How to Report Cybercrime in Spain (and Get Your Money Back)

Quick answer: If you are in immediate danger call 112. To report an online scam in Spain you file a denuncia with the Policia Nacional (091) or the Guardia Civil (062), either in person at a station or online through their electronic offices, and for free guidance call INCIBE's cybersecurity helpline on 017. Call your bank right now to block the card and try to recall the payment. Under EU PSD2 (transposed by Spain's Royal Decree-law 19/2018) your bank must refund payments you did not authorise, with your liability capped at EUR 50.

What to do in 3 steps

1. Call your bank now and freeze everything. Phone the number on the back of your card, report the fraud, block the card and ask them to recall or recover the transfer. The sooner you call, the better the chance the money is still sitting in the receiving account. Change your online banking password and ask for written confirmation of your report.
2. File the report (denuncia) with the police. Go to a Policia Nacional or Guardia Civil station, or use their electronic offices online. The Guardia Civil's electronic complaint for bank fraud can be completed fully online, but a denuncia started online with the Policia Nacional generally must be ratified in person at a station within 72 hours or it is dismissed. You can call INCIBE on 017 first for free help on how and where to report.
3. Escalate a refused refund. If your bank rejects an unauthorised-payment claim, complain in writing to its customer service, then to the bank's customer ombudsman (Servicio de Atencion al Cliente), and if still unresolved take it to the Banco de Espana's complaints service. Keep every reference number.

How recovery actually works

Be realistic. If the payment was unauthorised, your strongest route is the PSD2 refund duty on your bank, and notifying them fast matters because you must report an unauthorised charge without undue delay (and in any case within 13 months). If you were tricked into authorising the transfer yourself, getting money back depends on speed: banks can sometimes recall a transfer before the criminal withdraws it, and the police can freeze accounts, but once funds are cashed out or moved abroad, recovery is difficult and slow. A police denuncia is still essential, because it is what your bank, your insurer and any investigation will rely on. Be very wary of anyone who contacts you promising to recover your lost money for an upfront fee, as that is a common follow-up scam.

What to have ready

• The exact dates, amounts and reference numbers of every fraudulent transaction.
• The bank certificate or statement showing the fraudulent charges (the police usually require this for online-fraud reports).
• The account, card or IBAN the money was sent to, if you have it.
• Screenshots of messages, emails, websites, adverts or chats from the scammer, with full sender addresses and URLs.
• Any phone numbers used and a short written timeline of what happened.
• Your ID document (DNI, NIE or passport) for filing the denuncia.

Frequently asked questions

Do I have to report in person? Not always. The Guardia Civil's electronic complaint for bank fraud can be done entirely online. A denuncia started online with the Policia Nacional generally has to be ratified in person at a station within 72 hours, or it is automatically filed. Call 017 if you are unsure which route fits your case.

Will my bank really refund me? For genuinely unauthorised payments, yes, that is the bank's legal duty under PSD2 and Royal Decree-law 19/2018, with your liability capped at EUR 50, unless it can prove you acted with fraud or gross negligence. For payments you were tricked into authorising yourself there is no automatic refund, though it is still worth asking the bank to recall the funds.

What is 017 and does it cost anything? 017 is INCIBE's free, confidential national cybersecurity helpline for the public, open every day from 8am to 11pm. It also runs on WhatsApp (900 116 117) and Telegram (@INCIBE017). They give guidance, not police powers, so you still need to file a denuncia.

Sources

• INCIBE: Como denunciar si has sido victima de un fraude o delito
• INCIBE: Tu Ayuda en Ciberseguridad (017 helpline)
• Policia Nacional: Denuncias
• Guardia Civil: Denuncia telematica (electronic complaint)
• BOE: Real Decreto-ley 19/2018 (PSD2 transposition, payment services)

For step-by-step reporting and recovery guides covering other countries, see our cybercrime help hub.