Electronic fraud: what to do right away

Translated from the Spanish original. If there is any discrepancy between the two versions, the Spanish text prevails. Read the original in Spanish.

The phone rings, and someone claiming to call from the “security department” of your financial institution warns you about a suspicious transaction. To “protect the account,” they ask for the code that just arrived by text message. Minutes later, the balance is zero. Other times, the person logs into a fake website or discovers transfers they never made. These acts are crimes, and since April 2026 a new law sets out what the financial institution must do and within what deadlines.

What crime is it, and where do you report it?

The Criminal Code (Código Penal, Law 4573) punishes computer fraud (estafa informática): manipulating or influencing the data of a computer system, for example with false data, to obtain a financial benefit. The penalty is three to six years in prison, and five to ten years when the attack targets banking systems or the systems of financial institutions (Article 217 bis). When the deception targets the person directly, as in the fake call, it may also be ordinary fraud (estafa) (Article 216).

The criminal complaint (denuncia) can be filed orally or in writing with the Judicial Investigation Agency (Organismo de Investigación Judicial, OIJ), the Public Prosecutor’s Office (Ministerio Público), or a criminal court (Articles 278 and 279 of the Code of Criminal Procedure, Código Procesal Penal). It is advisable to provide dates, times, amounts, phone numbers, and destination accounts (Article 280). Within the criminal proceedings, the victim can also claim the return of the money and damages, including against whoever is civilly liable (Article 37).

What changed with Law 10889?

Law 10889, on the protection of consumers in the custody of their money, was published in the official gazette (La Gaceta) on April 22, 2026, and has been in force since that day. Its main points:

The institution is liable even without fault. The law amended Article 35 of the Law on the Promotion of Competition and Effective Consumer Protection (Ley de Promoción de la Competencia y Defensa Efectiva del Consumidor, Law 7472): supervised financial institutions are liable for damages when an unauthorized third party takes money from the accounts, regardless of the method used, unless a legal ground releases them (Article 1).
Deadline to file a claim. The affected person has thirty calendar days from the events to file a claim with the institution, using the form it provides and attaching a copy of the complaint filed with the OIJ (Article 3).
Deadline to respond. The institution has thirty calendar days to investigate and decide, which may be extended only once by up to ten business days. If it accepts the claim, it must credit the money within ten calendar days and remove any interest and charges caused by the fraud (Article 3).
Rejection backed by evidence. The institution may reject the claim only if it proves, with its own evidence, that there was self-fraud, intent to deceive (dolo), or a transfer between accounts of the same holder. The rejection is sent to the OIJ and to the General Superintendency of Financial Entities (Superintendencia General de Entidades Financieras, Sugef), which must review it within ten business days; if Sugef does not ratify it, the institution must return the funds (Article 3).
Delays have consequences. If the institution decides late, it must pay the customer compensation equal to one base salary (salario base); if one hundred twenty calendar days pass without a response, it loses the ability to reject the claim and must return the money (Article 5).

What should you do in the first few hours?

The law requires institutions to keep phone and digital channels open twenty-four hours a day, every day of the year, to receive the report and immediately block the affected products. When they receive it, they must give you a claim number with the date and time (Article 4). That record matters: the institution is liable for unauthorized transactions that occur after the claim (Article 3).

Do they always return the money?

Not necessarily. Before this law, the courts were already applying strict liability, which does not require proving fault on the part of the institution. The Third Chamber of the Supreme Court (Sala Tercera), in its judgment 31 of 2011, explained that the institution is liable because it profits from the risk its activity creates, and that it is released only if it proves a ground such as the victim’s own conduct or force majeure. That is where many cases are disputed: whether the customer gave away their passwords.

The new law limits the grounds for rejecting the claim before the institution. If Sugef confirms the rejection, the person can still go to court (Article 3), and in those proceedings the burden of proof is shifted in their favor (Article 7).

A word of caution: the same law punishes with prison anyone who pretends to be a fraud victim in order to deceive the institution (Article 9).

Practical recommendations

Notify your institution immediately through its 24-hour channel and write down the claim number, with the date and time.
File the complaint with the OIJ as soon as possible and keep the copy: you will need it for the claim.
File a written claim within thirty calendar days of the events.
Keep the evidence: screenshots of messages, call logs, emails, and account statements.
Do not give codes or passwords over the phone, even if the caller seems to know your information.

Need help?

If your claim was rejected or you did not receive a timely response, at Murillo y Guzmán we can review your case and assist you before the institution, Sugef, or the courts. Book a consultation.

This article is for informational purposes only and does not constitute legal advice for any specific case. To discuss your situation, book a consultation.