My bank denied my fraud claim: what now

Translated from the Spanish original. If there is any discrepancy between the two versions, the Spanish text prevails. Read the original in Spanish.

You filed your claim on time, with the OIJ complaint, and the answer arrives: denied, because the transfers were made with your passwords. Under Law 10889 (Ley 10889), in force since April 22, 2026, that is not enough. The law and the regulation that the General Superintendency of Financial Entities (Superintendencia General de Entidades Financieras, SUGEF) published on September 19, 2026 set out when a claim may be denied, with what evidence, and who reviews that decision.

On what grounds can the claim be denied?

Financial institutions supervised by SUGEF are liable, even without fault, for money that an unauthorized third party takes from accounts (we explain this in another article). That is why a denial is the exception. The law allows it only if the institution has its own, case-specific evidence that conclusively shows one of three situations (Article 3):

Self-fraud (autofraude): the person acted on purpose to deceive the institution and obtain a benefit.
Willful misconduct (dolo): deliberate conduct aimed at committing an unlawful act, knowing that it is unlawful.
Transfer between accounts of the same holder: the money merely moved from one of your accounts to another one that is also yours.

The regulation (Acuerdo SUGEF 5-26) further requires that, to deny on any of those grounds, the institution prove that it complied with the controls the regulation imposes to prevent fraud (Article 9).

Carelessness is not on the list. In the past, many denials relied on the fact that the customer had handed over their passwords: in Decision 08357-2025, the Administrative Litigation Court (Tribunal Contencioso Administrativo) sided with a state-owned bank that had denied a claim because the transactions were made with data that the person authorized on the account handed over during a deceptive phone call. Today, before the institution, that alone does not fit any of the three grounds. That said, the law still provides that the institution is not liable if a defense provided for in the legislation applies (Article 35 of the Consumer Protection Law, Ley de Promoción de la Competencia y Defensa Efectiva del Consumidor, Law 7472, as amended by Law 10889). In a lawsuit, if the victim contributed to the fraud through imprudence or lack of skill, the institution could be released; the judge assesses this in each case.

What evidence must the institution give you?

First, the institution must show you that it complies with the controls SUGEF requires and that its systems were not breached, taking into account, for example, your usage patterns and your usual devices. Only then may it analyze the customer’s conduct (Article 3 of the law and Article 8 of the regulation).

The decision denying the claim must include the evidence supporting it, such as the forensic analysis or the log (bitácora), which is the electronic record of what happened in the system (Article 3 of the law and Article 9 of the regulation). Annex 1 of the regulation details what the institution must send to SUGEF:

a letter signed by a legal representative detailing each transaction, the dates of the claim and of the denial, and the reason with its technical justification;
a copy of the claim, of the decision, and of the internal investigation report;
the log showing that the two-factor authentication you had enabled was used, or that you had not set it up;
the logs of the login and transaction notifications sent to you, without your having objected to the transaction;
whether there was a cybersecurity incident that day: if not, the incident log; if there was, the analysis showing it is unrelated to your case;
if a trusted device was used, the log of the notice by which it was authorized and the log of its use; if not, the log showing that the login complied with the security mechanisms.

If the decision does not address these points, you have arguments to challenge it.

Who reviews the denial?

The institution must send a copy of the decision to the OIJ and to SUGEF, which has ten business days from receiving the report to decide, by means of a reasoned act, whether the denial is supported by the evidence (Article 3). According to Annex 1, only denials of claims above the amount each institution sets for refunds without investigation are sent to it.

If SUGEF does not ratify the denial, the institution must return the funds within a maximum of ten business days and, if appropriate, reopen the account, although it may later sue to have a judge declare that the payment was not owed. If SUGEF upholds it, you may go to court (Article 3). In any event, you may turn to the administrative or judicial route whenever you see fit (Article 15), and in those proceedings the burden of proof is reversed in your favor (General Public Administration Law, Ley General de la Administración Pública, Article 298, and Civil Procedure Code, Código Procesal Civil, Article 41.1).

Practical recommendations

Read the decision with Annex 1 at hand. Check which ground it invokes and what specific evidence it presents.
If it does not include the evidence, request it in writing. The investigation must demonstrate it to you.
Check your own records. Look in your phone and your email to see whether you really received those notifications.

Need help?

At Murillo y Guzmán we can review your institution’s decision, compare it with what the regulation requires, and assist you on the path that best suits you. Book a consultation.

This article is for informational purposes only and does not constitute legal advice for any specific case. To discuss your situation, book a consultation.