If you pay by card online, the Spanish central bank starts from an uncomfortable premise: the plastic itself is not needed. Number, expiry date and CVV are enough. The defences that follow aim to make those three details nearly worthless — a law-mandated second check, an online card that is not your main one, and paying through a handset — plus the Spanish rules on who absorbs a fraudulent charge.
no se necesita tener la tarjeta físicamente, basta con su numeración, su fecha de caducidad y su CCV — Banco de España
- Key Point: Spanish payment law makes strong customer authentication compulsory, and remote codes must be bound to the amount and the payee.
- Key Point: Where the bank skipped that check, exposure stops at €50 before notice and can fall to nothing for purchases made with printed card data alone.
- Key Point: Prepaid, virtual and tokenised cards each cap the damage a leaked number can do.
The check the law requires
Article 68 of Real Decreto-ley 19/2018 on payment services obliges banks to apply strong customer authentication when a payer initiates an electronic payment; article 3 defines it as combining at least two independent elements from knowledge (a PIN), possession (a phone) and inherence (a fingerprint or face). Remote payments add a condition that does the protective work: the code must be tied to the sum and the beneficiary. Delegated Regulation (EU) 2018/389, applicable since 14 September 2019, requires that you be told how much you pay and to whom, and that any change to those details invalidates the code. Card checkouts run on EMV 3-D Secure, which EMVCo — the body behind the standard — says lets merchant and bank exchange data on the operation, the payment instrument and the device so the customer can be authenticated and card-not-present fraud curbed.
Why no prompt appears
Exemptions are built in. Online, no challenge is needed if the payment is €30 or less and no more than €100 or five operations have accrued since the last one. In shops, contactless is exempt to €50 per tap and €150 or five taps cumulatively.
When the bank did not ask
Article 46 is the clause most shoppers have never read. If strong authentication was never demanded, an unauthorised payment’s consequences fall on you only if you acted fraudulently. Otherwise the baseline caps your loss at €50 for operations made before you alerted the bank, barring fraud or gross negligence — and liability vanishes entirely for a remote payment made with nothing but the data printed on the card, assuming no gross negligence and prompt notice. So act at once: report the charge and block the card. From the moment you notify, Banco de España notes, the bank answers for later operations you did not make.
Cutting the exposure
The second layer is financial common sense rather than technology. Among its internet-fraud tips, Banco de España suggests a modest everyday balance, no overdraft, reviewed card limits and a prepaid card for e-commerce, which limits the value at risk.
Virtual cards push further, issued in the bank’s app or website with a number unlike the physical one. Finantres, reviewing one Spanish lender’s offering, describes single-use cards for a specific purchase and repeat-use cards with a monthly ceiling for subscriptions; a leak costs no more than that ceiling. A dynamic CVV targets the third detail: the security digits rotate, sometimes every few minutes, and show only in the bank app after you identify yourself, so a stolen number paired with a stale code is worth little. Terms vary between banks, so check yours.
Tokenisation swaps the real number for one bound to a device. EMVCo calls it substituting payment tokens for valuable card data. Apple says adding a card prompts the bank to create a device account number held in the Secure Element, an isolated chip, sent with a transaction-specific dynamic code; neither Apple nor the handset passes your number to the merchant. Google Wallet makes the same commitment for Android, and Apple Pay, Google Pay and Samsung Pay all rest on this design.
None of it fixes judgement. Talk someone into approving an operation in the banking app and strong authentication has done exactly what it was built for — they authorised it. That is why a code bound to sum and payee matters: read both before confirming. Banco de España’s warning is blunt:
tu banco nunca se dirigirá a ti para pedirte…
The sensible defaults: a phone wallet wherever accepted, separate or short-lived numbers for online shopping, and attention at every prompt.