Online payment fraud is on the rise: what can you do to protect yourself?

They were unable to tell her anything: what the purchases were or whether the charges would ultimately be applied to her account. Ana lodged a complaint with the bank to which she had entrusted her money, arguing that it had a duty to protect her funds.

Ana believed that it should have been the bank that alerted her to transactions carried out at unusual times and not in line with her spending habits.

The bank's customer service department merely informed her verbally of the procedure she should follow: she would have to wait for the charges to be made before reporting them to the police and only then could she request a refund.

She asked for a written breakdown of the steps she needed to take. The bank refused. Ana has now lodged a complaint with the bank's customer ombudsman.

Ana doesn't know exactly how the cybercriminal who obtained her bank details went about it. Laura, on the other hand, is aware of the exact moment when she made a mistake and gave cybercriminals access to her debit card: she was in Thessaloniki (Greece) when free roaming within the EU wasn't yet available and she needed to buy a train ticket to travel to another town.

Out on the street, she searched for open wi-fi networks, found one and carried out the transaction. On her return to Spain, when she checked her account balances after her trip, she was alarmed to see a string of transactions, each for just a few euros, but adding up to a substantial amount.

She rang her bank. They blocked her card and told her what to do: print out all the fraudulent transactions one by one, take them to the police, file a report and lodge a claim with her bank. In the end, she managed to get her money back.

These are two examples of a phenomenon on the rise.

A few days ago, the Bank of Spain published its report on complaints that explains that of the 1,101 complaints it received from residents of the province of Malaga in 2025, those relating to bank cards accounted for 30.8 per cent, followed by those concerning accounts, transfers and direct debits, at a further 30 per cent.

The Bank of Spain says that the data for 2025 confirms that a shift is taking place from complaints of a temporary nature linked to legal proceedings towards incidents arising from the rise in digital payments and the increase in cyber scams.

Complaints relating to fraudulent payment transactions rose by 18 per cent nationwide in 2025 and accounted for almost a third of the total, outstripping those relating to the charging of commissions, the failure to comply with customers' requests for information and documentation or disputes concerning the cancellation of services.

As lawyer Juan Manuel Lozano of Bejarano Abogados points out, we are at a point in time where technology and the development of artificial intelligence pose a huge challenge.

"We live at such a frenetic pace that we find ourselves opening emails, clicking on links, visiting websites and shopping from online websites offering products at surprisingly low prices… This puts us squarely in the firing line for online scams," he says.

"You only have to look at teenagers as they open and close social media posts at breakneck speed, accepting 'cookies' from websites they don't know… They look, yes, but they don't see, and the same thing happens to us adults. That's where the danger lies."

As cybercrime expert Juan Carlos Galindo puts it, "today, the greatest risk is no longer that our physical card will be stolen, but rather that the data needed to use it fraudulently will be stolen".

In addition to keeping an eye on your card and not sharing your PINs, Galindo says, enable notifications for every payment. He also says it's best to avoid making purchases or accessing online banking via public or unknown wi-fi networks.

Only shop on secure websites (those beginning with https) and from well-known retailers. He also advises enabling two-factor authentication whenever the bank offers it. It is also a good idea to check your account transactions regularly to spot any small suspicious charges (which is what Ana did correctly and which she reported to her bank).

Be wary of text messages, emails or phone calls asking you to verify your bank details. "Banks never ask for full passwords via these channels," Galindo says. "These days, fraud usually starts with social engineering: the criminal gets the victim themselves to provide the information."

To this list of tips, Juan Manuel Lozano adds a few more, such as keeping your computer's antivirus software up to date. "Often, laziness or not wanting to pay for antivirus software opens the door to scammers," he says.

He reveals his own personal habits for avoiding fraudulent calls: "I use an iPhone and I imagine it's similar on Android. It has various options, such as call filtering or silencing unknown numbers, which let you choose to have the phone ring only for your contacts or to ask the reason for the call, so the device alerts you to who is calling and why. There's also the option to group messages by known or unknown senders."

He stresses the importance of disabling the option to connect automatically to public networks and, if you do connect, to ensure that the websites you visit use the 'https' protocol and that the padlock icon appears to the left of the browser alongside the URL.

"These are indicators that the communication between your device and the server is encrypted and that the page has been verified."

Lozano reiterates that it is best not to carry out any actions that could compromise your personal or banking details while connected to a public network. He also highlights the risk behind websites selling very cheap products. "If in doubt, type the website's name into a search engine. You might be in for more than one surprise. Cheap can end up costing you dearly."

Nowadays, paying with your mobile phone is increasingly common. Galindo points out that, generally speaking, this is a safer option.

To begin with, he notes that to make a payment, you usually need to unlock the device using a fingerprint, facial recognition or a passcode. He also advises keeping the operating system up to date, not installing apps from unknown sources, enabling the options to locate and wipe the mobile in case of loss and using a strong device lock.

"A mobile phone can be more secure than a physical card, provided it is properly protected," he says.

For Juan Manuel Lozano, this means having two-factor authentication on your mobile, i.e. facial recognition and a passcode or a fingerprint and a passcode.

Galindo says that systems such as Apple Pay and Google Wallet generate a digital identifier (token) that replaces the actual card number, meaning that the retailer never receives the original details.

Be that as it may, Lozano warns against becoming complacent. "Both physical cards and mobile phones carry the same level of risk."

He recommends setting transaction limits on your bank account like, for example, 300 euros per day for in-store purchases and 400 for online shopping or money transfers.

"If you need more, you can change the limit instantly, which helps prevent fraudulent transfers."

Fraudulent transfers do not occur because someone "hacks" the bank, but because they have previously tricked the victim via a text message, a fake email, calls from people posing as bank staff, impersonation of suppliers to change the account number on an invoice or malware that alters the IBAN when a transfer is made.

In light of this, there are two protective measures: firstly, be wary of any call or message relating to bank details, whether it purports to come from the tax office, the post office or a court.

For major transactions, apply the "double-check" rule: always confirm the details via a second, independent channel before sending the money. However, you need to be even more careful, as Galindo warns of another risk: SIM card cloning, whereby cybercriminals manage to intercept verification text messages and can access online banking to authorise payments.

Another increasingly common way to protect yourself against fraud or limit potential losses is to use a prepaid card. These cards hold a fixed amount of money, and many people use them for online shopping or when travelling abroad.

Galindo recommends using prepaid cards in these situations, as well as when buying from unfamiliar retailers or websites that offer few guarantees.

"Prepaid cards limit the amount of money available, so even if a cybercriminal gains access to one, the financial loss will be much smaller. They are not a substitute for good security, but they can significantly reduce the impact of fraud."

Experts agree that fraud will never disappear completely because it evolves alongside technology.

"Every new payment system also creates new opportunities for criminals," Galindo says. "The goal is not to eliminate all risk, but to reduce it as much as possible through technology, education and prevention. Most major frauds today exploit human error rather than weaknesses in computer systems. That's why raising awareness is just as important as the security measures banks put in place."

Access the broad Spain national news archive