Bizum and WhatsApp Scams in Spain: How to Defend Yourself (Victim or Accused)
In this article
Key Takeaways
- A frequent fraud in courts
- Reverse Bizum: the trap
- PSD2: the bank is liable
- 400 euros: minor, unless repeat offending
Bizum and WhatsApp scams (reverse Bizum, the "child in trouble" message, fake buyers, company impersonation or romance scams) are punished as fraud: the basic offence over 400 euros carries prison of 6 months to 3 years (Art. 248 CP), and the computer-fraud form of phishing carries the same penalty (Art. 249.1.a CP). Where it exceeds 50,000 euros or affects many people, it is aggravated fraud (Art. 250 CP, 1 to 6 years). Since LO 1/2026, fraud under 400 euros may carry the basic-offence penalty in cases of repeat offending. The victim should keep screenshots, notify the bank immediately and report it; the bank may have to refund under the PSD2 rules if it did not apply strong authentication.
Need help with your case? Talk to a criminal defense lawyer at Alonso Sala.
Bizum and WhatsApp scams have become one of the most frequent frauds in Spanish courts. As criminal lawyers specialising in cyber scams, we explain the forms, how to claim if you are a victim and how to defend yourself if you are accused. (Bizum is Spain's instant mobile payment system.)
The 5 Most Frequent Bizum/WhatsApp Scam Forms
- Reverse Bizum: the scammer sends you a "payment request" disguised as a charge. You think you are receiving money, but you are actually sending it.
- The "child in trouble" WhatsApp: a message from an unknown number: "Mum, my phone broke, this is my new number. I need you to send me an urgent Bizum."
- The buyer scam on second-hand platforms: the "buyer" sends you a fake "Bizum payment" link redirecting you to a phishing site.
- Company impersonation: a WhatsApp that appears to be from your bank or a delivery company asking you to make a Bizum payment.
- Romance scam: after weeks of conversation, the person asks for urgent money by Bizum for an "emergency".
If You Are a Victim: How to Act in the First Hours
- Do NOT delete the WhatsApp conversation: it is your main evidence. Screenshot the profile, phone number, messages and the Bizum receipt. Our online fraud victims lawyers can act as private prosecution from this first stage.
- Contact your bank immediately: request the reversal of the Bizum. It is instant and irrevocable, but if you act within minutes, the receiving bank could block the funds.
- Police report: report online or in person, providing screenshots and the scammer's number.
- Claim against the bank: if the bank did not implement sufficient security measures (PSD2 strong authentication), it may be jointly liable and obliged to reimburse you.
- Private prosecution: if the amount is significant, a criminal lawyer acting as a private prosecutor drives the judicial investigation far more aggressively than a simple report.
If You Are Accused of a Scam: Criminal Defence
Many people are accused of a Bizum scam without being real scammers:
- Money mules: people who received a "work from home" offer and agree to receive Bizum payments in their account to forward to third parties for a commission. They are victims of recruitment, but may be accused as necessary cooperators.
- Commercial misunderstandings: second-hand sellers accused of fraud when there was really a problem with the shipment.
Our defence focuses on proving the absence of prior deceit (antecedent intent), the seller's good faith or ignorance of the fraudulent origin of the funds.
Penalties for Online Fraud
- Minor fraud (up to 400 euros): a minor offence with a fine of 1 to 3 months, unless the repeat-offending rule applies (explained below).
- Basic fraud (over 400 euros): prison of 6 months to 3 years (Art. 248 CP). Computer fraud — manipulating information systems or fraudulently using another person's payment data, the typical phishing scheme — carries the same penalty (Art. 249.1 CP).
- Aggravated fraud (Art. 250 CP): prison of 1 to 6 years where, among other circumstances, the amount defrauded exceeds 50,000 euros or the fraud affects a large number of people, which is common in mass phishing and smishing campaigns.
- If the amount exceeds 250,000 euros (Art. 250.2 CP): prison of 4 to 8 years.
