Spain

Men and women are hit almost equally: men were 52% of the 383,285 victims of cybercrime police identified in 2025, and the most common age was 51 to 65. In the 2024 fraud records, people aged 51 to 65 were 26% of victims, those aged 26 to 40 were 25%, those aged 41 to 50 were 23%, and the over 65s and the 18 to 25s about one in eight each. Andalusia, Catalonia and Madrid record most cases.

Scammers reach people mainly by text, email, WhatsApp and phone. In a national poll by the state research centre CIS in February 2024, people who had met a scam or an attempt in the past year said it came as a link in a text (59%), a fraudulent email (43%), a fake WhatsApp message (38%) or a call from a fake operator (31%). The usual script is a text in the name of a bank, which can appear in the same thread as the bank's real messages, followed by a call from a supposed bank employee who asks for the security codes. Others pose as the traffic authority with a fine, the tax agency or Social Security, or as a son or daughter with a new number who needs money urgently. Fake investments are advertised on social media with famous faces.

Most of those caught are in Spain: 76% of people arrested or investigated for cybercrime in 2025 were Spanish, and in one ring of 100 arrested most were aged 18 to 25. Part of the money goes abroad: two rings broken up by the Guardia Civil sent their takings to Nigeria, and the tools are sold over Telegram.

Money leaves by bank transfer, by the mobile payment service Bizum and by card. Payment firms in Spain reported 86,382 fraudulent transfers worth €153 million in 2024, about €1,770 each, and 2.6 million fraudulent card payments worth €141 million, about €55 each. In the first half of 2025 the average fraudulent transfer rose 42% to €2,347. The Banco de España names two main causes: customers manipulated into ordering the payment, and fraudsters issuing the order themselves. Gangs also take out pre-approved loans in the victim's name. The money lands in accounts opened or lent by recruits known as mules, often with stolen identities, and is moved on in small sums: one ring sent more than €4 million to Nigeria in over 9,200 transfers.

Several things can stop a payment. Banks must use two-step authentication for online payments. Since 9 October 2025 they must tell the payer whether the name of the person being paid matches the account number, and the payer decides whether to go on.

Phone companies must block calls and texts from numbers that do not exist or that arrive from abroad showing a Spanish number: they blocked more than 300 million calls and 26.6 million texts between March 2025 and August 2026. Since 15 September 2026 they must also block texts whose sender name is not on the register kept by the competition and telecoms authority CNMC. Firms may no longer make commercial calls from mobile numbers. In 2025 INCIBE and Red.es closed 4,600 fraudulent .es websites.

Payment firms in Spain recorded €318.3 million of payment fraud in 2024, according to the European Banking Authority and the European Central Bank: €153.0 million on transfers, €141.0 million on cards, €17.4 million in cash withdrawals, €4.1 million on direct debits and €2.8 million in electronic money. Card fraud took 0.038% of the value of card payments, above the EU average of 0.033%. No police body or ministry publishes a total of money lost to fraud.

Losses on transfers are growing in size. In the first half of 2025 the average fraudulent transfer rose 42% to €2,347, the Banco de España reports, mainly because customers were manipulated into ordering the payment themselves. The police recorded 429,677 online frauds in 2025, up from 412,850 in 2024 and 70,178 in 2016.

Catalonia's public safety survey, the only one in Spain that asks what a fraud cost, found that 76% of fraud victims lost money in 2022. The median loss was €100, and a few very large losses carried much of the money. Card charges were the most common fraud, 40% of incidents, followed by cheating in a purchase, 27%.

Most money returned to victims in Spain is refunded by banks for card fraud the customer did not authorise. Spanish payment firms recorded €141.0 million of card fraud in 2024, and customers bore 40% of the losses, according to the European Banking Authority and the European Central Bank. On €153.0 million of fraudulent transfers, customers bore about 89%.

If someone else made the payment and the customer reports it within 13 months, the bank must refund it by the end of the next working day, unless it suspects fraud and tells the Banco de España in writing. The customer bears at most €50 for a lost or stolen card, and everything only if the bank proves fraud or gross negligence; in April 2025 the Supreme Court held that a record of two-step authentication does not prove consent. A payment the victim made after being deceived carries no refund right. The Banco de España's findings do not bind banks, and the Ombudsman says victims are more likely to recover money in the civil courts.

Little is recovered from scammers. Police seize money case by case: €1.3 million from one investment ring in 2025. A European Union agreement of November 2025 would make banks refund customers tricked by someone posing as their bank, if they report to the police. It is not yet law.

