In a recent ruling (STS 571/2025 of 9 April), the Supreme Court has established case law on banking security and digital fraud, obliging financial institutions to respond for unauthorised transactions when no gross negligence on the part of the customer is proven.
📌 Case study: a customer affected by digital fraud
An Ibercaja user suffered a complex fraud using phishing techniques and SIM card duplication, which allowed the fraudsters to execute 15 unauthorised transfers for an amount of more than €83,000. Although the customer had warned the bank of suspicious movements, the bank failed to activate preventive measures or detect the anomalies in the system.
⚖️ Supreme Court decision
The Court rejected the bank’s appeal and reaffirmed the bank’s liability, stating that:
- The use of systems such as two-factor authentication does not exempt banks from their supervisory obligations.
- Clauses releasing the institution from liability are null and void if they contradict the regulations in force.
- It is up to the bank to prove gross negligence or fraudulent behaviour on the part of the customer.
What does this mean for consumers?
This Supreme Court ruling represents a step forward in the protection of the rights of users of digital payment services:
- Banks should have effective systems in place to detect suspicious transactions.
- Consumers are not liable for unauthorised transactions if they have acted diligently.
- The principle of trust and confidence in electronic means of payment is reinforced.
📝 Conclusion: your rights as a user are protected
If you have been the victim of a digital fraud, you can claim back the amounts stolen from the bank, provided that you have acted diligently and notified the bank immediately.
Have you suffered a bank fraud? In our office we help you to claim and defend your rights. Contact us for an initial assessment with no obligation.
<small><em>This article is for informational purposes only and does not constitute legal advice. Each case must be assessed by a specialised lawyer. According to article 74 of Royal Decree-Law 19/2018, institutions are obliged to return the amount of unauthorised transactions to the customer, except in the case of gross negligence. </em></small>