Spain: The Bizum Scam Explained

The short answer

In the "accidental Bizum" scam, a stranger sends you money, then asks you to send it back because it was a "mistake." The Banco de España and Guardia Civil have warned about it. The catch: the money you received came from a stolen or compromised account, so when its real owner reports the fraud, the bank reverses that incoming payment — but the money you "returned" left your own balance and is gone. The rule that defeats it: a genuine Bizum you receive never needs you to confirm, approve or return anything. If money arrives "by mistake," do nothing and tell the sender to ask their bank to reverse it. Never send it back yourself.

If you have already sent money back and want the emergency steps, skip to if you already sent it.

Bizum is woven into daily life in Spain — splitting a dinner, paying back a friend, settling rent. That familiarity is exactly what the scam borrows. The message doesn't feel like a fraud; it feels like an honest mistake from a slightly flustered stranger. "Perdona, te he enviado 50 € sin querer, ¿me los puedes devolver?" Who wouldn't return money sent to them in error? That decency is the lever the whole scam pulls.

The backdrop is on the official record. Spain's Ministerio del Interior, in its Informe sobre la Cibercriminalidad en España 2024, counted 464,801 cybercrimes — and 412,850 of them (89%) were fraud (estafas informáticas). INCIBE, the national cybersecurity institute, says it managed 97,348 incidents in 2024 (up 16.6%), with 67.6% hitting ordinary citizens, and named vishing and smishing impersonating banks and public bodies as the dominant themes. The Bizum twist is what happens when that fraud wave meets Spain's most-used payment app.

How the "accidental Bizum" scam works

The sequence is short, which is part of why it works — there's barely time to think:

—Money really does arrive. You get a genuine Bizum notification — say €50. It's real money, in your account, right now. That realness is what disarms you.

—The apologetic message. A stranger contacts you: they sent it to the wrong number, so sorry, could you send it back? Sometimes they're charming, sometimes flustered, always polite.

—You 'return' it — from your own money. You Bizum the €50 back to the number they give you. It feels like simple honesty. It is the moment the theft completes.

—The reversal. The original €50 was funded from a stolen or compromised account. When the true owner reports the unauthorised charge, the bank reverses that incoming payment out of your account.

—You're down twice over. The €50 you received is clawed back; the €50 you sent is gone to the scammer. You paid them out of your own pocket and have nothing to show for it.

The genius — and the cruelty — of this one is that it weaponises your honesty, not your greed. Most scams need you to want something for nothing. This one needs you to do the decent thing and give a stranger their money back. The more trustworthy you are, the better the target you make. That's why "just be less gullible" is useless advice here: being a good person is the vulnerability.

Recreated WhatsApp chat from an unknown Spanish number claiming to have sent a 50-euro Bizum by mistake and asking the victim to send it back, illustrating the accidental-Bizum scam. — What the message looks like, recreated. An unknown number claims an “accidental” Bizum and asks you to return it “to this number.” The money it sent came from a compromised account and is later reversed — so the amount you send back leaves your own pocket. Example only — not a real message.

The rule the Banco de España keeps repeating

On its official consumer site (Cliente Bancario), Spain's central bank states the one fact that collapses most Bizum scams. In its own words on the "Estafas por Bizum" page:

"Si recibes un Bizum, el dinero se ingresa automáticamente en tu cuenta; si te piden confirmar algo, desconfía: se trata probablemente de un pago que vas a hacer, no de un ingreso que vas a recibir."

— Banco de España, Estafas por Bizum (clientebancario.bde.es). In English: if you receive a Bizum, the money is credited automatically; if they ask you to confirm something, be suspicious — it's probably a payment you're about to make, not money you're about to receive.

So the rule is simple and absolute: a genuine Bizum you receive never requires you to confirm, approve or accept anything. The money simply lands — no PIN, no notification to approve, no "accept" button.

That single rule also defeats the scam's nastier cousin — the fake "confirm to receive" request. Here the scammer sends you a Bizum request (a charge), dressed up in a message as if it were money coming to you. If you tap to "accept the payment," you are actually approving a payment out of your account. Because receiving never needs approval, any screen asking you to confirm, enter a PIN, or authorise something "to get your money" is — by definition — trying to take money from you, not give it.

How to stay safe

1If money 'arrives by mistake', do nothing. You are not responsible for sending back a payment a stranger claims they made in error. The correct, safe channel is for them to ask their own bank to reverse it — a real accidental transfer can be undone that way. Your job is simply not to move your own money. Silence costs you nothing; 'returning' it costs you everything.

2Never 'return' it to a number or account they give you. The scammer will push you to send the money to a specific phone number, account or Bizum contact. That is the theft. The legitimate reversal never runs through a destination the other person chooses — it runs through the banks.

3Remember the Banco de España rule: receiving needs no approval. A genuine Bizum you receive just lands in your account — no PIN, no confirmation, no 'accept' button. So if a screen asks you to enter your PIN or approve a notification 'to receive' money, stop: that is a request to SEND money wearing a disguise.

