The Bank of Spain has placed fraud at the center of its concerns around customer protection. Its 2025 Complaints Report identifies fraudulent payment transactions as the leading source of customer complaints throughout the year.
Fraud has become, by far, the most common reason why banking customers file complaints. In 2025, it accounted for 9,179 complaints submitted to the supervisor—nearly three out of every ten cases received—and the trend continues to worsen, with an 18% increase compared with the previous year.
The outlook shows no signs of slowing. According to the Bank of Spain, fraud-related complaints increased by more than 50% in the first four months of 2026 compared with the same period a year earlier. For financial institutions, this translates into more complaints to manage, greater supervisory scrutiny over how cases are handled, and an erosion of customer trust that may not always appear on the balance sheet but has a direct impact on customer perception.
The sustained increase in complaints places fraud among the top priorities for the financial sector, both from a risk management and customer protection perspective.
At the same time, supervisors increasingly expect institutions to demonstrate not only that they complied with regulatory requirements, but also what concrete measures they took to prevent fraud.
The report highlights two areas where the problem is particularly concentrated:
- Credit and debit cards, where complaints increased by 15%. These cases stem from two main issues: payments authorized by customers after being manipulated through fraud or social engineering, and complaints related to insufficient information provided on revolving credit cards, a type of credit product repaid in small installments that can leave customers in debt far longer than expected.
- Bank transfers and current account transactions, where fraud is often the result of criminals persuading customers to initiate the transfer themselves, rather than exploiting a technical vulnerability.
When a bank can demonstrate that it applied Strong Customer Authentication (SCA) before authorizing a payment—such as a one-time verification code or confirmation through the banking app—the supervisor generally rules in the institution’s favor, as this shows compliance with regulatory requirements.
However, regulatory compliance is not the same as fraud prevention. A bank may fully comply with Strong Customer Authentication requirements and still fail to stop a customer from being manipulated into authorizing a fraudulent transaction.
Why it matters
This is the broader takeaway: fraud is no longer primarily about compromising systems—it is increasingly about manipulating people. Phone calls impersonating banks, messages that mimic official communications, and, increasingly, AI-generated voices and images are making social engineering attacks harder to detect, both for customers and for financial institutions.
For banks, this reinforces the need to complement traditional security controls with models capable of assessing the full context of every transaction: who is initiating it, from which device, under what behavioral patterns, and whether there are risk signals linked to identity, biometrics, or known fraud.
Strong authentication at the start of a transaction is no longer enough. Financial institutions need to go further by continuously assessing whether a transaction remains legitimate throughout its lifecycle—or whether behavioral, contextual, or device-related signals indicate that the customer may be acting under the influence of a fraudster.
