Will BBVA Refund Scammed Money?

BBVA can refund money lost to fraud, but the refund is not automatic in every case. The bank investigates all reported cases individually and responds in accordance with applicable regulations. For unauthorised transactions, the chances of recovery are highest under PSD2 and Spanish payment law. For authorised transfers confirmed by the client under the influence of fraudsters, BBVA conducts an investigation but does not guarantee reimbursement. Immediate contact with BBVA at 900 102 801, card blocking, and restriction of account operations are the critical first steps.

When BBVA Is Obligated to Refund

The determining factor is whether the transaction was authorised by the client. Under PSD2 and Spanish payment legislation, BBVA is obligated to refund unauthorised payment transactions unless it can demonstrate gross negligence or fraud on the part of the client. BBVA states that all fraud cases are investigated individually and the response follows applicable regulations. This means the bank does not offer blanket refund guarantees but assesses each case on its specific facts. For card fraud and account compromise, speed of notification is critical – BBVA emphasises immediate contact and card blocking as the first priority.

Unauthorised Transactions

Where a transaction was executed without the client’s consent – including unauthorised card use, account compromise, or operations the client did not confirm – the client’s position is strongest. Under PSD2, the payment service provider must refund the full amount of an unauthorised transaction unless it proves gross negligence or fraud on the part of the client. BBVA recommends contacting the bank immediately at the first sign of fraud. The card can be blocked through BBVA.es, the BBVA España app, or by phone. A victim of card theft or data compromise who could not have prevented the unauthorised use through reasonable care is not considered to have acted with gross negligence. The burden of proving gross negligence lies with the bank.

Authorised Transfers Made Under the Influence of Fraudsters

Where the client initiated and confirmed the transfer themselves – even if they were deceived through smishing, vishing, spoofing, or other social engineering – BBVA does not promise an automatic refund. The bank accepts the fraud report and conducts an individual investigation. BBVA regularly publishes warnings about smishing, vishing, and spoofing schemes and explicitly states that fraudsters forge messages and calls in the name of BBVA. Where the transaction was formally authorised by the client, the dispute with the bank becomes more complex. The outcome depends on the specific circumstances, the bank’s fraud controls, and whether BBVA’s security systems should have detected and prevented the fraudulent transaction.

Card Fraud

For card fraud – unauthorised card transactions including stolen card data, cloned cards, and compromised credentials – the probability of recovery is comparatively high. BBVA provides immediate card blocking through multiple channels: BBVA.es, the BBVA España app, and the fraud phone line. After blocking, the bank initiates an investigation of the disputed transaction. The chargeback mechanism through Visa or Mastercard applies to fraudulent card transactions under payment scheme rules. Speed of contact with the bank is critical for card fraud cases as it directly influences the investigation outcome.

When BBVA Refuses a Refund

BBVA may refuse a refund in several situations. First – the client confirmed the transfer themselves after a fraudulent call, SMS, or website, and the transaction is classified as authorised. Second – the client disclosed PIN, authentication codes, or login credentials to third parties, which the bank may classify as gross negligence. Third – the fraud was reported too late, reducing the bank’s ability to block or recall the payment. Fourth – the bank’s individual investigation concludes that the transaction was formally authorised and the bank met its security obligations. BBVA’s detailed warnings about spoofing and social engineering indicate that where clients disregarded clear fraud indicators and authorised payments, the bank’s position on refund may be stricter. A refusal is not final – the client is entitled to escalate through the complaints procedure and through Spanish civil courts.

BBVA Spoofing Warning – Critical Information

BBVA specifically warns that fraudsters can make calls and messages appear to come from official BBVA phone numbers. The bank explicitly states that although certain official BBVA numbers exist, BBVA does not call clients from those numbers. The appearance of an “official” number on the client’s screen does not confirm that the call is genuine. This warning is critical because spoofing attacks are designed to exploit the client’s trust in the bank’s official contact details. If the client receives a call apparently from BBVA requesting security credentials, payment confirmation, or fund transfers, the call should be terminated immediately and the client should contact the bank independently through 900 102 801.

