also satisfies the precondition, but its report does not bind the bank, can take months and does not stop the clock on the year you have to sue the receiving bank; we explain what to do with that report in a separate guide. The independent financial customer protection authority is still only a bill and is not operating as at 1 October 2026. To sue your own bank you have five years (article 1964.2 of the Civil Code), and if it is an institution from another EU Member State that directs its activities to Spain, you can do so before the Tribunal de Instancia where you are domiciled (articles 17 and 18 of Regulation (EU) 1215/2012).

The criminal complaint helps, but the civil case cannot wait for it

Report the fraud, and the sooner the better: at a police station, a Guardia Civil (Civil Guard) post, the duty court or online with later ratification, with every IBAN, every amount, every time and the screenshots. We draft the report. Besides opening the investigation, it records the date on which you learned of the fraud and it is the channel through which a judge can obtain from the receiving banks the account transaction history and the account opening records, information that will not be given to you by letter because of banking secrecy and data protection.

What you should not do is wait for the criminal case to end. These cases take years, the perpetrators are usually outside Spain, and it is unwise to count on the criminal case stopping the clock on the year you have to sue the receiving bank: a burofax interrupts that period and avoids the argument. The civil claim against the banks rests on their own conduct (what they verified, what they saw and what they did), not on the fraud itself. And article 40 of the Civil Procedure Act allows the civil case to be suspended for criminal proceedings only where their outcome may have a decisive influence, and only once the civil case is awaiting nothing but judgment.

And the warning that saves the most money: an investment scam is usually followed by a second one. Someone contacts you posing as a law firm, the police, the CNMV or a European body, knows the details of your case and offers to recover the money in exchange for an upfront payment or a supposed fee. It is the same network. Nobody can guarantee that you will recover what you transferred, and neither do we: what we do is tell you, with the bank's records in front of us, whether there is a case against the banks and how much can be claimed.

How we run the case, step by step

1. 1

   We alert your bank without delay and request the recall

   A call to the bank's fraud line and written confirmation the same day: access blocked, no further orders and a recall request for fraud on each transfer, noting the exact time. If the money is still in the receiving account, the first few hours offer the best chance of recovering it without litigation.

2. 2

   We draft the police report with every IBAN

   It sets out the timeline, the amounts, the times, the IBANs, the payee names dictated to you and the screenshots, and asks for the receiving banks to produce the transaction history and the opening records of each account. It also establishes the date on which you learned of the fraud.

3. 3

   We request your bank's own records

   In writing: the Verification of Payee result for each order, the alerts triggered, the changes of limits and payees, the authentication logs (article 44.4 of Royal Decree Law 19/2018) and the recording of any call, which is also sought through a data subject access request (article 15 GDPR).

4. 4

   We stop the clock on the year to sue the receiving bank

   A burofax to each receiving bank: it interrupts the limitation period (article 1973 of the Civil Code), asks the bank to preserve the account information and opens the prior negotiation required by article 5 of Organic Law 1/2025, on the same subject matter as the future claim.

5. 5

   We file a complaint with your bank on every ground

   The complaint to the customer service department is drafted like a lawsuit: Verification of Payee, warning signs ignored, amount and interest. If the bank does not answer within fifteen business days or gives an unsatisfactory answer, you have met the precondition for suing under Organic Law 1/2025.

6. 6

   We sue in the civil section of the Tribunal de Instancia

   With the records in front of us we decide whom to sue and on what basis: your bank, within the five years, and the receiving bank, before the year runs out, with an IT or banking expert report where the case requires it.

The law that applies

• Art. 5 quater del Reglamento (UE) 260/2012. Inserted by Regulation (EU) 2024/886 and applicable since 9 October 2025 to transfers in euros, it obliges the payer's bank to offer, whatever the channel, a service that checks before authorisation whether the payee name matches the holder of the IBAN; if it does not match, the bank must warn the payer that the funds may reach an account held by someone else, and if it is a close match, show the real name. A bank that does not provide the service or provides it defectively is liable to the payer; if the payer authorises after the warning, it is not liable by this route. 32024R0886
• Arts. 43, 44.4 y 59 del RDL 19/2018. Rectification of an unauthorised or incorrectly executed transaction requires the user to notify the bank without undue delay and in any event within thirteen months of the debit, unless the bank failed to provide the information on the transaction (article 43). The bank must keep for at least six years the records showing compliance with its obligations and hand them to the user on request (article 44.4). An order executed in accordance with the unique identifier is deemed correctly executed with regard to the payee specified in it (article 59.1). BOE-A-2018-16036
• Arts. 3, 4, 6 y 17 de la Ley 10/2010. They require the bank to verify with reliable documents the identity of whoever opens an account, prohibiting accounts in fictitious names (article 3), to identify the beneficial owner and find out whether the customer acts on their own behalf or for third parties (article 4), to scrutinise transactions to check that they match the customer's profile (article 6) and to examine with special attention transactions that are unusual or show signs of simulation or fraud (article 17). BOE-A-2010-6737
• Arts. 1101, 1104 y 1902 CC. Those who, in performing their obligations, are guilty of fraud, negligence or delay, or in any way contravene their terms, are liable for the damage caused (article 1101); negligence is the omission of the care required by the nature of the obligation and corresponding to the circumstances of the persons, the time and the place (article 1104); and whoever by act or omission causes damage to another, through fault or negligence, is obliged to repair the damage caused (article 1902). BOE-A-1889-4763
• Arts. 1964.2, 1968.2 y 1973 CC. Personal actions with no special period must be brought within five years from when performance of the obligation can be demanded (article 1964.2); the action for obligations arising from fault or negligence under article 1902 must be brought within one year from when the injured party learned of it (article 1968.2); and limitation is interrupted by bringing the action before the courts, by a claim made by the creditor out of court and by any acknowledgment of the debt by the debtor (article 1973). BOE-A-1889-4763
• Art. 5 y disposición adicional séptima de la LO 1/2025. In civil matters, for a claim to be admitted it is a precondition to have first used an appropriate dispute resolution method, with the subject of the negotiation matching that of the dispute, except to apply for preliminary inquiries or prior interim measures (article 5). In individual consumer actions, a prior complaint made out of court to the business they contracted with is enough if it went unanswered within the legal period or the answer was unsatisfactory, as is the decision on a complaint to the Banco de España (seventh additional provision). BOE-A-2025-76
• Disposición adicional segunda del RD 736/2019. It obliges payment service providers to have a customer service department that resolves their users' complaints, dealing with every issue raised within fifteen business days of receipt at the latest; only in exceptional situations is a holding reply allowed, explaining the delay and specifying the deadline for the final answer. BOE-A-2019-18425
• Arts. 4, 7.2, 17 y 18 del Reglamento (UE) 1215/2012. Persons domiciled in a Member State are sued before the courts of that State (article 4), and in matters of tort also before those for the place where the harmful event occurred (article 7.2). In consumer contracts, where the other party directs its activities to the consumer's State, the consumer may sue it before the courts for the place of the consumer's own domicile (articles 17 and 18). 32012R1215

Each article checked against the consolidated text published in the BOE (the Spanish official gazette).

Frequently asked questions