New in 2026: Repeat Offending in Small-Value Scams
Many Bizum scams are, taken individually, of small value: charges of 50, 100 or 300 euros that until now were punished as a minor offence with a simple fine. Organic Law 1/2026, of 8 April, in force since 10 April 2026, has changed that rule: where the offender already has at least three final convictions for offences of the same nature (at least one of them for a minor offence), a fraud not exceeding 400 euros is punished with the penalty of the basic offence: 6 months to 3 years in prison (Art. 248 CP). Expunged records, or records that should have been expunged, do not count.
The reform cuts both ways. For the victim, it reinforces the value of reporting even small frauds: every conviction counts, and serial scammers no longer walk away with token fines. For an accused person with a record, the stakes are far higher: a 200-euro Bizum can now be argued in terms of prison, so reviewing whether prior convictions are final, of the same nature and not expunged becomes an essential line of defence.
Will the Bank Refund the Money? The PSD2 Directive
The PSD2 Directive protects the user against unauthorised payment operations. The bank must reimburse unauthorised operations unless it proves that the operation was correctly authenticated (strong customer authentication) or that there was gross negligence by the user. Spanish case law is being very favourable to phishing victims: if the bank did not implement biometric authentication or second-channel verification, liability falls on the bank.
Frequently Asked Questions
Can a Bizum be traced? Yes. Bizum is linked to a bank account with an identified holder. The police can ask the receiving bank for the identity of the destination account holder.
Can I recover a Bizum sent by mistake? Bizum is instant and irrevocable. You must contact the recipient and request a voluntary return. If they refuse, it is misappropriation.
Can I be accused of fraud if I sold something online and it did not arrive? It depends. If the product existed and you really sent it and it was lost in transit, it is NOT fraud (a civil matter). If the product never existed, it IS fraud.
Victim of — or accused of — a Bizum/WhatsApp scam?
If you have been scammed, we act as a private prosecutor to recover your money. If you are accused, we dismantle the accusation by proving the absence of prior deceit.
📞 Call us: +34 91 078 65 74
Frequently asked questions
What is 'reverse Bizum' and how does it trick victims?
The scammer sends what looks like a payment request disguised as an incoming charge, so the victim believes they are about to receive money when they are actually authorizing a payment out of their own account.
What penalty does a Bizum or WhatsApp scam carry?
Basic fraud over €400 carries 6 months to 3 years in prison (Art. 248 CP), the phishing/computer-fraud form carries the same range (Art. 249.1.a CP), and aggravated fraud — over €50,000 or affecting many people — carries 1 to 6 years (Art. 250 CP).
Can a fraud under €400 still lead to prison since the 2026 reform?
Yes, in repeat-offending cases — since Organic Law 1/2026, someone with at least three prior final convictions for offences of the same nature can face the basic offence's prison penalty even for a fraud under €400, rather than the usual fine-only minor offence.
Is my bank liable if I was scammed via Bizum or phishing?
Under the PSD2 Directive, the bank must generally refund unauthorised operations unless it can prove the transaction was correctly authenticated with strong customer authentication or that the customer was grossly negligent.
Am I a criminal if I received Bizum payments as part of a 'work from home' scheme without knowing it was fraud?
Not necessarily — people recruited as unwitting 'money mules' to receive and forward Bizum payments are often victims of the recruitment themselves, and the defence in these cases focuses on proving there was no prior knowledge of the funds' fraudulent origin.
Can a Bizum payment be traced?
Yes — Bizum is linked to an identified bank account holder, and police can request the receiving bank disclose the identity of the destination account holder.
What should I do in the first hours after realizing I've been scammed via Bizum or WhatsApp?
Do not delete the conversation, screenshot the profile, messages and payment receipt, contact your bank immediately to attempt a reversal, and file a police report as soon as possible.
Do you need criminal defense in this area?
We are criminal defense lawyers specializing in cybercrime and technological criminal law. We act urgently to protect your rights.