Bizum and WhatsApp Scams in Spain: How to Defend Yourself (Victim or Accused)

Bizum and WhatsApp scams have become one of the most frequent frauds in Spanish courts. As criminal lawyers specialising in cyber scams, we explain the forms, how to claim if you are a victim and how to defend yourself if you are accused. (Bizum is Spain's instant mobile payment system.)

The 5 Most Frequent Bizum/WhatsApp Scam Forms

1. Reverse Bizum: the scammer sends you a "payment request" disguised as a charge. You think you are receiving money, but you are actually sending it.
2. The "child in trouble" WhatsApp: a message from an unknown number: "Mum, my phone broke, this is my new number. I need you to send me an urgent Bizum."
3. The buyer scam on second-hand platforms: the "buyer" sends you a fake "Bizum payment" link redirecting you to a phishing site.
4. Company impersonation: a WhatsApp that appears to be from your bank or a delivery company asking you to make a Bizum payment.
5. Romance scam: after weeks of conversation, the person asks for urgent money by Bizum for an "emergency".

If You Are a Victim: How to Act in the First Hours

1. Do NOT delete the WhatsApp conversation: it is your main evidence. Screenshot the profile, phone number, messages and the Bizum receipt.
2. Contact your bank immediately: request the reversal of the Bizum. It is instant and irrevocable, but if you act within minutes, the receiving bank could block the funds.
3. Police report: report online or in person, providing screenshots and the scammer's number.
4. Claim against the bank: if the bank did not implement sufficient security measures (PSD2 strong authentication), it may be jointly liable and obliged to reimburse you.
5. Private prosecution: if the amount is significant, a criminal lawyer acting as a private prosecutor drives the judicial investigation far more aggressively than a simple report.

If You Are Accused of a Scam: Criminal Defence

Many people are accused of a Bizum scam without being real scammers:

• Money mules: people who received a "work from home" offer and agree to receive Bizum payments in their account to forward to third parties for a commission. They are victims of recruitment, but may be accused as necessary cooperators.
• Commercial misunderstandings: second-hand sellers accused of fraud when there was really a problem with the shipment.

Our defence focuses on proving the absence of prior deceit (antecedent intent), the seller's good faith or ignorance of the fraudulent origin of the funds.

Penalties for Online Fraud

• Minor fraud (up to 400 euros): a minor offence with a fine of 1 to 3 months, unless the repeat-offending rule applies (explained below).
• Basic fraud (over 400 euros): prison of 6 months to 3 years (Art. 248 CP). Computer fraud — manipulating information systems or fraudulently using another person's payment data, the typical phishing scheme — carries the same penalty (Art. 249.1 CP).
• Aggravated fraud (Art. 250 CP): prison of 1 to 6 years where, among other circumstances, the amount defrauded exceeds 50,000 euros or the fraud affects a large number of people, which is common in mass phishing and smishing campaigns.
• If the amount exceeds 250,000 euros (Art. 250.2 CP): prison of 4 to 8 years.

New in 2026: Repeat Offending in Small-Value Scams

Many Bizum scams are, taken individually, of small value: charges of 50, 100 or 300 euros that until now were punished as a minor offence with a simple fine. Organic Law 1/2026, of 8 April, in force since 10 April 2026, has changed that rule: where the offender already has at least three final convictions for offences of the same nature (at least one of them for a minor offence), a fraud not exceeding 400 euros is punished with the penalty of the basic offence: 6 months to 3 years in prison (Art. 248 CP). Expunged records, or records that should have been expunged, do not count.

The reform cuts both ways. For the victim, it reinforces the value of reporting even small frauds: every conviction counts, and serial scammers no longer walk away with token fines. For an accused person with a record, the stakes are far higher: a 200-euro Bizum can now be argued in terms of prison, so reviewing whether prior convictions are final, of the same nature and not expunged becomes an essential line of defence.

Will the Bank Refund the Money? The PSD2 Directive

The PSD2 Directive protects the user against unauthorised payment operations. The bank must reimburse unauthorised operations unless it proves that the operation was correctly authenticated (strong customer authentication) or that there was gross negligence by the user. Spanish case law is being very favourable to phishing victims: if the bank did not implement biometric authentication or second-channel verification, liability falls on the bank.

Frequently Asked Questions

Can a Bizum be traced? Yes. Bizum is linked to a bank account with an identified holder. The police can ask the receiving bank for the identity of the destination account holder.

Can I recover a Bizum sent by mistake? Bizum is instant and irrevocable. You must contact the recipient and request a voluntary return. If they refuse, it is misappropriation.

Can I be accused of fraud if I sold something online and it did not arrive? It depends. If the product existed and you really sent it and it was lost in transit, it is NOT fraud (a civil matter). If the product never existed, it IS fraud.