Bizum scam in Spain: how to get your money back

How Bizum works and why recall is hard

Bizum is not a separate company holding your money: it is Spain's instant account-to-account payment system, tied to your phone number and operated entirely inside your own bank's app. When you confirm an operation, the money leaves your account and lands in the recipient's account within seconds. There is no holding period and no cancel button — which is precisely why scammers love it.

Draft my claim — free

A refund is never guaranteed technically. Your bank can only file a retrocesión (a recall request) with the recipient's bank, and that bank needs its client's — the scammer's — consent, or a court order, to send the money back. That is why every hour counts: if the funds have not yet moved on from the destination account, a fast freeze can still save them.

The core trick you must understand: the «solicitud de dinero» (money request). Bizum has two opposite operations — sending money and requesting it. The scammer (the classic fake «buyer» on Wallapop) sends you a REQUEST and tells you it is «the payment». The victim confirms it in the app believing they are ACCEPTING an incoming transfer, when in fact they are authorizing an outgoing payment. The tell: the operation summary shows a minus, not a plus.

The decisive legal distinction: if money left with no action on your part (stolen phone, phished credentials, SIM-swap), it is an UNAUTHORIZED transaction and the bank must refund it by law, fast. If you confirmed the operation yourself — even under deception — it legally counts as an authorized payment, and banks routinely refuse these refunds in their first answer.

But that first refusal is not the end. Banco de España criteria and a growing line of court rulings hold the bank liable where social engineering exploited weaknesses in its own controls: spoofed SMS landing in the bank's official message thread, calls placed from the bank's official number, no fraud alert on a transaction completely outside your pattern. Every case turns on its facts — which is exactly why the written claim is always worth filing.

The most common scams

• The fake marketplace buyer on Wallapop, Vinted or Milanuncios. They are in a rush to buy, claim they have «already sent the Bizum» and pressure you to confirm the notification. That notification is a money request: by confirming it, you pay them. A variant: a payment «to reserve» an item or a rental flat that does not exist.
• The «hijo en apuros» (child in trouble) WhatsApp scam. An unknown number writes: «Mum/Dad, my phone broke, this is my new number, I need an urgent Bizum». It weaponises a parent's panic; several transfers are often chained within an hour. The golden rule — too late for this guide, invaluable for next time — is to always call the old number.
• Bank impersonation (spoofing). An SMS that lands in the same thread as your bank's genuine messages («suspicious operation, verify here»), or a call from the bank's official number: a supposed «fraud department» agent walks you through «cancelling» charges — while actually making you confirm payments or hand over codes. Phishing links about «your parcel», «your fine» or «your refund» belong to the same family.
• Tampered QR codes, fake investments and romance scams. A QR sticker pasted over the real one on a parking meter or poster leads to a fake payment page. «Investment platforms» and online relationships cultivated for weeks end the same way: escalating chains of Bizum transfers to mule accounts. If the promised return requires one more payment to «unlock» your funds, it is the same scam in its next phase.

Your rights: RD-ley 19/2018

• Unauthorized transaction = immediate refund. Art. 45 of RD-ley 19/2018 (Spain's payment-services law, transposing the EU's PSD2 directive) obliges the bank to refund an unauthorized transaction immediately and, at the latest, by the end of the next business day after you report it. It can only refuse if it proves — the burden is the bank's — fraud or gross negligence on your side.
• Your liability is capped. Under art. 46, for operations made with a lost or stolen payment instrument before you notify the bank, you are liable for at most €50. From the moment you report the loss or theft, your liability is zero. And if the bank did not give you a way to report at any time, you are not liable at all.
• Thirteen months as the outer limit. You can demand correction of an unauthorized or incorrectly executed transaction if you report it without undue delay after discovering it, with an absolute cap of 13 months from the debit date. Do not go anywhere near that limit — speed is your best argument — but know that a months-old charge is still claimable.
• The bank's SAC has 15 business days. For payment-services complaints, the bank's SAC (Servicio de Atención al Cliente — its official customer-service department) must answer a written claim within 15 business days, a shorter deadline than for other banking complaints. Once that period passes in silence, the next door opens automatically.
• Banco de España for free — and court without a lawyer up to €2,000. A complaint to Banco de España (Spain's banking conduct authority) costs nothing, and although its reports are not binding, they carry real weight: many banks refund on receiving one. If it does go to court, small-claims proceedings for amounts up to €2,000 require no lawyer.

Deadlines that matter

• The bank: today, the minute you discover it. A retrocesión (recall request) only has a real chance while the money is still sitting in the destination account, and that window is measured in hours. Reporting also triggers the art. 46 rule: up to €50 of liability before you report — zero after.
• The denuncia (police report): as soon as possible, ideally within 24-48 hours. It can be filed online or at any police station. Without it, almost no bank will seriously process a fraud refund, and both Banco de España and the court will expect it in your file.
• The written SAC claim: file it as soon as you have the denuncia. From that moment the bank's clock runs: 15 business days to answer a payment-services complaint. Keep dated proof of submission.
• Banco de España: the moment the SAC refuses or stays silent. Once the SAC stage is exhausted (a negative answer, or 15 business days with none), you can file the free complaint with Banco de España. No further waiting, no second attempt with the bank required.
• The absolute cap: 13 months from the debit to report an unauthorized transaction. That is the legal outer boundary, not a target. Every week of delay becomes the bank's «undue delay» argument.

