Bizum has become a default payment rail for millions, which makes one misunderstanding especially dangerous: accepting a money request does not collect cash. It sends cash. That distinction sits at the heart of most Bizum fraud, from bogus second-hand buyers to messages claiming a payment was made by mistake.
- Core mechanic: A Bizum request asks you to pay its creator. Ignoring or rejecting it moves no money.
- No credentials needed: Receiving a Bizum requires no bank codes, account numbers or passwords. Anyone asking is running a scam.
- After acceptance: A confirmed Bizum is irrevocable in the app. Contact your bank immediately, preserve evidence and report the fraud.
What a Bizum request really does
A request is a demand for money, not a notification of incoming funds. The person requesting money enters the amount and recipient; the recipient has seven days to accept before expiry. The bank app alerts the user. Bizum’s guidance is to read the message, open the details and reject the request if anything feels doubtful. Until then, no money moves. Receiving money is different. The Banco de España says an incoming Bizum is deposited automatically; if someone asks you to confirm something, treat it as suspicious because it is probably a payment you are about to make, not a deposit.
Bizum says the problem “always comes down to a user being tricked into proactively sending money.”
Five recurring Bizum scams
Reverse Bizum in second-hand sales. A fraudster poses as a buyer on a marketplace, then sends a request instead of a payment. The Centro Europeo del Consumidor, part of the Ministerio de Consumo, places this mainly on Milanuncios, Wallapop and Vinted. The victim mistakes the request for a transaction step and authorizes a payment.
The fake refund. A message claims money was sent by mistake and asks for it back. The Banco de España warns that many victims accept without checking whether any money arrived. Sometimes funds do arrive, but from an already compromised account, so consult the bank before returning unexpected money.
The fake public body. Bizum’s anti-fraud guidance describes scammers impersonating the Seguridad Social with a refund promise. The sender may appear as TGSS to seem credible. What arrives is not a deposit but a payment request.
Advance payment. The fraudster is the seller: they advertise an item at a tempting price and ask for part or all of the money before shipping, but the goods never arrive.
The acquaintance in trouble. A supposed contact sends an urgent request for money. INCIBE advises confirming identity through another channel, such as a phone call. With AI-generated voices and images, that check is no longer excessive caution.
No codes, no credentials, no exceptions
Receiving a Bizum never requires sharing banking credentials, codes or account numbers. Bizum says a recipient does not need to enter bank credentials, and neither the bank nor Bizum will ask for an account number. If someone claiming to be either asks, do not reply. Nor should a buyer ask you to read out a code sent to your phone: such codes authorize your operations. The pattern mirrors phishing — urgency, external links and requests for data no legitimate party needs.
If you have already accepted
Contact your bank immediately and report the incident to the Policía Nacional or Guardia Civil with all available evidence. Do not expect the app to undo the transaction. Bizum acknowledges that a Bizum cannot be cancelled: it arrives in seconds and becomes irrevocable once confirmed. The trail matters. Bizum says all operations are recorded with the recipient’s details and provided to authorities when requested during an investigation.
- Contact your bank. It can advise and assess recovery; Bizum mentions a retrocession, similar to a transfer.
- Preserve evidence: screenshots of messages, the listing, phone numbers and amounts.
- File a report with the Policía Nacional or Guardia Civil.
- Seek free help from INCIBE on 017, also via WhatsApp.
- If the bank does not resolve the complaint, INCIBE notes you can turn to the Banco de España.
Bizum sets limits per transaction, per day and per month, and banks can apply lower limits. Reducing them in the app is a cheap way to contain mistakes if Bizum is rarely used.
The deeper issue is interface design. A screen where “accept” means “pay” resembles one for receiving money, and fraudsters exploit that gap. Blog warnings do not close it. Until the interface changes, the defensive rule is one line: receiving money never requires accepting anything. Sellers should add another: the buyer sends the money, and you confirm nothing. If the other side asks the opposite, the sale is over.