4Read the screen before every tap. Bizum shows clearly whether you are about to send or receive. Scams rely on speed and a confusing message that makes 'send' feel like 'accept'. Two seconds reading the actual action on screen defeats the entire trick.

5Verify any 'urgent' message through a second channel. If the request seems to come from a friend, family member or your bank, contact them a different way — call the number you already have, not the one in the message. The 'hijo en apuros' (child in trouble) version of this runs on WhatsApp and trades on panic.

6If you already sent it, report in minutes. Call your bank to try to stop the outgoing payment, file a denuncia with the Policía Nacional or Guardia Civil, and report to INCIBE on 017. Keep every screenshot — speed and evidence are what give you a chance of recovery.

If you already sent it back — the emergency steps

If you've already returned money or approved a request, move quickly:

1Contact your bank immediately, report the fraud, and ask whether the outgoing payment can be stopped or recalled. With instant payments the window is short, so call now.

2Gather every piece of evidence before it disappears — screenshots of the Bizum notification, the full chat, and the phone number or contact used.

3File a report (denuncia) with the Policía Nacional or the Guardia Civil. A formal report is usually needed for any chance of recovery and for your bank's investigation.

4Report the scam and get free guidance from INCIBE on 017 (the citizens' cybersecurity line), or forward a scam SMS to INCIBE at incibe@incibe.es.

5If you're an expat unsure where to start, use our international reporting directory for the right body in Spain.

Then watch for the second scam. People who have just lost money are a prime target for a recovery scam — someone who contacts you claiming to be a lawyer, the police, or a "fund recovery" service that can get your Bizum money back for an upfront fee. No legitimate body charges you in advance to recover stolen money. The recovery offer is the same predators returning for a second bite.

From the field. The reason this scam spreads so fast is that the victim does everything that normally keeps you safe — they don't click a strange link, don't hand over a password, don't chase easy money. They just return a payment to a stranger who seemed to have made an honest mistake. That's why warnings that boil down to "be more careful" miss it entirely. The fix isn't suspicion of everyone; it's one mechanical habit: money that arrives "by mistake" is never yours to send back — let the banks reverse it.

The one rule

If you take one habit from this piece, take this: never "return" a Bizum a stranger says they sent by mistake — do nothing, and tell them to ask their own bank to reverse it. A real incoming payment needs nothing from you. The moment someone needs you to send, approve or confirm, the money is flowing the other way.

Got an odd Bizum and not sure what to do? Ask us before you send anything.

Describe what arrived and what they're asking. A real expert reviews every case and replies within 24 hours — free, confidential, nothing to sell.

Submit a free case review →Scammed in Europe — can you get it back? →

Common questions about the Bizum scam

What is the 'accidental Bizum' scam?

It is a scam where receiving money is the trap. A stranger sends you a Bizum payment, then messages to say it was a mistake and politely asks you to send it back. The Banco de España and Spain's Guardia Civil have warned about it. The money you received was taken from a third party whose account was compromised; when that person reports the unauthorised charge, the original Bizum is reversed — but the 'refund' you sent from your own balance is gone. You end up paying the scammer out of your own pocket.

Someone sent me money by Bizum and asked me to return it — what do I do?

Do not send it back. If a Bizum truly arrived by mistake, the safe response is to do nothing and tell the sender to ask their own bank to reverse it — that is the proper channel, and it costs you nothing. Never 'return' the money yourself to a phone number or account the stranger gives you. If you are unsure, screenshot everything (the payment, the messages, the phone number) and ask your own bank before moving a cent.

Why does returning the money cost me twice?

Because the incoming money is not really the scammer's. They funded the 'accidental' Bizum from a stolen or compromised account. When the genuine owner notices and reports it, the bank claws that original payment back out of your account. Meanwhile, the money you 'returned' went straight to the scammer from your own funds. So you lose the amount you sent back, and the amount you received is reversed — the scammer keeps your real money.

How can I tell a genuine incoming Bizum from a scam?

The Banco de España has stressed one rule: a genuine Bizum you receive never requires you to confirm, approve or accept anything. The money just lands. So if a request asks you to enter your PIN, approve a notification, or 'confirm to receive' a payment, it is not an incoming payment at all — it is a request for you to SEND money, disguised as receiving it. Reading the screen carefully before you tap is the whole defence.

I already sent the money back — what now?

Act immediately. Contact your bank to report the fraud and ask whether the outgoing payment can be stopped or recalled. Gather all the evidence — screenshots of the Bizum, the chat, the phone number — and file a report (denuncia) with the Policía Nacional or the Guardia Civil. You can also report the scam and get free guidance from INCIBE on 017. Then ignore anyone who later contacts you promising to recover your money for a fee — that is a second scam targeting people who were just hit.

Sources & further reading

Claims in this piece are attributed to these sources. Click any of them to verify.

A stranger "accidentally" Bizums you money and politely asks for it back. Sending it back is the scam.