Calling from your bank

The call shows the bank’s own number. The caller knows the customer’s name and the last card payment. There is a suspicious transaction, he says, and the money must be moved to a safe account now, or a code read out to stop the charge. By the time the customer calls the real bank, the money has gone.

Then comes the complaint. Payments made “in contexts of deception or scam”, as the Banco de España puts it, were the largest single subject of complaints to it in 2025. They made up 30% of the 30,970 it received, up 18% on the year before. Two-thirds were card payments, a third transfers. In the first four months of 2026, complaints to the regulator rose by more than half, and the Banco de España says the rise is mainly about fraud.

Who pays depends on the law and on proof. Under Spain’s payment services law, a bank must refund a payment its customer did not authorise, no later than the end of the next business day. The record that a card or a code was used does not, on its own, prove that the customer authorised the payment. It is for the bank to prove fraud or gross negligence by the customer. When the customer pressed the button, talked through it by a caller posing as the bank, the case is harder for both sides. That is where it ends up: in the complaints queue.

The rules are moving. Since 15 September, Spanish mobile operators must block text messages whose sender name is not registered with the CNMC, the competition regulator. That makes it harder to send an SMS under a bank’s name. The EU’s new payment services regulation, agreed in November 2025, goes further. A customer tricked into paying by someone posing as their bank gets a right to a full refund, if they report it to the police and the bank. The text is agreed but not yet in force. On current estimates it applies from 2028.

Most of the debate is about who pays. Less is said about what the complaints contain. A fraud complaint is the victim’s own account of the attack: the number that called, what the caller already knew, the words that made it convincing, the screen the app showed, the moment the customer realised. A transaction log shows that money left. Only the customer can say how they were persuaded to send it.

That makes the complaints the first place a new scam shows up. Its first victims write in before anyone has counted the losses. Read one at a time, each case looks like bad luck. Read together, by script rather than by product, they show the pattern: the caller who knew the last payment, the courier sent to collect the card, the investment advert with a familiar face.

Reading them that way takes three changes. The complaint’s text has to reach the fraud team, not just the case file. Someone has to read across the week’s complaints and group them by how the customer was deceived. And the same reading should look at the bank’s own part. Did the customer try to call the bank during the attack, and how long did they wait? Did the app warn them? Was the decision on one case the same as on its twin?

Consistency matters because a refusal does not end the case. A refused customer can go to the Banco de España, and in 2025 banks put matters right in 3,585 complaints once the regulator was involved, across all subjects. A refusal that a twin case contradicts is unlikely to survive that second look.

The register will not stop fraud, and neither will the EU’s refund rule. But every victim who complains has already done the hardest part of the investigation: they have written down what happened. A bank that reads those accounts together will see the next scam while it is still small. One that reads them one at a time will find it in next year’s report.