Unfortunately, online banking fraud is becoming an increasingly common phenomenon. In a context where the use of digital platforms has surged, internet and mobile frauds have grown alarmingly. This week, we discuss the recent ruling 571/2025 from the Spanish Supreme Court, which establishes important precedents regarding bank liability in online fraud cases.
What Are Online Frauds?. Phishing.
As explained in previous articles, online frauds related to banks have multiplied in recent years. One of the most common frauds is known as “phishing“. But there are other forms, such as smishing (when the scam happens via SMS) or vishing (when it happens via phone calls). This type of fraud involves identity theft, often through emails, S.M.S messages, or fake websites that imitate banking institutions to steal personal and banking data from victims. In general, cybercriminals can access the victim’s bank account and perform unauthorized transactions.
Applicable Legislation in Online Fraud Cases.
At the European level, the European Directive 2015/2366 and the Delegated Regulation 2018/389 are particularly relevant. Nationally, in Spain, we have Royal Decree 19/2018 on payment services. Of particular note are articles 36 and 41 to 46, which establish a nearly objective liability for banks. This means that the bank is obligated to refund the stolen money immediately, unless it can prove that the customer acted with serious negligence or fraud.
The Supreme Court Ruling of April 9th, 2025.
This case specifically involves clients from whom over 83,000 euros were stolen via phishing. It all started when the user received alerts about unauthorized access to his email and also SMS messages with banking codes he had not requested. Despite notifying his bank and expressing concern, in the coming weeks up to 15 fraudulent transfers occurred overnight, via Bizum and online banking. Many of these were directed to accounts linked to known criminals. Only part of the money was recovered. The bank refused to refund the rest, and the client had to pursue legal action.
Supreme Court Jurisprudence: When is the Bank Liable?.
The Supreme Court ruling confirms that:
.- Banks cannot hide behind clauses that exempt them from liability in cases of fraud. These clauses are common in contracts signed with banks, but they go against the law.
.- The client is obliged to immediately notify their bank of any loss, theft, or improper use of their data.
.- The fact that a transaction is validated with correct credentials is not enough to assume the account holder’s consent, especially if the customer has previously reported suspicious elements.
.- It is the bank’s responsibility to prove that the client acted negligently or fraudulently.
.- If the bank cannot prove negligence or fraud on part of the client, the bank will be responsible for the unauthorized transaction or any incorrectly executed operation.
Conclusion.
The recent ruling from the Supreme Court significantly strengthens the liability of banks in online banking fraud cases like phishing. At White-Baos, we are experts in consumer law. If you have been a victim of online fraud related to your bank, do not hesitate to contact us. We will review your case and offer expert legal advice.
The information provided in this article does not constitute legal advice but is intended for general informational purposes only.
Carlos Baos (Lawyer)
White & Baos.
Tel: +34 966 426 185
E-mail: info@white-baos.com
White & Baos 2025 – All Rights Reserved.