Evidence to gather

• Screenshots of the entire deception before it disappears: the WhatsApp or marketplace chat, the SMS messages (with the full thread visible — especially if the fake message landed inside the bank's official thread), the call log showing the number that called you, the fake buyer's listing.
• The exact operation details from your app: reference number, date and time, amount, the recipient's phone or alias, and whether it was a payment you sent or a money request you confirmed. Screenshot the full operation detail screen.
• The denuncia and proof of every notification: when you called the bank (ask for the call reference number), when you blocked Bizum and your cards, when you filed the written claim. A precise «discovered — reported — filed» timeline is worth gold.
• Every sign that the bank's controls failed: the spoofed SMS inside the genuine thread, the call from the bank's official number, the absence of any alert or extra verification on an out-of-pattern operation (unusual amount, brand-new recipient, odd hour). These are the facts that turn a deniable «authorized payment» into a winnable case.

Steps to claim your money back

• Call the bank immediately. Block Bizum and your cards, report the fraudulent operation, expressly ask the bank to start the retrocesión with the recipient's bank and to request a freeze on the funds while they are still there. Note the date, time and reference of the call.
• File the denuncia. Online or at a police station, with all screenshots and the operation details. Ask for a stamped copy — you will need it for the bank, for Banco de España and for court.
• Send a written claim to the bank's SAC. Demand the refund citing arts. 45 and 46 of RD-ley 19/2018: immediate refund if the transaction was unauthorized; if you confirmed it under deception, argue the bank's control failures. Attach the denuncia and your evidence. The bank has 15 business days to answer.
• Document the bank's security failures. Before sending the claim, assemble the facts that point at the bank: spoofing through its official channels, no fraud alerts, an operation far outside your pattern waved through without extra verification. This is the section of the claim that changes outcomes.
• If they refuse or stay silent, complain to Banco de España. It is free, filed online, with the complete file (SAC claim, the answer or the silence, denuncia, evidence). A favourable report applies real pressure: many banks refund at this stage.
• Court as the last step. Up to €2,000, small-claims proceedings need no lawyer; above that, weigh the court route with counsel — judgments against banks in spoofing and SIM-swap cases are no longer rare.
• Never pay «fund recovery agents». Companies that contact you promising to get the money back for an upfront fee are, almost always, phase two of the same scam. The real claim circuit — bank, Banco de España, court — never requires advance payments to intermediaries.

Mistakes that cost money

• Skipping the denuncia «because they'll never catch the scammer anyway». The police report is not about catching the culprit: it is the document your bank, Banco de España and the court all require before processing a refund. Without it, the claim starts crippled.
• Delaying the call to the bank. Every hour shrinks the retrocesión's chances, and art. 46 is explicit: until you report, you are liable for up to €50; from the moment you report, for nothing. The shame that delays the call is exactly the reaction the scammer is counting on.
• Accepting the bank's first verbal «no». The standard counter answer to a payment confirmed under deception is refusal. The written SAC claim and the step up to Banco de España change outcomes with real frequency — but only if you file them.
• Paying someone who promises to recover the money. «Recovery firms» that find you (rather than the other way round) and ask for money upfront are a second scam targeting the same victim list.
• Deleting the chats or the listing «to move on». You are destroying your own evidence. Capture and archive everything before blocking the scammer.
• Mistaking a money request for an incoming payment. If the operation shows a minus in your history, you paid — you did not receive. Understanding this in time also prevents the second «retry» scammers love to ask for («it failed, confirm it again»).

If the bank says no

• The first refusal is the script, not the verdict. For payments confirmed under deception, the bank's standard reply is that «the operation was authorized by the client». That sentence closes nothing: it opens the escalation that actually works — the written SAC claim, Banco de España, court.
• Strengthen the file with the bank's own failures. What sways reports and judgments: the fraudulent SMS that landed in the bank's official thread, the call from its spoofed corporate number, the total absence of alerts on an operation outside your pattern (amount, hour, brand-new recipient), the missing extra verification. Name each failure, with a screenshot.
• Banco de España after the SAC. With the refusal in hand (or 15 business days of silence), file the free complaint with Banco de España with the full file. Its criteria in social-engineering fraud keep moving in the victim's favour, and a report finding failures on the bank's side often triggers a refund without ever reaching court.
• Court — with facts, not fury. Up to €2,000 you can sue without a lawyer. Recent case law holds banks liable for failing to flag manifestly anomalous operations and for letting spoofing ride in through their own channels. A tidy file — timeline, denuncia, evidence, prior claims — is what turns that case law into your case.

Related guides

Frequently asked questions

Official sources