Banking
I Was Scammed Online: Is My Bank Liable Even if It Was Not at Fault?
Under Law 10889, your financial institution is liable for money a third party takes from your account, even without fault. Exceptions and burden of proof.
Translated from the Spanish original. If there is any discrepancy between the two versions, the Spanish text prevails. Read the original in Spanish.
One Sunday night, five transfers left a customer’s account, made from a cell phone she had never used. When she complained, she was told the systems had not been breached and that her username and password had been used. For years, that answer was enough. Since April 22, 2026, when Law 10889 was published, it is no longer enough on its own.
What does it mean that the institution is liable without fault?
Law 10889 amended Article 35 of the Law on the Promotion of Competition and Effective Consumer Protection (Ley de Promoción de la Competencia y Defensa Efectiva del Consumidor, Law 7472). Supervised financial institutions, public or private, are now liable for the damages caused by the taking of money from accounts or the inadequate safekeeping of funds, when it is committed by a third party the account holder did not authorize, regardless of the mechanism used (Article 1 of Law 10889).
This is known as strict liability (responsabilidad objetiva): you do not have to prove that your bank made a mistake. The institution is liable because it provides a risky service and profits from it. It makes no difference whether the fraudster used a fake website, a phone call, or a duplicate of your SIM card.
The rule covers public and private banks, non-bank financial companies, savings and loan mutuals (mutuales), and savings and credit cooperatives, among other supervised institutions (Article 2 of Law 10889 and Article 117 of Law 7558). Law 7472 is a matter of public policy (orden público): no clause in the contract can take this protection away from you (Article 72).
When can the institution be released?
Article 35 releases it if it proves a ground for exemption provided by law. Claiming that the fraudster was to blame does not help it: that is precisely the situation the law covers.
Your claim can only be rejected with the institution’s own evidence, specific to the case, showing one of these situations (Article 3, paragraph b):
- Self-fraud (autofraude): the customer acted on purpose to deceive the institution and obtain a benefit.
- Willful misconduct (dolo): deliberate conduct aimed at committing an unlawful act, knowing it is unlawful.
- A transfer between accounts of the same holder.
And before analyzing what the customer did, the institution must show that its systems were not breached and that it complies with the controls of the General Superintendency of Financial Entities (Superintendencia General de Entidades Financieras, Sugef), such as requesting confirmation before executing an atypical transaction (Article 3, paragraph a). Sugef’s regulation on computer fraud (Acuerdo SUGEF 5-26, in force since September 19, 2026) develops those controls (Article 12) and requires proof that they were met in order to reject a claim (Article 9).
Unintentional carelessness, such as giving a code to someone who called pretending to be the bank, is not among the grounds for rejection before the institution. In a lawsuit it is different: if the victim contributed to the fraud through imprudence or lack of skill, the institution could be released. It is up to the judge to assess this case by case.
Who has to prove what?
Law 10889 added a rule to Article 298 of the General Public Administration Law (Ley General de la Administración Pública) and to Article 41.1 of the Civil Procedure Code (Código Procesal Civil): in electronic fraud cases, before administrative authorities and before the courts, the burden of proof is reversed in favor of the consumer (Articles 6 and 7).
In practice, the institution keeps the records of every login (device, network, passwords, alerts) and it is up to the institution to produce them. You provide what you have: the transactions you do not recognize and the criminal complaint.
How were these cases decided before?
The original Article 35 already applied to banks, with results that depended on the evidence. In Decision 090-2012, the Administrative Litigation Court (Tribunal Contencioso Administrativo), Fourth Section, ordered a bank to return ¢3,700,000 to a customer who had entered all the numbers of his security code card on a page that looked like the bank’s. The systems were not breached, but the transfers were not customary, some came from abroad, and the bank, which knew about a virus in circulation, did not warn its customers.
By contrast, in Decision 08357-2025 that court ruled in favor of a state-owned bank: the representative of an association handed over his token and passwords during a fake phone call, and twenty-three transfers went out on a Saturday afternoon. In the court’s view, the bank’s controls worked and the harm was not attributable to it.
Whether the bank should have detected such unusual transactions is a question that now has express rules. Those decisions explain the origin of the standard, not how the new law will be applied.
Practical recommendations
- Do not consider the case closed if all you are told is that the systems were not breached: that is only the first step of the investigation.
- Describe the facts exactly as they happened, even if you were tricked into giving a code. Being deceived is not willful misconduct; faking a scam, on the other hand, is a crime (Article 9 of Law 10889).
- Demand that any rejection come with its technical evidence (Article 3) and keep your own evidence.
- Act quickly. The first steps are in our article on what to do in the first hours.
Need help?
Each case depends on how the money was taken and on the evidence available. At Murillo y Guzmán we can review yours and assist you with the claim or in a lawsuit. Book a consultation.
This article is for informational purposes only and does not constitute legal advice for any specific case. To discuss your situation, book a consultation.