Bizum and WhatsApp Scams in Spain: How to Defend Yourself (Victim or Accused)

Bizum is the instant payment service built into the apps of most Spanish banks: money moves between accounts in seconds, using only the recipient's mobile number. The account holder orders each Bizum from their own banking app, and almost everything depends on that detail: if you sent it because you were deceived, the payment is authorised and is not simply cancelled; if someone else operated your account or your phone without your consent, your bank has other obligations.

What to Do (and What Not to Do) If You Have Been Scammed via Bizum or WhatsApp

If you sent the Bizum yourself, even because you were deceived, the payment counts as authorised (Art. 36.1 of Royal Decree-Law 19/2018): once your bank has received the order, you cannot revoke it (Art. 52.1). So the order matters:

1. Tell your bank straight away through its fraud channel: explain that it is a scam, ask it to alert the recipient's bank and, if the scammer may have your security details, to block your cards and online access.
2. Keep the evidence: delete nothing; screenshot the chat, the profile and the number, export the conversation if you can and keep the Bizum receipt and any texts, emails or links received.
3. Report it as soon as possible to the National Police (Policía Nacional), the Civil Guard (Guardia Civil) or the duty court (juzgado de guardia); our guide I've been scammed: what do I do? also covers other payment methods.
4. If someone may have got into your online banking or your phone (you were asked for codes, installed an app at a supposed technician's request or suddenly lost your mobile signal), change your passwords from another device and tell your mobile operator: that points to an unauthorised payment.

What not to do: send more money to “unlock” what you lost; pay upfront anyone who claims they can recover it, which is another scam; delete messages; or tell the scammer you are going to report them.

Will the Bank Refund the Money? Authorised or Unauthorised Payment

The answer lies in the EU Payment Services Directive (PSD2), transposed in Spain by Royal Decree-Law 19/2018 of 23 November, which distinguishes two situations:

• Unauthorised payment: a third party operated your account without your consent, using stolen credentials, a duplicate SIM or your stolen phone. The bank must refund the amount immediately and, at the latest, by the end of the next business day after noticing or being notified of it, unless it has reasonable grounds to suspect fraud and reports them in writing to the Bank of Spain (Art. 45.1). If you deny authorising the payment, the bank must prove that it was authenticated, accurately recorded and not affected by a technical breakdown (Art. 44.1).
• Payment authorised through deception: you sent the Bizum believing your supposed son or daughter, a fake bank employee or a non-existent seller. That refund regime does not apply: the money is claimed mainly from the scammer, in the criminal proceedings.

The customer bears all the losses if they acted fraudulently or failed, deliberately or through gross negligence, to protect their security credentials and to report the problem without undue delay (Arts. 41 and 46.1), but the bank must prove it (Art. 44.3); if the bank did not require strong customer authentication, the customer only bears losses caused by their own fraud (Art. 46.2). Notice must be given without undue delay and, in any event, within thirteen months of the debit date (Art. 43.1). If you were tricked into reading out a code over the phone, which regime applies is argued case by case.

SIM Swapping, Phishing and Smishing: When Someone Else Makes the Bizum

In SIM swapping, the criminal impersonates you to your mobile operator, obtains a duplicate SIM card and receives the bank's verification texts; with them, they enter your online banking and send Bizum payments to accounts they control. In phishing and smishing (phishing by text message), the key is the credentials you typed into a fake website linked from an email or a text. Either way, you are not the one ordering the payment: criminally, it is computer fraud under Art. 249.1.a of the Criminal Code (CP); for the bank, an unauthorised transaction. Tell your bank and your operator, and ask the operator for the details of the duplicate SIM request for your complaint.

Where to Report It and How to Claim the Money

A complaint (querella or denuncia) can be a simple report to the police, the duty court or the Public Prosecutor's Office (denuncia), which needs no lawyer, or a querella, which makes you a party from the outset and is filed through a court representative (procurador) and signed by a lawyer (Art. 277 of the Criminal Procedure Act, LECrim); foreign nationals may bring one for offences against them or their property (Art. 270 LECrim), although, unless a treaty or reciprocity exempts them, they must post a bond set by the court (Arts. 280 and 281 LECrim).

Go to a National Police station, a Civil Guard post or the duty court, which handles urgent matters, with your identity document (DNI, foreign resident's TIE card or passport) and an orderly account of events, including:

• the conversation, as screenshots or exported, with the sender's number;
• the receipt for each Bizum, showing the recipient's number or name, and your bank statement;
• any links, text messages, emails or adverts received, and your call log;
• a list of all the payments, if there were several or to several people.

If you do not understand or speak any of the languages that are official where you file the complaint, you are entitled to language assistance and a written translation of your copy of it (Art. 6 of Law 4/2015 on the Statute of Victims of Crime).

In the criminal proceedings, the civil claim goes with the criminal one unless you waive it or expressly reserve it (Art. 112 LECrim): whoever is criminally liable must also make good the loss caused (Art. 116 CP), through restitution, repair of the damage and compensation (Arts. 109 and 110 CP). You can join as a private prosecutor (acusación particular), a party with its own lawyer alongside the Public Prosecutor's Office, before the charges are formally set out (Art. 110 LECrim), to drive the investigation and seek precautionary measures securing the financial liabilities (Art. 764.1 LECrim). Not joining does not mean giving up compensation.

