Unrecognized card charge in Spain: getting your money back (and when to file a chargeback)

Two different tools — don't mix them up

Tool 1 — the law, for UNAUTHORIZED payments. Articles 45-46 of RD-ley 19/2018 (the Spanish transposition of the EU's PSD2 directive) order the bank to refund an unauthorized charge immediately, at the latest by the end of the next business day after you report it. The bank refunds first and investigates later: it may only refuse if it proves fraud or gross negligence on your part — and that burden of proof sits with the bank, not you.

Draft my claim — free

Tool 2 — card-scheme rules, for AUTHORIZED payments gone wrong. The chargeback (contracargo, sometimes just «devolución» in bank jargon) covers orders never delivered, insolvent merchants, double charges, wrong amounts, subscriptions billed after cancellation and counterfeit goods. It isn't statute but Visa/Mastercard rulebook — yet your bank must process the request diligently: it files the dispute on your behalf against the merchant's bank.

Choosing wrong confuses the bank and burns deadlines. Demanding a «chargeback» for a cloned card, or citing art. 45 because a shop didn't ship, routes your claim to the wrong department. First question, always: did I authorize this payment? No → art. 45. Yes, but they failed to deliver → chargeback.

The SCA angle strengthens your hand. PSD2 requires strong customer authentication (SCA — the 3DS confirmation in your banking app or by SMS) for most online charges. If the bank executed a charge without SCA where it was required, its position collapses: liability shifts to the bank or merchant. That is the star argument of a written claim. And even a 3DS-approved charge extracted by phishing is fought like other social-engineering cases — on the bank's control failures.

Cancelling the card does not cancel the subscription. Recurring payment mandates can follow your replacement card through the schemes' account-updater services. To kill a recurring charge you must revoke it with the merchant AND instruct the bank to block future recurring charges from that merchant — banks must honour that instruction for card recurring payments.

The most common cases

• Unknown online charges after a data leak or card skimming: purchases on sites you've never heard of, often small at first to «test» the card. Route: art. 45, next-business-day refund.
• The free-trial trap: a trial that silently converts to a paid subscription, and hard-to-cancel memberships that keep billing month after month. Route: revoke the mandate + chargeback for every charge after your cancellation.
• The merchant never shipped or went bust before delivering (airlines, furniture, tickets, online stores). Route: chargeback for services not provided, with the clock running from the expected delivery date.
• Double charges and wrong amounts: hotels billing twice, rental cars adding «extras» you never agreed to, inflated tips or currency conversions. Route: chargeback for a processing error, with the booking and receipt as evidence.

Your rights against the bank

• Immediate refund of anything unauthorized (art. 45 RD-ley 19/2018): the bank must credit you back at the latest by the end of the next business day after your report, restoring the account to its pre-charge state. Investigating is the bank's problem — after refunding.
• Liability capped at €50 for charges made before you report a lost or stolen card — and zero for everything after the report. If the card never left your wallet (data stolen online), in practice you owe nothing unless the bank proves your fraud or gross negligence.
• The bank cannot make a police report a precondition for the refund. The law doesn't require one: your statement that the payment isn't yours is enough. A denuncia (formal police report) is worth filing in fraud cases — it strengthens the file — but it is not a prerequisite.
• The right to have your bank file a chargeback: for authorized payments where the merchant failed (no delivery, double charge, billing after cancellation), you request the dispute and the bank presents it to the merchant's bank. The typical window is around 120 days from the charge or from the expected delivery date.
• Free escalation: the bank's customer service department (SAC — Servicio de Atención al Cliente) must resolve payment-services complaints within 15 business days; after that, a free complaint to the Banco de España; and for amounts up to €2,000 you can sue in small-claims court (juicio verbal) without a lawyer.

Deadlines: what is running, and from when

• Report an unauthorized charge the same day you spot it. There is no legal hour-count, but your maximum exposure (€50) only drops to zero from the moment of the report — and speed defuses any negligence argument.
• Absolute 13-month limit: once 13 months have passed since the debit without you reporting it, you lose the right to rectification under art. 43. Check statements even for cents — fraud starts small.
• Chargeback: roughly 120 days. The Visa/Mastercard window runs from the charge date or, for undelivered purchases, from the date you should have received the order. Waiting months for the merchant's «support team» can push you past it.
• The bank's SAC: 15 business days to answer a payment-services complaint (not the 30 days or 2 months that apply to other matters). A rejection — or silence — opens the door to the Banco de España.
• Banco de España: available once the SAC stage is exhausted (negative answer or silence within the deadline). It is free, and although its ruling isn't binding, most banks correct course before the final report.

