Bank withdraws appeal after devastating ruling on electronic fraud

In one of the most revealing rulings on the liability of financial institutions for digital fraud, the bank has withdrawn the appeal it had lodged in the legal proceedings claiming the return of €63,981.82 stolen through unauthorized banking transactions.

The withdrawal of the appeal, notified on May 9, 2025, came after the recent ruling by the Supreme Court, which resolved another identical dispute also lost by the bank and led by the same lawyer representing the plaintiff.

However, beyond the outcome of the proceedings, the real value of this case lies in the critical examination of the proven facts and the legal grounds that revealed serious deficiencies in the bank’s protocols. The court rulings did not merely uphold the consumer’s argument: they dismantled the bank’s actions point by point, accusing it of negligence, delay, and failure to comply with the regulatory framework for payment services and money laundering prevention.

Fraud: a pattern incompatible with the customer’s profile

On April 12 and 13, 2021, 16 transfers and several Bizum transactions were executed from the bank’s digital platform, draining more than €69,600 from the accounts of two customers (father and daughter), both with valid electronic banking contracts.

The massive withdrawal, in a very short period of time, is in itself a warning sign. However, the bank did not block the transactions, request additional confirmation, or activate any preventive protocols.

Court’s criticism: gross negligence and passivity in the face of fraud

The first instance ruling was categorical: the bank had seriously breached its contractual and legal obligations. The judge emphasized:

• That the entity did not detect or prevent unusual and high-risk transactions which, by their nature, required enhanced monitoring;
• That the customer had been the victim of a duplicate SIM card from Barcelona, a circumstance that triggered the unauthorized access;
• That, despite the immediate complaint, the bank did not react with due speed or actively cooperate with the authorities in blocking the funds;
• That the entity receiving the money—the defendant bank itself in some cases—did not block the recipient accounts until a month after receiving the police request.

The Court of Appeal reinforces the sentence: breach of legal and contractual duties

The appeal lodged by the bank was dismissed in its entirety by the Provincial Court of Zaragoza, which upheld the sentence imposed in the first instance. The Court described the bank’s conduct as a systemic breach of its security and supervision duties, expressly highlighting that:

“The legislator (…) transfers (the risks) to the major beneficiary of the system, who derives significant benefits from using systems and working methods that are highly profitable but also highly vulnerable, without the service providers having managed to create secure channels of communication that would ensure the full reliability of the system and the authenticity of payment orders.”

The court also expressly mentioned the existence of an ongoing criminal investigation into a criminal organization specializing in mass fraud, of which the customers were only some of the many victims. In this context, the Chamber criticized the bank’s inaction in response to the express instructions of the Civil Guard, which on April 14 requested the immediate freezing of the receiving accounts. However, the financial institution did not act until May 12, by which time the funds had already been completely stolen and could not be recovered.

The bank’s strategy in cassation: denial of fraud and contractual defense

Despite these circumstances, the bank decided to lodge an appeal, arguing that the transactions had been carried out using the agreed authentication mechanisms and should therefore be considered authorized by default.

The final blow: Supreme Court ruling and withdrawal of the appeal

The turning point came on April 9, 2025, when the Supreme Court handed down its ruling. It was clearly established that liability for bank fraud perpetrated through social engineering techniques and unauthorized access cannot be transferred to the customer, unless the financial institution can reliably prove that it has taken all reasonable technical, legal, and operational measures to prevent the offense.

This doctrine, which is forceful and in line with the principles of financial consumer protection, set a decisive precedent.

A few days later, the bank filed a written withdrawal of the appeal in this case, which was accepted by decree dated May 14, 2025, with express condemnation to pay costs.

Conclusion

This case not only reinforces case law favorable to bank users in fraud contexts, but also highlights the blind spots in banking operations:

• Absence of real-time transactional risk analysis mechanisms;
• Lack of response to external indications and security alerts;
• Lack of coordination between branches, legal departments, and compliance bodies;

And a misconception of contractual consent as a shield against digital fraud.The lesson is clear: in today’s banking ecosystem, signing an online banking contract is not enough. The entity must prevent, identify, and act. Failure to do so, as our Provincial Courts have repeatedly stated and the Supreme Court has confirmed, is equivalent to assuming the cost of fraud.

If you have any questions on this subject, please do not hesitate to contact us by telephone at Núria Martí García or by email at nmg@btsasociados.com. We will be happy to assist you.