Immediate Steps After Discovering Fraud

Step 1 – Contact BBVA Immediately

The primary fraud line for all account and card security incidents is 900 102 801. BBVA repeats this number in its latest fraud warnings about fraudulent SMS and calls. For business clients: 91 298 35 96 (small business) and 91 224 98 02 (medium and large business). The client should call immediately upon any suspicion of fraud – the speed of notification directly affects recovery prospects.

Step 2 – Block Cards and Restrict Account Operations

All compromised cards must be blocked immediately through BBVA.es, the BBVA España app, or by phone. Account operations should be restricted to prevent further unauthorised transactions. This is the first action BBVA instructs clients to take upon discovering fraud.

Step 3 – File a Police Report

In parallel with notifying BBVA, a criminal complaint (denuncia) should be filed with the Spanish National Police (Policía Nacional), Civil Guard (Guardia Civil), or through the online reporting platform. BBVA recommends contacting the police as part of the standard fraud response. The police report is an essential evidentiary document for both the bank’s investigation and any subsequent legal proceedings.

Step 4 – Preserve All Evidence

All phishing emails, fraudulent SMS messages, call logs, screenshots of fake websites, transaction confirmations, recipient IBANs, and any other supporting materials must be preserved without alteration. Digital evidence forms the foundation for BBVA’s individual investigation and any subsequent regulatory or judicial proceedings.

Step 5 – Submit a Formal Complaint if BBVA Refuses

Where BBVA refuses the refund after its individual investigation, the client should submit a formal complaint through the bank’s complaints procedure. If the complaint is not resolved satisfactorily, the dispute can be escalated to the Banco de España complaints service. Civil litigation in Spanish courts is a viable recovery path – Spanish judicial precedent supports claims against banks where security deficiencies contributed to fraud losses.

Alternative Recovery Mechanisms

Banco de España Complaints Service

Where BBVA’s internal complaint does not resolve the dispute, the client can file a complaint with the Banco de España complaints service (Servicio de Reclamaciones). The Banco de España reviews whether the bank complied with its obligations under payment legislation. While the complaints service does not order refunds directly, its findings carry weight in subsequent legal proceedings and create regulatory pressure on the bank.

Complaint to the CNMV

For investment-related fraud, a complaint to the Comisión Nacional del Mercado de Valores (CNMV) is available. The CNMV supervises investment services and can investigate whether regulated entities or unauthorised firms were involved in the fraud.

Civil Litigation

Civil proceedings against BBVA are available under Spanish and EU law where a breach of PSD2 obligations is proven, Strong Customer Authentication was not applied, suspicious transaction patterns were ignored, or fraud notifications received an inadequate response. Spanish courts have established precedent for ordering banks to refund fraud losses where security deficiencies are proven. Civil proceedings against the fraudster are available in parallel where the fraudster is identified. The European Account Preservation Order (EAPO) enables the freezing of the fraudster’s assets across all EU member states simultaneously.

Criminal Proceedings

A criminal complaint filed with the Spanish National Police, Guardia Civil, or the cybercrime unit (Grupo de Delitos Telemáticos) initiates an investigation in which law enforcement authorities gain access to bank records, IP logs, payment system data, and telecommunications operator records. Criminal investigation is the primary tool for identifying anonymous fraudsters and tracing the movement of stolen funds across jurisdictions.

BBVA Contact Details for Fraud Enquiries

BBVA operates a full-service banking infrastructure with branches, phone support, online banking, and mobile app across Spain and internationally. Head office: Plaza San Nicolás, 4, 48005 Bilbao, Spain. Madrid offices: Ciudad BBVA, Calle Azul 4, 28050 Madrid (tel: 913 746 000) and Paseo de Recoletos 10, 28001 Madrid (tel: 915 377 000). Fraud line (accounts and cards): 900 102 801. Small business fraud: 91 298 35 96. Medium and large business fraud: 91 224 98 02. Card blocking: BBVA.es / BBVA España app / phone. Escalation: Banco de España complaints service. Investment fraud: CNMV.