Evidence to keep from minute one

• The statement with the charge marked: screenshot and PDF of the transaction with date, amount and the merchant name exactly as shown. Multiple charges? List them all — the full series proves the pattern.
• Your report to the bank with a timestamp: the reference number from the 24/7 phone line, a screenshot of the in-app chat, a copy of the form. The report date fixes your liability caps and starts the file.
• For purchase disputes: the order, the confirmation, the promised delivery date, your emails to the seller and their replies (or silence), and proof of subscription cancellation — a dated «cancelled» screenshot, the confirmation email, the free-trial terms.
• For fraud: any trace of the scam (SMS, phishing email, fake site) and the denuncia if you filed one. And delete nothing — the merchant account, browser history and «old» emails are exactly what the bank will ask for.

How to claim, in order

• Classify the charge: did you authorize it? No (cloned card, stolen data, a purchase you never made) → the art. 45 fraud route. Yes, but the merchant failed (no delivery, overcharge, billing after cancellation) → the chargeback route. Everything else follows from this answer.
• Block the card and report through the bank's 24/7 channel (phone or app) the moment you spot the charge. Ask for a reference number. Blocking stops new fraudulent charges; the report activates your €0 cap.
• File the claim in writing: for fraud, cite art. 45 of RD-ley 19/2018 and demand the refund within the legal deadline (next business day), flagging the absence of SCA if the charge ran without 3DS; for a purchase dispute, formally request a chargeback attaching the order, the cancellation and the emails. In writing, with proof of receipt — phone calls leave no file.
• If it's a subscription: revoke the recurring payment with the merchant (a dated email, even if they ignore it) AND instruct the bank in writing to block future recurring charges from that merchant — including on the replacement card. The bank must honour that instruction.
• If it's fraud, file a denuncia with the Policía Nacional or Guardia Civil, attaching statements and screenshots. Not a precondition for the refund, but it strengthens your file with the bank, the Banco de España and any future court case.
• If the bank refuses or goes silent, complain to the SAC (15 business days to answer), then to the Banco de España — free — attaching the whole paper trail.
• Last resort: small-claims court. Up to €2,000 you need no lawyer, and with a documented chronology — report, written claim, SAC silence, Banco de España report — the bank's position is weak.

Mistakes that cost money

• Using the wrong tool: demanding a «chargeback» for a cloned card, or invoking art. 45 because the shop didn't ship. The claim lands in the wrong pipeline while the deadlines keep running.
• Cancelling the card and assuming the subscription died with it. The recurring mandate survives and can reappear on the new card via account-updater services. You must revoke with the merchant and order the block from the bank — in writing.
• Letting the ~120-day chargeback window close while waiting for the merchant's «support». Negotiate if you like, but file the dispute with your bank before it expires — you can always withdraw it if the seller pays.
• Accepting «you confirmed it with 3DS, there's nothing we can do» as final. Neither missing SCA nor a 3DS extracted by phishing closes the case — those are precisely the arguments that win in writing and before the Banco de España.
• Paying «subscription cancellation» or «fund recovery» services. The first charge you for an email you can send yourself; the second are, frequently, round two of the same scam.
• Destroying evidence: deleting the merchant account, the order emails or the cancellation screenshot. Without that trail, the chargeback collapses the moment the merchant contests it.

If the bank says no

• Demand the refusal in writing and take it to the bank's SAC with your documented claim. For payment services the SAC has 15 business days to resolve; silence counts as a rejection and opens the next door.
• Play the SCA card: ask in writing whether the charge was executed with strong customer authentication and which factors were used. If there was no 3DS where it was required, liability shifts to the bank and its refusal loses its footing — say so in exactly those terms.
• Complain to the Banco de España: free, online with a digital certificate or on paper. Attach the full chain (report, claim, SAC answer). Many banks refund on receiving the referral, without waiting for the final report.
• If the merchant contests your chargeback (re-presentment), that is not the end: you can answer with your evidence — the dated cancellation, the delivery promise never kept — and the bank must pass it on. And for amounts up to €2,000, small-claims court without a lawyer remains open.

Related guides

Frequently asked questions

Official sources