Have you been a victim of phishing? Top court rules that banks must pay back the money stolen

The law states that financial institutions are only exempt from the obligation to return the funds if they can prove that the customer acted with "gross negligence"

Almudena Nogués

Malaga

Friday, 9 May 2025, 15:57

It is one of the most common and recurrent scams. Phishing uses the sending of an email as bait (or an SMS message, in which case it is called 'smishing') in which cybercriminals impersonate a bank, a social media network, a public entity or a company with the aim of obtaining confidential information, making a financial charge or gaining access to the device.

To do so, they attach infected files or links to fraudulent websites. Those who take the bait easily become victims, to the detriment of their bank accounts. But whose fault is it? A Supreme Court ruling in Spain has upheld another decision in which a judge had already ruled in favour of a user who was claiming a refund of more than 83,000 euros that had been withdrawn from their account with their card, without having authorised it and despite having exercised due diligence. "This is good news and we welcome it", said the national OCU consumers' organisation.

According to the association, based on the ruling, in the event that money has been stolen from a customer's account by phishing or other similar deception, banks must replace the money stolen as soon as they become aware of the fact, unless it can be shown that the user has been grossly negligent. According to the supreme court, there is a quasi-strict liability for the payment service provider. The bank can only escape this liability if it proves the following:

• That the transaction was properly authenticated, recorded and accounted for.

• That there was no technical failure or service deficiency.

• That the user acted with fraud or gross negligence.

"In addition, to provide guarantees to the user, the bank should have security systems capable of detecting suspicious activity, as well as blocking or verifying high-risk transactions," the OCU said.

The Supreme Court's recently announced ruling is clear: no payment made under the effects of deception can be considered as authorised and must therefore be automatically reimbursed. "This ruling is an endorsement of the interests of users, who see how the highest judicial authority supports their requests. With this in hand, they should report it as soon as possible and the bank should respond to the requests of any victim of 'phishing' and promptly reimburse the unduly stolen money. If they do not do so, we remind you that you have the right to complain," the organisation added.

As SUR has previously highlighted, more and more consumers are taking their banks to court for not returning the money stolen from their accounts through phishing scams. And most of them end up winning their cases, as the payment services act protects them unless the bank can prove that the user has committed "gross negligence" in the protection of their personal data. Such negligence would be, for example, writing down the passwords on the back of a credit card; but in phishing cases this is not usually the case, since in most cases the user is the object of a fraud capable of deceiving many people.

In Malaga, in fact, there have already been numerous judgements forcing banks to pay back the amounts stolen from their clients in phishing attacks. There are law firms that specialise in this type of case, such as Belén Rincón, a lawyer specialising in banking law, who said: "We are receiving more and more cases and the scams are becoming more and more elaborate. The first step if you have been a victim is to report it to the police and, if the bank refuses to return the money, file a formal complaint." The lawyer also insists: "You should not settle because the payment services act and case law protect the consumer. The bank must return all the money."

Top 50

Esta funcionalidad es exclusiva para registrados.

Reporta un error en esta noticia