The legal framework
Article 248 of the Penal Code defines fraud (estafa) as deception sufficient to cause error and a disposal of assets to the victim's or a third party's detriment, including by computer manipulation, punished with 6 months to 3 years (a fine if under 400 euros, article 249, as reformed by Organic Law 14/2022); article 250 raises it to 1 to 6 years when the value exceeds 50,000 euros, many people are affected, personal relationships or the victim's vulnerability are abused, or it is committed by forgery or impersonation, and to 4 to 8 years above 250,000 euros. Reports go to any Policía Nacional station (Central Technological Investigation Brigade), Guardia Civil post (Telematic Crime Group), the duty court or the prosecutor; INCIBE's 017 line gives free guidance and the Internet User Security Office publishes alerts. Banks must refund unauthorised transactions within one business day (Royal Decree-Law 19/2018, transposing PSD2) except for the customer's gross negligence, and case law (Supreme Court 2024 and provincial courts) increasingly compels refunds of bank-impersonation fraud (phishing, smishing) where the bank's security failed, but not transfers knowingly made to a virtual 'fiancé'; complaints go to the bank's customer service and then the Bank of Spain. Spain recorded more than 470,000 cybercrimes in 2024, 90 % fraud, with romance scams costing tens of millions a year and victims mostly over 50.
British residents in Spain are targeted by two kinds of fraud: the online romance and 'crypto investment' scams that hit everyone, and Spain-specific schemes aimed at expatriates — fake solicitors and 'recovery agents' for timeshare victims, bogus property-tax refunds, fake gestores and cold-calling 'financial advisers' on the Costa del Sol. Age, isolation and language are the vulnerabilities the scammers exploit, and Spanish police and INCIBE publish alerts in English.
Where the money went decides who can help. A Spanish bank account: report in Spain (the police can freeze Spanish receiving accounts within hours), complain to the bank and, if refused, to the Bank of Spain. A UK bank account or card: Action Fraud (or Police Scotland) and the UK bank, with the Financial Ombudsman if refused, and since October 2024 the UK's mandatory reimbursement of authorised push-payment fraud up to 85,000 pounds — a protection that does not exist in Spain, where a transfer you made yourself is not refunded.
Key points
| Offence | Fraud: 6 months to 3 years (article 248); 1 to 6 years above 50,000 euros, many victims or vulnerability (article 250); 4 to 8 years above 250,000 |
|---|---|
| Report | Police station, Guardia Civil, duty court or prosecutor; guidance on 017 (INCIBE); some reports online with a digital certificate |
| Bank refund | Unauthorised transactions refunded within a day (RDL 19/2018); bank impersonation increasingly refunded by the courts; voluntary transfers not |
| Platforms | Obliged to remove reported profiles (DSA); dating apps not liable for the damage save negligence |
| Limitation | 5 years for basic fraud, 10 for aggravated |
| UK side | Action Fraud; UK banks must reimburse authorised push-payment fraud up to 85,000 pounds since October 2024; Financial Ombudsman |
| Figures | More than 470,000 cybercrimes in 2024, 90 % fraud (Ministry of the Interior); romance scams: tens of millions in losses, victims mostly over 50 |
In practice
- Report as soon as possible with all the evidence (conversations, profiles, transfer receipts, cryptocurrency addresses): the police can request the freezing of receiving accounts in Spain within hours; ask for a copy of the denuncia — you will need it for the bank and insurers.
- Call the bank immediately to attempt a recall of the transfer; if the receiving account is Spanish and still has funds, it is sometimes recovered.
- Complain in writing to the bank's customer service and, without a reply in 15 days or with a refusal, to the Bank of Spain; for impersonation fraud, civil courts have sided with many victims.
- Report the profile to the platform and to the Internet User Security Office; do not respond to 'recovery agencies' or supposed lawyers or police who make contact afterwards — they are the same network, and timeshare victims are their favourite prey.
- For money sent from a UK account, report to Action Fraud and your UK bank as well: the UK reimbursement rules for authorised push payments may apply even though the fraudster was in Spain.
Cost and coverage
Report and 017 free; complaint to the Bank of Spain free; civil proceedings require a lawyer and procurador above 2,000 euros (legal aid according to income).
Recent changes
Organic Law 14/2022 reordered the penalties for fraud; the Supreme Court strengthened in 2024 the liability of banks in impersonation fraud; verification of the payee's name on transfers came into force in October 2025; the police dismantled in 2024 and 2025 romance-scam networks based in Spain operating from call centres, some targeting British and German pensioners.
Where to go
- 017 — INCIBE: free guidance on cybersecurity and scams (9 am to 9 pm).
- Policía Nacional — Central Technological Investigation Brigade; Guardia Civil — Telematic Crime Group.
- Bank of Spain — complaints against banks; Internet User Security Office (osi.es): alerts and guides.
- Action Fraud (UK) and the Financial Ombudsman Service for UK accounts; British consulates for lists of lawyers.
Worth knowing
The law punishes fraud well, but money sent voluntarily to a stranger is not refunded by a Spanish bank and is rarely recovered by the police once it has left Spain: the only defence is never to send money to someone you have not met in person. The second fraud — 'recovering' the money for a fee — almost always follows the first, and British timeshare owners have paid it for decades.
Frequently asked questions
I sent money from my Spanish account to someone I met online — will my bank refund me?
No, if you authorised the transfer yourself: Spanish law (and EU payment rules) oblige banks to refund only unauthorised transactions. Report to the police at once so the receiving account can be frozen, and ask your bank for a recall. If the fraud involved impersonation of your bank (a call or text that led you to give codes), Spanish courts increasingly order refunds — complain in writing, then to the Bank of Spain.
Does it help to report to Action Fraud as well?
Yes, if any UK account, card or company was involved: Action Fraud feeds UK investigations and your UK bank may have to reimburse an authorised push payment under the rules in force since October 2024. For a purely Spanish loss, the Spanish denuncia is what matters; Action Fraud will not investigate abroad.
How do I recognise the Costa scams aimed at expatriates?
Cold calls or emails offering to recover timeshare money, property-tax refunds or 'compensation' for a fee; 'advisers' selling unregulated investments; fake lawyers and gestores. Check any firm with the CNMV (investments), the Bar association (lawyers) and the official gestor register; never pay upfront for recovery; and ask the consulate or a registered lawyer before paying anything. Genuine refunds from the Spanish tax agency never require a fee.
Official sources and links
- Penal Code — articles 248-251 bis (fraud) — consolidated text
- INCIBE — 017 and guides on scams — National Cybersecurity Institute
- Action Fraud (UK) — reporting fraud involving UK accounts
- Administración General del Estado — administracion.gob.es — official portal of Spanish public services, with pages in English
- Boletín Oficial del Estado (BOE) — Spanish legislation, official and consolidated texts
- British Consulates in Spain — gov.uk — living in Spain guide, consular help, lists of English-speaking lawyers