Cyber fraud against companies

What to do in the first 24 hours and who bears the loss

Cyber fraud against companies rarely breaks into any system. It deceives a person: the one who pays. An email that looks like it comes from the CEO, a call in their voice, an invoice from a long-standing supplier with a new bank account. The employee, deceived, makes the transfer with their own credentials. That is why the law treats the payment as valid and the loss, almost always, stays with the company.

Traditional crime has mutated along with society: new offences and new ways of committing them appear, and the prosecution of crime has to evolve with them. Today, the best lawyer is the one who combines knowledge of how the criminal operates with procedural practice and with a problem we all know: how long a judicial response takes. That is why we work with IT forensic experts, private investigators and lawyers specialised in cybercrime.

The four most common forms

1. CEO fraud. Someone poses as the chief executive or a director and orders an urgent, confidential transfer. Today the voice may be cloned with artificial intelligence. We tell the story in Open Case.
2. Supplier IBAN change. An email, sometimes from the supplier's real mailbox, announces a new account for paying a genuine invoice. It is the fraud we see most often in SMEs.
3. Payroll diversion. An email «from the employee» asks to change the account where their salary is paid. The company pays the salary into the fraudster's account.
4. Fake lawyer or fake adviser. A second person, supposedly from a firm handling the transaction, dictates the instructions and asks that nobody else be told.

In all of them the same thing happens: urgency, secrecy and a change from the usual way of paying.

The first 24 hours

Money is recovered, when it is recovered, through speed. This is the order.

1. Call your bank, on its fraud line, and confirm in writing: ask it to attempt to recall the transfer and to ask the receiving bank to hold the funds. This is a request, not a right: whether the bank holds the money is up to it, and it cannot be compelled.
2. Report it the same day to the National Police or the Guardia Civil, with the transfer receipt, the destination account, the emails and the call log. The police can request information from the bank and go to the judge. Only a judge can order an account to be frozen with binding effect.
3. Preserve the evidence. Do not delete emails or messages; keep the originals and note times and numbers.
4. Notify the insurer within the policy deadline. Late notice is the first reason to dispute payment.
5. Protect the employee. They are the main witness. If they fear the consequences they will be slow to speak, and here every hour counts.

Acting in time works. In a case in April 2026, the Guardia Civil obtained the precautionary freezing of six transfers totalling more than €2.2 million in under 24 hours from when they were ordered, thanks to an online report. It was a smishing fraud (an SMS impersonating the bank), not CEO fraud, but the lesson is the same ^[2].

Who bears the loss?

First you must know whether the transaction was authorised. Spain's payment services law requires the bank to refund an unauthorised transaction immediately, at the latest by the end of the next business day after the customer notifies it, provided the customer reports it without delay (art. 45 of Royal Decree-law 19/2018) ^[4]. The Court of Justice of the European Union has clarified, in its judgment of 15 October 2026 (Case C-70/25, Tukowiecka), that the bank cannot refuse that immediate refund by alleging gross negligence by the customer: it must refund first and, if it proves such negligence, claim afterwards. That protects those who suffer phishing ^[1].

But in CEO fraud and IBAN-change fraud nobody impersonates the company to the bank: the order is given by the company, through its employee, with its credentials. For the law, that transaction is authorised (art. 36) and the immediate-refund rule does not apply ^[4].

If you paid a supplier, what happens to the debt?

It depends on how the money reached the wrong account.

If you paid by mistake (wrong account or wrong amount), you can claim the money back from whoever received it: anyone who receives something they had no right to collect, delivered by mistake, must return it (art. 1895 of the Civil Code). If, once the mistake is pointed out, they do not return it and dispose of the money, they commit misappropriation in its residual form (art. 254 of the Criminal Code), which the Supreme Court applies to whoever receives money by mistake from the sender and, once warned, refuses or fails to return it ^[3]. That is why it is advisable to send a formal demand quickly: the law does not expressly require one, but it proves that they knew of the mistake and did not return the money. And do not wait: it is a minor offence and is time-barred after one year, so the civil and criminal routes must both start early.

If you paid because of deception (a fraudster gave you a false account in your supplier's name), the payment does not discharge your company: your supplier, who has not been paid, can still claim the debt from you, because payment must be made to the person in whose favour the obligation was constituted or to someone authorised to receive it on their behalf (art. 1162 of the Civil Code). Your company loses the money paid and still owes it. Payroll works in a similar way.

That is why you should speak to the supplier the same day, by phone, before the other side's lawyer does.

What crime is it?

Fraud (art. 248 of the Criminal Code). The basic penalty is six months to three years' imprisonment; one to six years plus a fine if the amount exceeds €50,000, and four to eight years plus a fine if it exceeds €250,000 (art. 250). Whoever lends their account to receive the money commits money laundering (art. 301): six months to six years if they knew the money was of criminal origin, and six months to two years if they acted with gross negligence. A voice cloned with AI does not change the offence: it only makes the deception more believable ^[4].

How to protect yourself: seven rules that fit on one page

1. Two people for every significant payment. Whoever prepares it does not approve it.
2. Always call back on a number the company already had, never the one given in the email or the call itself.
3. New account, delayed payment. Every new account or change is verified through another channel and waits a fixed period before the first payment.
4. Urgency and secrecy do not excuse checking, even when the order comes from the top executive. In writing: nobody will be penalised for hanging up and checking.
5. Limits agreed with the bank: a cap per transaction and per day, joint signature above a set amount, and an alert for every new payee. And do not waive the payee verification that euro-area banks have offered since October 2025, including for batch payments (Regulation (EU) 2024/886).
6. A voice no longer identifies anyone. An agreed control question for any payment order by phone or video call.
7. One drill a year and, the same day, re-read the insurance policy.

Frequently asked questions

If it has already happened

Call your bank and then us: +34 916 26 63 93 or through the contact form. Tell us what happened, at what time you ordered the payment and to which account. You do not need to bring anything for the first call.

Sources

1. Court of Justice of the European Union, judgment of 15/10/2026, Case C-70/25 (Tukowiecka), press release No 147/26. Link
2. Guardia Civil, «La Guardia Civil evita una estafa de 2,2 millones de euros gracias a una denuncia telemática», 08/04/2026 (in Spanish). Link
3. Spanish Supreme Court, Criminal Chamber: judgments 30/2015 of 22 January (appeal 1219/2014); 403/2015 of 19 June (ECLI:ES:TS:2015:3175); 119/2021 of 11 February (ECLI:ES:TS:2021:598); and 575/2023 of 10 July (ECLI:ES:TS:2023:3099), which classifies art. 254 as a minor offence with a one-year limitation period.
4. Criminal Code (LO 10/1995), arts. 248, 250, 254 and 301 (BOE); Civil Code, arts. 1162 and 1895 (BOE); Royal Decree-law 19/2018 on payment services, arts. 36 and 45 (BOE); Companies Act, art. 225; Regulation (EU) 2024/886.

Criminal law and compliance · Open Case: «Your CEO called. It wasn't him.»