Online, phone and payment fraud

It is for anyone thinking about, planning or carrying out a move to Spain. Read it before you arrive, or as soon as you start dealing with Spanish banks and offices.

Start with "Spotting fake bank, Correos, DGT and tax-office messages". It covers the most common scam and teaches the habits that protect you from most of the others. If you think you have already been scammed, go straight to "You have been scammed: who to call first and in what order", because the first hours matter.

Key rules

• Card chargeback: Card disputes can generally be made up to 120 days from the transaction date or the date the goods should have arrived.
• Reporting window: Tell your bank about an unauthorised payment without delay and in any case within 13 months of the debit date.
• Tell your bank first: Call your bank's fraud line straight away, using the number on your card or in its app, because speed decides whether money can be stopped.
• INCIBE helpline: You can call 017 for free, confidential advice every day from 9:00 to 21:00, but it gives advice and does not take formal police reports.
• Links: Genuine tax, traffic and Social Security offices do not ask you to pay or enter data through a link in a text or email.
• Bank codes: Never give anyone your PIN, password or SMS codes, and never install remote-access apps at a caller's request.

Online, phone and payment fraud: the whole process, step by step

• Spot the warning signs before you click or answer (Spotting fake bank, Correos, DGT and tax-office messages; Phone calls from a fake bank agent or fake police officer): Before you click, reply or share any code

• Check the message through the official website or app, or by phoning the number on your card: Before you act on any message or call

• Call your bank's fraud line and ask it to block the card or recall the payment (You have been scammed: who to call first and in what order): Straight away, within minutes if possible

• File a denuncia with the police and keep the copy (You have been scammed: who to call first and in what order): Soon after calling the bank, the same day if you can

• If you paid by card, ask your bank in writing for a chargeback (After you've paid a scammer: recovery chances by payment method): Within 120 days of the transaction date or the date the goods should have arrived

• Report an unauthorised payment to your bank in writing (After you've paid a scammer: recovery chances by payment method): Without delay and in any case within 13 months of the debit date

• If your identity was used, check your credit files, loans and work record, then challenge any contract or debt in your name (Someone is using your identity: stopping misuse of your documents): As soon as you notice something you do not recognise

• If the bank refuses to refund, complain to its customer service department, then to the Banco de España: After the bank's written refusal

Documents you may need

Identity and residence

• Your original ID

Income and work

• The company's reply — Someone is using your identity: stopping misuse of your documents

Payments and receipts

• A receipt or translation of the denuncia in a language you understand — You have been scammed: who to call first and in what order

Other documents

• Your evidence — Romance scams and sextortion online, You have been scammed: who to call first and in what order
• The copy of your denuncia with its number — Romance scams and sextortion online, You have been scammed: who to call first and in what order
• Copy of your police report — Someone is using your identity: stopping misuse of your documents
• Your .pfx backup file of the certificado digital — Protecting your digital ID (Cl@ve), SIM and accounts from takeover
• Your CIRBE report from the Banco de España — Someone is using your identity: stopping misuse of your documents
• Your work history report — Someone is using your identity: stopping misuse of your documents

Online, phone and payment fraud: questions that cross several articles

How can I check whether a message from the tax office, DGT or Social Security is real?

Type the official web address into your browser and log in with Cl@ve or a certificate to see whether the notice exists. These bodies do not send links by SMS or email asking for payment or data. Read Spotting fake bank, Correos, DGT and tax-office messages, and report suspicious messages to INCIBE on 017.

What should I do if a caller shows my bank's real number?

Hang up and call the bank back on the number printed on your card or shown in its app, because scammers can display a real number. Banks never ask for your PIN, one-time codes or a transfer to a safe account. Read Phone calls from a fake bank agent or fake police officer, then You have been scammed: who to call first and in what order if you already shared anything.

Can I file a fraud report online if I do not speak Spanish?

Yes, you can start an online pre-denuncia for some offences, but you must confirm it in person at a station with your ID. You have the right to a free interpreter and to a receipt in a language you understand. See You have been scammed: who to call first and in what order.

Does a message that arrives in my bank's normal SMS thread prove it is genuine?

No, a message inside your bank's usual SMS thread can still be fake, because scammers can insert texts into genuine threads. Do not use any link in it, and go to the bank's app instead. Spotting fake bank, Correos, DGT and tax-office messages lists the other red flags.