Bizum scams: how to act and what legal steps to take

Bizum has become one of the most popular payment methods in Spain: fast, simple and available from your phone in seconds. But that same immediacy makes it an attractive instrument for fraudsters. The key feature is that, unlike an ordinary bank transfer, a Bizum payment is practically instantaneous and irrevocable: once the money leaves, it is gone. There is no grace period or automatic reversal mechanism, which makes managing the fraud more urgent.

Bizum scams do not exploit technical vulnerabilities, because the platform itself is secure, but rather the user’s trust and the speed of the operation. In most cases, the victim has expressly authorised the operation, albeit deceived, which has consequences for the bank’s liability.

The most frequent forms are several. The confusion between a payment request and a payment received: Bizum allows money to be both sent and requested, and the fraudster, in a sale, sends a payment request instead of a payment; the seller, believing they are accepting a payment, is themselves sending the money. Payment for a purchase that never arrives, the classic sale scam adapted to Bizum. The overpaying-buyer fraud, who pays too much and asks for the difference to be returned, when the first payment was fake. The smishing that simulates a Bizum alert to capture banking credentials. And the sale-with-Bizum-code fraud, in which the code requested from the victim actually authorises a transfer from their account.

Recovering the money is difficult precisely because of Bizum’s irrevocability, so the speed of action is decisive. The legal steps are several. First, call the bank immediately to request the blocking or reversal of the operation; the entity may contact the receiving bank to freeze the funds before the fraudster withdraws them. Second, file a police complaint as soon as possible, providing all the information: the phone number, the proof of the operation and the screenshots of the conversation.

Third, submit a formal written complaint to the bank requesting the return of the amount. Fourth, if the bank does not respond satisfactorily, turn to the Bank of Spain’s complaints service. And fifth, consider the judicial route, claiming the amount against the perpetrator of the fraud or against the bank if it breached its security obligations.

The bank’s liability depends on the circumstances. If the victim was deceived into authorising the operation themselves, the bank usually argues that the customer authorised it, although there are rulings that have qualified that position when the bank did not implement additional security measures. If the fraud involved unauthorised access to the account, the payment services regulations require the bank to refund unless there was gross negligence by the customer. The European Payment Services Directive establishes strong authentication obligations that may favour the consumer.

It is worth remembering that the fraudster always has a real bank account linked to their phone number, which makes their identification easier once the complaint triggers the investigation, even if that account belongs to an accomplice or a money mule.