Finding a payment on your card statement that you never made starts a legal clock most cardholders do not know exists. Under Spain’s payment-services framework, consumers have up to 13 months from the debit date to challenge an unauthorised transaction, and once the bank has been properly notified, the money should be back in the account by the end of the following business day at the latest.
- 13 months to act: The window runs from the date of the debit, and missing it generally forfeits the right to a correction.
- Next-day refunds: For charges you never authorised, the bank must return the amount immediately and no later than the close of the next business day, using the same value date.
- €50 ceiling: Your maximum exposure for a lost, stolen or misappropriated card is €50 before you notify the bank — and in several scenarios it is zero.
- 15 business days: That is the deadline for a bank to answer a written complaint, after which the Bank of Spain becomes an option.
Two disputes that banks treat very differently
The rulebook is Real Decreto-ley 19/2018 on payment services, Spain’s transposition of the EU’s PSD2 directive. It separates two scenarios: a charge you never authorised — a cloned or stolen card, or purchases made with your details — and a charge you did authorise but no longer want, or that arrived higher than reasonably expected, such as a subscription that was never properly cancelled or a hotel bill that overshoots the quote.
Before escalating, rule out the mundane explanation. Many “phantom” charges are genuine purchases hiding behind an unrecognisable trading name, the corporate identity of a payment gateway, or an annual renewal long forgotten. Search your inbox for the exact amount and check whether anyone at home used a card stored on a phone. If the charge still defies explanation, treat it as unauthorised.
Notification is what starts the clock
Contacting the bank is the single act that shifts the legal advantage to your side. The regulation obliges you to report unauthorised use “without undue delay” once you become aware of it, and sets the outer limit at 13 months from the debit date. The Bank of Spain’s banking-customer portal lists the practical sequence: request a block through the bank’s app, website or phone line, file a report with the National Police, the Guardia Civil or a court, and review every charge on the statement.
Banks must keep a free channel open at all times for these notifications, and must hand over proof that you reported the incident if you ask for it, covering the following 18 months. Request that proof — a chat screenshot or an incident reference number is enough. If you suspect the card details leaked through a phishing email, a fake SMS or a compromised handset, secure your accounts before a second charge lands.
Who absorbs the loss, and when the €50 cap disappears
As a rule, the bank does. It must refund the amount immediately and, at the latest, at the end of the business day following detection or notification. The one exception is where the institution has reasonable grounds to suspect fraud by the customer itself, and in that case it must report the matter to the Bank of Spain in writing.
The burden of proof also favours the cardholder: the bank has to demonstrate that the transaction was properly authenticated and recorded, and a simple log showing the card was used does not prove authorisation or negligence.
The famous €50 figure is a ceiling, not a fixed fee. It applies only to operations carried out before you gave notice with a card that was lost, stolen or appropriated. Liability drops to zero when you could not have detected the loss before the payment, when the failure came from a bank employee or agent, when fraud happened online using only the data printed on the card — number, expiry and security code — provided there was no gross negligence in safekeeping and you notified promptly, when the bank failed to require strong customer authentication, and for everything occurring after your notification.
The reverse is equally blunt: if the bank proves fraud or gross negligence on your part, you absorb the entire loss with no cap. Handing your PIN or a confirmation code to a supposed bank employee over the phone is the classic case institutions litigate.
Subscriptions, overcharges and the escalation route
A recurring payment you once approved follows a different path. Withdrawing consent stops the series, and any future charge in that sequence becomes unauthorised, returning you to the refund rules above. Confirm the withdrawal in writing to both the merchant and the bank so a record exists.
If you authorised a transaction without knowing the exact amount — a hotel hold, a car rental — and were billed more than you could reasonably expect, you can demand a refund within eight weeks of the debit. The bank then has ten business days to return the money or explain its refusal, and here the cardholder carries the burden of proof.
When the answer is no, or never arrives, submit a written complaint to the bank’s customer service, which must reply within 15 business days; in exceptional circumstances a provisional response may explain a delay, but the definitive answer cannot exceed one month. Beyond that, the Bank of Spain accepts complaints through its electronic registry or by post, provided you attach evidence of the earlier claim. Two limits apply: one year from the complaint to the institution, and five years from the events themselves.
Spanish law protects cardholders considerably more than many bank first responses suggest: next-day reimbursement is the default, the burden of proof sits with the institution, and €50 is a cap rather than a charge. The weak point remains “gross negligence”, a concept each lender interprets in its own favour. Documenting everything — notification time, incident number, police report, written complaint — is what turns a generic rejection into a recoverable claim. A new EU payment-services regulation is still in the pipeline: as of 21 October 2026, the European Parliament’s legislative observatory lists it as awaiting the Council’s first-reading position, so the current rules remain the operative benchmark for some time yet.