Spain Scams: Online, Tourist & Investment Fraud Guide
Common scams in Spain and how to report to INCIBE, the Policía Nacional, and your bank.
Emergency number: 112 — verify on official sources.
Last reviewed: 1 August 2026
Spain is both a high-volume tourism destination and a target for online fraud. Tourist areas see classic street scams, overcharging taxis, and fake rental listings, while the broader population faces phishing, smishing (fake Correos parcel texts), investment fraud, and job scams. INCIBE (the National Cybersecurity Institute) runs the 017 free cybersecurity helpline, and police complaints can be filed online or at a Policía Nacional or Guardia Civil station.
Spain's instant payment app Bizum has spawned its own scam family: fake buyers on Wallapop or Milanuncios who send a Bizum 'request' instead of a payment (hoping the seller approves it without reading), fraudulent 'refunds' from utility or tax impersonators, and charity-collection requests from strangers. Approving a Bizum request always sends money, so read every notification. The 'hijo en apuros' ('child in trouble') WhatsApp scam is another staple — a message from an unknown number claims to be your son or daughter with a broken phone needing an urgent transfer. Bank impersonation follows the European pattern: an SMS that threads into your real bank's messages warns of a suspicious login, the link leads to a cloned site, and a follow-up call from the 'fraud department' finishes the job.
Rental fraud is acute in Madrid, Barcelona, and the coastal markets: cloned listings at attractive rents, landlords 'working abroad' who want a deposit by transfer before any viewing, and holiday lets that don't exist. Tourists should watch for the classic distraction repertoire — bird-dropping cleanups, petition clipboards, three-cup games on La Rambla — plus bar-bill and flamenco-ticket overcharges. Investment fraud runs through WhatsApp and Telegram 'trading academies' and celebrity-deepfake ads; check the CNMV's warning lists before putting money anywhere. Report to your bank first, then the police and INCIBE's 017 for guidance.
Common scams
- Phishing and smishing impersonating banks or Correos
- Investment and crypto fraud
- Rental and property deposit scams
- Online marketplace non-delivery
Tourist-specific scams
- 'Three-card' and shell-game street scams
- Overcharging or unlicensed taxis at airports
- Fake flamenco show ticket sellers
- Distraction theft and 'bird-dropping' scam
Online shopping scams
- Fake online shops and rental listings
- Account takeover phishing
- Subscription trap sites
Job scams
- Task scams via messaging apps
- Fake job offers requiring upfront documentation fees
- Money-mule recruitment via 'easy income' social media ads
Romance scams
- Dating-app romance and cryptocurrency investment grooming
- 'Hijo en apuros' WhatsApp messages impersonating a child in trouble
- Long-distance partners with escalating emergencies and travel costs
Investment scams
- Fake trading platforms and clone broker firms
- Crypto and 'AI bot' investment schemes
- WhatsApp and Telegram 'trading academy' groups with fake celebrity endorsements
How to report a scam here
- Contact your bank immediately if money was transferred
- Report cybercrime and fraud via INCIBE at incibe.es or call the 017 helpline
- File a police complaint at denuncias.policia.es or at a local police station
- Check investment firms with the CNMV (securities regulator) at cnmv.es
Local reporting & protection links
- Cybercrime reporting
- Consumer protection
- Police
- INCIBE 017 cybersecurity helpline — Free helpline — dial 017 within Spain
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Bank & payment guidance
Call your bank immediately using the number on your card; Spanish banks can attempt to recall transfers most effectively in the first few hours, so do this before anything else. Say plainly that you were deceived into making the payment, ask for it to be stopped and the receiving account reported, and write down the reference number. For Bizum, tell the bank whether you sent money or approved a request — approving a request is still an outgoing payment, and speed matters because Bizum settles instantly. Spanish banks have faced growing pressure, and court rulings, to reimburse victims of convincing spoofed-SMS and spoofed-call fraud, so file a police denuncia and give the bank the reference: a formal complaint materially strengthens your claim. No legitimate bank or authority sends an SMS asking you to confirm credentials via a link. If you clicked one or shared a code, change your passwords from another device and ask about blocking the card.
Evidence to preserve
- Screenshot all messages, profiles, websites and payment pages
- Save transaction references, account numbers and crypto wallet addresses
- Keep emails with full headers where possible
- Note dates, times, names and phone numbers used
Frequently asked questions
What is the INCIBE 017 helpline?
It is a free Spanish government cybersecurity helpline staffed by specialists who can advise on cybercrime and online fraud incidents. Dial 017 free from within Spain.
How do I avoid rental scams in Spain?
Use only established rental platforms, never pay a deposit by bank transfer before verifying a property in person or through a verified agent, and be suspicious of prices significantly below market rates.
Can I lose money by accepting a Bizum?
Yes — if what you approve is actually a payment request rather than an incoming payment. Fraudulent 'buyers' and fake refund agents send Bizum requests hoping you'll confirm without reading. Check whether the notification says you are sending or receiving before entering your PIN.
Sources
- National police and cybercrime portals (verify on official sites)
- FTC / Action Fraud / Scamwatch consumer guidance