Online Shopping Scams in Spain: A Step-by-Step Guide

🇪🇸 Read the original in Spanish

Digitalisation has completely transformed our consumption habits, but it has also opened the door to new and sophisticated forms of fraud. Making a purchase online only to discover that the product never arrives, that the website has disappeared, or that what you received is a crude imitation with no trace of the seller is a distressing situation that affects thousands of users in Spain every year. Faced with this scenario, paralysis is the victim's worst enemy; reacting quickly, gathering the right evidence, and knowing the legal protection mechanisms offered by the Spanish legal system is essential to recover your money and report the offenders.

The Legal Framework: What does Spanish law say about online scams?

In Spain, the protection of online buyers is structured through a solid regulatory framework that combines consumer law, e-commerce regulations, and the Criminal Code. When we fall victim to deception on the web, different legal texts come into play depending on the nature and severity of the incident.

The crime of scam/fraud in the Criminal Code

Not every breach of contract is a scam. If a legitimate online store is late with a shipment, we are facing a consumer issue. However, if there is prior deception or a deliberate omission to obtain an illicit financial benefit at the buyer's expense, we are looking at a criminal offense.

*Article 248 of the Código Penal (Criminal Code) regulates the crime of scam (estafa*), establishing that those who, with intent to profit, use sufficient deception to cause an error in another, inducing them to perform an act of disposition to their own or another's detriment, commit a scam. Following legal reforms, this article expressly punishes those who, using electronic transfers, malware, or any other computer manipulation, achieve the non-consensual transfer of any asset.

• *Minor scam (estafa leve): If the defrauded amount does not exceed 400 euros, it is considered a minor crime of scam, punishable by a fine of one to three months*.
• Aggravated scam: If the defrauded amount exceeds 400 euros, the prison sentence ranges from six months to three years. If circumstances of special gravity concur (such as affecting basic necessity goods or causing a situation of severe economic hardship), the penalties can be considerably higher.

Consumer protection in e-commerce

When we buy from a company (a B2C relationship), we are protected by the _Real Decreto Legislativo 1/2007, de 16 de noviembre, por el que se aprueba el texto refundido de la Ley General para la Defensa de los Consumidores y Usuarios_ (TRLGCU) (General Law for the Defence of Consumers and Users).

• Right of withdrawal (Article 102 TRLGCU): The consumer has a period of 14 calendar days to withdraw from the contract without needing to provide any justification. If the seller does not inform the consumer of this right, the period is extended to 12 months.
• Delivery period (Article 109 TRLGCU): Unless otherwise agreed, the merchant must deliver the order within a maximum period of 30 calendar days from the conclusion of the contract.

For its part, the _Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico_ (LSSI) (Information Society and E-Commerce Services Act) obliges service providers to offer clear information about their identity, address, contact details, and prices (including taxes and shipping costs)—something that scammers systematically omit or falsify.

Step-by-Step Guide: What to do after suffering an online scam

If you have confirmed that you have been the victim of a fraud, you must act methodically and quickly. Follow these steps in order to maximize your chances of recovering your money and to help identify the scammer.

Step 1: Gather and secure all evidence

Before the scammer deletes the traces of the website or their social media profiles, you must save as much digital evidence as possible:

• Screenshots: Capture the purchase process, the product description, the offered price, the shopping cart, and the order confirmation.
• Communications: Save all received and sent emails, as well as conversations on WhatsApp, Telegram, or social media chats. Do not delete any messages.
• Proof of payment: Download the bank statement for the credit/debit card, the receipt of the transfer made, or the confirmation from platforms like PayPal or Bizum.
• Seller's details: Note down the exact URL of the website, the name of the domain owner (if it is possible to obtain it), phone numbers, physical addresses, and email addresses appearing on the website.

Step 2: Contact your bank or payment platform

Time is a critical factor in stopping the flow of money.

• Card payment: Call your bank immediately to report the fraud. Request a card block if you suspect they might have saved your security details (CVV) to prevent future charges. Ask about the chargeback procedure, a mechanism of card networks (Visa, Mastercard) that allows the cancellation of fraudulent transactions under certain conditions.
• Payment platforms (PayPal): If you used PayPal, you have a period of 180 calendar days from the date of payment to open a dispute under their "Buyer Protection". If the seller does not respond or does not provide valid proof of shipment, PayPal will refund your money.
• Bank transfer: If you made a transfer, request an immediate recall from your bank. However, transfers are difficult to reverse once the money has reached the destination account, hence the importance of acting within the first 24 to 48 hours.

Step 3: File a report with the State Security Forces

Filing a formal complaint (denuncia) is an essential requirement for the bank to process certain chargebacks and to initiate criminal proceedings. You can go to:

• _Policía Nacional_ (National Police): You can file a pre-complaint on their virtual office, but you must physically go to a police station within 72 hours to sign and ratify it.
• _Guardia Civil_ (Civil Guard): They have a Telematic Crimes Group (Grupo de Delitos Telemáticos - GDT), where you can report the fraud online and formalise the complaint at their nearest station.

What should you bring? Bring printed copies of all the documentation gathered in Step 1. Make sure the complaint states the exact amount defrauded, the destination bank account number (IBAN) or the email associated with the payment, and the contact details of the alleged scammer.

Step 4: Notify the Consumer Office or the Internet Security Office (OSI)

If the conflict is with a real company operating in Spain or the European Union but engaging in unfair commercial practices, you can go to the _Oficina Municipal de Información al Consumidor_ (OMIC) (Municipal Consumer Information Office) of your local town hall or submit a complaint through the European Union's online dispute resolution platform. Additionally, reporting the fraudulent website to the _Oficina de Seguridad del Internauta_ (OSI) (Internet Security Office) of INCIBE helps to block the website to prevent other people from falling into the trap.

