1. Legal Framework

A. Payment Services Law - Royal Decree-Law 19/2018 of 23 Nov (Real Decreto-ley 19/2018) - Transposes PSD2 Directive 2015/2366

Articles 36, 41-46 establish nearly objective liability (cuasi-objetiva):

• Art 45: In case of unauthorized transaction, bank must refund immediately (max end of next business day) unless it can prove transaction was authenticated and correctly recorded.
• Art 46: Payer bears losses ONLY if fraudulent conduct or intentional / gross negligence failure to protect credentials.

Burden of proof lies with bank: "bank must assume responsibility for losses resulting from fraud unless it can prove fraud or gross negligence by client" [[9073362209715046841]]

B. Elder / Vulnerable Customer Protection

Origin: Campaign by 78-year-old pensioner Carlos San Juan - "I'm old, not stupid" 2021-2022 against financial exclusion.

Response:

Strategic Protocol to Strengthen Banking Sector's Social and Sustainable Commitment - signed 21 Feb 2022 at Ministry of Economic Affairs with Governor of Banco de España. Banking associations AEB, CECA, UNACC signed update to include new measures to ensure personalised customer services to citizens, especially elderly. [[3299838322760876598]]

Law 4/2022 on protection of consumers in situations of social and economic vulnerability - Amends Law 7/2021 to mandate personalized attention to elderly/disabled. [[3299838322760876598]]

Banco de España Conduct Supervision Priorities 2025 - Chapter 5: Lists payment fraud prevention and embedding consumer protection across governance as key priorities. [[9073362209715046841]]

Obligations for banks:

1. Extend cashier services - personal, preferential approach with extended cashier service for elderly [[3299838322760876598]]
2. Dedicated trained staff for elderly
3. Adapt ATMs, apps, websites - simplify
4. Free training in digital skills and fraud prevention - CaixaBank example: train 30,000 employees for 4m customers over 65 [[3299838322760876598]]
5. Six-monthly reports by Financial Inclusion Observatory

C. Banco de España Circular & Anti-Fraud Duties

Under PSD2 Art 98, banks must have:

• Strong Customer Authentication (SCA)
• Transaction Monitoring System to detect anomalous patterns - multiple transfers at odd hours, unusual amounts
• Real-time fraud detection

2. Supreme Court Doctrine Shift - STS 571/2025

This is landmark.

STS 571/2025, 9 April 2025 (Id Cendoj: 28079110012025100563) - Ibercaja Banco Case

Facts: Clients lost >83,000 euros via phishing / SIM swap. Ibercaja argued credentials were used, so authorized.

Supreme Court (Judge Manuel Almenar):

"Tribunal Supremo strengthens protection of payment service users against digital fraud. Requires banks to assume liability for unauthorized transactions resulting from identity theft, even if customer's credentials were used, when they fail to prevent suspicious transactions such as multiple transfers at unusual times for large amounts." [[9073362209715046841]]

Liability of bank not only for security failures in failing to detect fraudulent operations (multiple transfers in short period, at odd hours) [[4217851769545577296]]

Ratio:

1. Burden on bank: Financial institutions now liable for online fraud unless they can prove customer negligence [[9073362209715046841]]
2. Must prove gross negligence, not mere negligence: Spanish and EU framework - gross negligence is only circumstance where user bears loss [[9073362209715046841]]
3. Age, technological literacy relevant: Factors such as advanced age, limited technological literacy, user's profession must be considered when assessing gross negligence [[9073362209715046841]]
4. Immediate refund doctrine: Bank cannot simply refuse immediate refund because it believes customer was grossly negligent. [[9073362209715046841]] - CJEU C-70/25 Tukowiecka 2025 affirmed this.

Result: Ibercaja appeal rejected, ordered to compensate customer who lost tens of thousands via SIM swap. [[4217851769545577296]]

3. Other Case Laws

1. BBVA - Court of Murcia 2025 - 5,977 euros - Failure to do everything in power
Spain's BBVA ordered to compensate customer 5,977 euros for failing to fulfil responsibilities and take all possible steps to prevent client from being scammed. Cites STS 571/2025 doctrine for usurpation of passwords and withdrawal of funds. [[4217851769545577296]]

2. STS 507/2025 (mentioned in commentary) and CJEU 21 March 2019 Case C-245/18
Under Spanish and EU law PSPs subject to heightened liability rules. Banks cannot be held liable for customer's own negligent behaviour or failures attributable to other parties in chain. But CJEU confirms bank may execute transfer solely based on IBAN - but must still monitor fraud. [[4217851769545577296]]

3. CJEU Judgment 1 Aug 2025 - Late Notification
User may lose right to refund if notifies unauthorized charges late - but bank must still prove. [[4217851769545577296]]

4. Elderly Specific - Preference Shares Cases - STS 2010-2015
Though not fraud, Supreme Court established vulnerability test: Cases involving retired and elderly, those with Alzheimer's, illiterate people, clearly unable to comprehend what signing. [[4217851769545577296]] Banks liable for mis-selling complex products to elderly. Same vulnerability standard now applied to phishing cases - elderly cannot be expected to detect sophisticated spoofing.

5. Spain - SBI vs Pallabh Bhowmick (Jan 2025) cited alongside STS 571/2025 - Framework failure = liability. Bank failed to prevent suspicious transactions such as multiple transfers at unusual times. Must prove system operated flawlessly. Quasi-objective liability. [[4217851769545577296]]

4. Bank's Obligations Checklist for Elder Fraud Prevention (Spain 2026)

1. SCA + Behavioral Monitoring: Detect multiple transfers in short period, at odd hours, large amounts - STS 571/2025 requires block.
2. Personalized Attention: For customers >65, offer human channel, extended cashier hours, cannot force digital-only.
3. Refund Immediately: Art 45 RD 19/2018 - refund by next business day, investigate after. Cannot withhold pending proof of gross negligence.
4. Prove Gross Negligence: Must show elderly customer intentionally disclosed credentials or acted with serious negligence - mere clicking phishing link is NOT gross negligence for 78-year-old.
5. Training: Staff training for elderly segment mandatory per Protocol 2022.
6. Reporting to BdE: Payment fraud prevention is supervisory priority - BdE can fine.

Bottom line: In Spain 2026, if an 80-year-old loses money to phishing, bank pays unless bank can prove intentional fraud or gross negligence by elder - and court will consider age and digital literacy as mitigating. Failure to detect anomalous transfers = bank liability even if credentials used.