With the bank, file a written complaint with its customer service department, which must reply within fifteen business days, or one month in exceptional cases (Art. 69 of Royal Decree-Law 19/2018); if unsatisfied, you can then turn to the Bank of Spain's complaints service, which issues a reasoned report (Art. 30 of Law 44/2002). Both routes are compatible with the criminal complaint. A conviction does not by itself return the money: that depends on identifying whoever is responsible and on their having assets, or on the money still being traceable.

The Most Frequent Types of Bizum and WhatsApp Scam

• The “child in trouble” or fake relative: a message from an unknown number (“Mum, my phone is broken, this is my new number”) and, straight away, an emergency: a payment needed today, often to someone else's account. If it comes as a call, with a voice imitating your relative's, it is a form of vishing (voice phishing).
• Fake bank support: a text or a call warns of a suspicious charge and guides you to “cancel” it; in reality, you end up sending a Bizum, reading out a code or installing a remote-control app.
• The fake sale or rental: goods never sent, or deposits to reserve a flat that does not exist or is not available.
• The fake buyer: someone posing as a buyer sends you a link to “receive a Bizum payment” that leads to a fake page capturing your card or online-banking details.
• Reverse Bizum: a request for money is presented as an incoming payment; by accepting it, you pay.
• Romance or investment scams: after weeks of conversation, you are asked for money for an emergency or to invest in a non-existent platform.

Which Offence Is It and What Is the Penalty? Table by Type of Scam

What matters is who orders the payment: if the deception leads you to make the Bizum, it is fraud under Art. 248 CP; if the scammer executes it from your online banking or with your payment details, it is the offence in Art. 249.1 CP. Both start at six months to three years in prison:

The 400-euro rule is in the third paragraph of Art. 248 CP and only covers fraud by deception, where a fine of one to three months makes it a minor offence (delito leve). For Art. 249.1, the State Public Prosecutor's Office (Fiscalía General del Estado) concluded that Organic Law 14/2022 abolished its minor form and that, even where the loss does not exceed 400 euros, prosecutors are to seek six months to three years in prison (FGE Consulta 1/2024 of 21 March). In a continuing offence against property, the penalty reflects the total loss caused (Art. 74.2 CP): several small payments add up. Fines are day-fines: days or months at a daily rate of 2 to 400 euros, set according to the offender's financial means (Art. 50 CP).

New in 2026: Repeat Offending in Small-Value Scams

Organic Law 1/2026 of 8 April, in force since 10 April 2026, added two exceptions to that 400-euro rule: it does not apply if an Art. 250 CP circumstance is present, or if the offender has been convicted by final judgment of at least three offences of the same nature within the chapter on fraud-type offences (defraudaciones), at least one of them a minor offence. In that second case, the prison sentence of six months to three years in Art. 248 CP is imposed. Records that have been expunged, or should have been, do not count. For an accused person with a record, checking whether those convictions are final and should already have been expunged is a central line of defence.

If You Are Accused of a Bizum Scam: How the Defence Is Built

Not everyone investigated over a Bizum is a scammer: holders of bridge accounts, sellers whose sale went wrong and people whose identity was used without their knowledge also end up in court. The usual lines of defence:

• Holding the account is not committing the offence: a Bizum reaching your account proves where the money went, not who devised the deception. Who used the phone, from which devices the account was operated and whether there was identity theft must all be examined.
• The deception must come first and be sufficient: if the item existed and was sent, or the deal went wrong later, the problem is usually civil; see the difference between fraud and breach of contract.
• Classification and amount: fraud under Art. 248 CP is not the same as the Art. 249.1 CP offence, and the penalty depends on the amount and on whether there is a continuing offence.
• Repairing the harm: returning the money, or reducing the harm, before the trial is a mitigating circumstance (Art. 21.5 CP).

Do not make a statement without a lawyer: you have the right to remain silent and not to answer some or all of the questions (Art. 118.1.g LECrim) and, if you do not speak or understand Spanish or the official language in which the proceedings are conducted, to an interpreter, including at the police interview (Art. 123.1.a LECrim). Do not pressure the complainant to withdraw either: fraud is prosecuted ex officio (de oficio), whatever the victim later decides, and that contact can be used against you.

Used as a Money Mule: If You Received and Forwarded Money Through Your Account

Many Bizum scams rely on bridge accounts: people recruited through a work-from-home or “payment manager” job offer, or as a favour to an acquaintance, who receive the money and forward it or withdraw it in cash for a commission. Their liability depends on what they knew or should have known:

• If you knew about the plan and took part in it, you may be liable for the fraud itself as a necessary cooperator or accomplice (Arts. 28 and 29 CP).
• If you knew the money came from an offence and transferred it or helped hide its origin, Art. 301.1 CP punishes money laundering with six months to six years in prison and a fine of one to three times the value of the assets.
• If you did not know, but the signs were so clear that missing them was gross negligence, negligent money laundering under Art. 301.3 CP may apply: six months to two years in prison and a fine of one to three times the value.

The defence reconstructs what the person could have known: how the offer reached them, what they were told, how much they earned for what they did and whether they stopped as soon as they became suspicious. The Supreme Court has also recalled that money laundering requires acts aimed at concealing or disguising the unlawful origin of the assets, and not the mere possession or use of the money (STS 123/2026, of 12 February). No line of defence can promise an outcome: everything depends on the evidence. More on our page on money mule defence.

At Alonso Sala, with more than 15 years of experience in criminal law, we act as private prosecutor for victims of online fraud and defend people under investigation, including those whose account or identity was used. You can call us on +34 91 078 65 74 for an initial assessment of your case.