Spain: Consumer Protection & APP Fraud

Consumer Protection & APP Fraud

Spain's consumer-facing APP-fraud picture this cycle combines a statistical baseline with a converging legal-and-statutory liability trajectory. Spain's Ministerio del Interior recorded 464,801 registered cyber-offences in 2024, approximately 89% of which were online fraud; notably, this marked the first year-on-year decrease in this statistic. Kaspersky-sourced data places the average per-victim loss at €577, while under-reporting is estimated at near 69%, a figure that suggests the true fraud-loss picture for Spanish consumers is materially larger than officially recorded statistics indicate.

Against this statistical backdrop, Spanish consumers already benefit from judicial protection ahead of formal statutory codification: the Tribunal Supremo's sentencia 571/2025 ordered a bank to refund over €56,000 lost to phishing and SIM-swap fraud for failing to react to evident fraud signals. Once PSD3/PSR is transposed, expected in the mid-to-late 2027 window, this judicial standard is expected to be joined by an explicit statutory provider-liability obligation for authorised push payment fraud under the PSR component of the package.

Taken together, Spanish PSPs face a converging statutory-and-case-law liability regime for APP fraud, arriving in two stages: an already-live judicial standard now, and a codified statutory obligation once transposition is complete. Consumers experiencing APP fraud losses in Spain currently have judicial precedent to draw on even before PSR's liability provisions take direct legal effect domestically.

Outlook

The near-term-to-mid-term development to track is whether Spain's declining year-on-year cyber-offence statistic continues, and whether further judicial rulings extend or refine the evident-fraud-signal liability standard ahead of PSD3/PSR's formal transposition into Spanish consumer-protection law.