In Catalonia's public safety survey (ESPC 2022), 22.1% of fraud victims signed a complaint with the police or a court: 31.8% of undue card charges were reported, against 12.1% of frauds when buying a product or service. Police forces recorded 429,677 online frauds in 2025, up 4% from 412,850 in 2024 and almost nine in ten of the 488,426 cybercrimes known to them. Cybercrime victims rose 9.3% to 383,285, and card fraud hit 146,737 people; 14.6% of known cybercrimes were cleared. Complaints go to the Policía Nacional, where an online complaint must be signed at a station, to the Guardia Civil, which takes fraud complaints wholly online, and to regional forces such as the Mossos d'Esquadra.

Banks' customer services handled 1,061,153 complaints of all kinds in 2025, against 1,068,370 in 2024. A claim reaches the Banco de España only after the bank: it received 30,970 claims in 2025, 45% fewer than in 2024, and turned away more than 4,000 that had skipped the bank. Of the claims, 9,179 were about fraud, up 18% from 7,747, again the leading subject, and claims rose by more than 50% in the first four months of 2026, mainly over fraud.

INCIBE's cybersecurity helpline, which advises and does not take police complaints, answered 142,767 queries in 2025, up 44.9% from 98,546, and 95,064 in the first half of 2026, against 49,599 a year earlier. INCIBE-CERT handled 45,445 online fraud incidents in 2025, up 19%. The CNMV published 458 warnings on unauthorised investment firms in 2025.

The figure shown here is the number of online frauds (estafas informáticas) known to Spain's police forces in 2025, compiled by the Interior Ministry from the Policía Nacional, the Guardia Civil, the regional forces and the local police: 429,677. It counts offences, not victims, includes card fraud and fraud against businesses, and leaves out frauds committed wholly in person. In 2024, the latest year broken down by type, 183,082 were frauds with credit or debit cards, 153,142 were other frauds such as phishing and fraudulent online sales, 41,829 were bank frauds, 33,178 were computer frauds and 1,619 were frauds on investors.

Police cleared up 49,860 of the 412,850 frauds recorded that year, about one in eight, and arrested or investigated 14,640 people for them. In 2025 they arrested or investigated 19,876 people for cybercrime of all kinds. Prosecutors counted 28,952 court cases opened for online fraud in 2025 and brought charges in 3,357. They say few investigations succeed because victims are scattered, the frauds are run from abroad and the evidence is held in other countries.

Fraud carries six months to three years in prison, or a fine when the sum is €400 or less. Since 2023 fraud by computer or with a payment card has had no such lower tier. Frauds above €50,000, or with many victims, carry one to six years. People who lend their accounts are charged with money laundering.

By cases, card fraud is the largest type on the police count: 44% of online frauds in 2024, usually card details stolen and used for purchases. Other frauds, a class that takes in phishing and fraudulent online sales, were 37%, bank frauds 10% and computer frauds 8%. Police recorded 1,619 investor frauds. Phishing was 25,133 of the 45,445 online fraud incidents handled by INCIBE in 2025, and impersonation by phone, text or email was the subject of 40% of citizens' queries to its helpline in early 2026, ahead of fraudulent purchases (13%) and identity theft (9.5%).

Bank impersonation works in two steps: a mass text leads to a copy of the bank's website, then a caller posing as the bank obtains the codes and empties the account. In the 'child in need' scam a WhatsApp message from an unknown number claims to be a son or daughter and asks for an urgent transfer: one gang took almost €3 million from about 500 people. In the reverse Bizum trick the victim accepts a payment request thinking money is coming in.

By money, the largest cases are investments. A fake crypto platform took €39 million from about 500 people in Spain, and a Barcelona call centre ring more than €10 million. Victims are drawn in by WhatsApp groups and by advertisements that use the faces of famous people, sometimes generated with AI, and those who have lost money are then offered paid help to recover it. Romance scams, duplicated SIM cards and fake orders from a company's chief executive complete the list.

Spain acts through separate ministries, and the strongest duties fall on phone companies. Since March 2025 operators must block calls and texts that fake Spanish numbers, and they report more than 300 million calls blocked in 17 months. Banks must verify the name on the receiving account since October 2025. The CNMV's plan against financial fraud brings together 24 public and private bodies and works with Meta and Google on advertisements; it has fined X for failing to cooperate. The consumer group ASUFIN asked in July 2025 for a standing table of government, banks and phone companies.

The results are modest. Online frauds known to police rose 4% in 2025 and 1.6% in the first half of 2026. Police clear about one fraud in eight. Prosecutors brought charges in 11.6% of fraud cases in 2025 and describe their specialist unit as plainly too small.

On liability, the law and the Supreme Court put the loss on the bank when a payment was not authorised, yet customers bore more than 80% of losses on fraudulent transfers in 2024, and the Banco de España's findings do not bind banks. Phone companies and platforms bear none of the loss. The Ombudsman notes that the ban on commercial calls from mobile numbers has moved them to landline numbers. The national cybersecurity strategy dates from 2019, and the bill for a binding financial complaints authority lapsed when parliament was dissolved in October 2026.