Practical Examples and Reference Figures

To better understand how laws and procedures are applied in practice, we analyse two very common scenarios.

Example 1: Purchasing a tech device on a cloned website

• The case: Carlos buys a latest-generation mobile phone on a website that imitates a well-known electronics chain. The market price of the phone is 1,200 euros, but the website offers it for 450 euros. Carlos makes the payment using a credit card. After 5 days, the website disappears, he receives no confirmation email, and the phone never arrives.
• Legal analysis and amount: As it exceeds 400 euros, we are facing an alleged ordinary (not minor) crime of scam under Article 248 of the Criminal Code.
• Practical resolution: Carlos gathers his card statement showing the charge of 450 euros, screenshots of the cloned website, and the proof of transaction. He goes to the Policía Nacional and files a complaint. With the copy of the complaint, he goes to his bank to request the chargeback procedure for fraud. Having acted within the first 10 days, the bank manages to withhold the funds and refunds him the full amount.

Example 2: Scam on a second-hand platform between individuals (C2C)

• The case: Sofía wants to buy a second-hand video game console from an individual through a well-known marketplace app. The seller asks her to complete the transaction outside the platform to "avoid fees" and requests a Bizum payment of 180 euros. After receiving the money, the seller blocks Sofía on the app and on WhatsApp.
• Legal analysis and amount: As the amount is under 400 euros, it is classified as a minor crime of scam (delito leve de estafa). Since it is a transaction between individuals, the General Law for the Defence of Consumers and Users (TRLGCU) does not apply; instead, the Código Civil (Civil Code) applies regarding obligations and contracts.
• Practical resolution: Sofía cannot use the application's protection system because she agreed to operate outside of it. Bizum does not have a buyer protection system nor does it allow a voluntary money transfer to be reversed unilaterally. Sofía reports the facts to the Guardia Civil, providing the scammer's phone number (associated with their Bizum) and the chat logs. Although the criminal route will proceed to identify the line owner, recovering the 180 euros will be very complex unless the offender is located and ordered to return the money in a trial for a minor offense.

Mistakes You Must Avoid

Making certain mistakes during or immediately after suffering a scam can ruin your chances of recovering your money or identifying the culprit. Avoid the following:

• Paying extra under false pretences of "unlocking": Many scammers contact the victim again claiming that the package is held at customs or that an additional payment of, for example, 50 euros is required for transport fees to release the shipment. Do not pay more; it is an extension of the original scam.
• Deleting evidence out of shame or frustration: Deleting chat history, emails, or emptying the recycle bin makes the police investigation extremely difficult and can invalidate your complaint due to a lack of solid evidentiary clues.
• Delaying communication with the bank: Waiting weeks to see if the product "eventually arrives" drastically reduces the chances of your bank successfully executing a chargeback. Card brands impose strict deadlines for these claims.
• Accepting untraceable or unsafe payment methods: Avoid sending cash by mail, using money transfer services like Western Union or MoneyGram for commercial transactions with strangers, or making direct transfers if the website offers secure payment gateways.

Frequently Asked Questions (FAQ)

Can I get my money back if I paid by bank transfer?

Recovering money from a bank transfer is complex because transfers are irrevocable payment mandates. If you act within the first 24 to 48 hours, your bank can attempt a recall request for error or fraud to the receiving entity. However, once the money has been credited to the scammer's account (who usually withdraws it immediately or transfers it to mule accounts), the only way to recover it is by identifying the perpetrator after filing a judicial complaint.

What responsibility does the classifieds website or platform where I was scammed have?

As a general rule, intermediary platforms (such as second-hand portals or marketplaces) are exempt from direct civil liability for frauds committed by their users, provided they do not have effective knowledge of the illegal activity or, having it, act quickly to remove the content or block the offending user, in accordance with the _Ley de Servicios de la Sociedad de la Información_ (LSSI). However, if you used the payment and shipping system integrated into the platform itself, you will be covered by their specific protection policies.

Is it useful to report a scam for an amount under 50 euros?

Yes, it is extremely important to report it. Although amounts under 400 euros are considered a minor crime of scam, the accumulation of complaints against the same offender or against the same bank account allows the judicial police to unify the cases. This helps to prove the scammer's habitual offending (multirreincidencia), which can elevate the classification of the crime to prison sentences and dismantle organized fraud networks that profit through systematic micro-scams.

What happens if the scammer is outside of Spain?

If the fraudulent website or the scammer operates from outside the European Union, criminal prosecution and money recovery become highly complex due to jurisdictional limitations. In these cases, the best defence is prevention and an immediate claim to your card-issuing bank to attempt a chargeback, as the rules of the payment networks (Visa/Mastercard) apply internationally and are independent of the merchant's country of residence.

Summary

• Identify the nature of the deception: Distinguish between a consumer issue (delay, defective product) and a crime of scam under *Article 248 of the Código Penal*** (manifest deception and intent to profit).
• Act quickly: Contact your bank within the first 24 to 48 hours to try to cancel the charge or request a transaction chargeback.
• Gather digital evidence: Save screenshots, emails, proof of payment, and web links without modifying or deleting any element.
• File a formal complaint: Present a detailed complaint (denuncia) to the Policía Nacional or the Guardia Civil, providing all the physical and printed evidence you possess.
• Avoid additional payments: Under no circumstances agree to make new payments under the guise of customs, account unlocks, or unforeseen shipping costs.

General legal information, not personalised legal advice. For your specific situation, ask your question for free at AbogadoAI — answers grounded in Spanish law (BOE), in English.

This is general information, not legal advice. Verify on the BOE or consult a lawyer for your specific case.