Spanish banks report 150% surge in stolen device fraud, research reveals

By Puja Sharma

Spanish banks have reported a sharp rise in digital banking fraud, with sessions conducted from stolen devices increasing by 150% over the past 12 months. Attempted fraud sessions rose by 19%, while the average value of attempted fraud increased by 63%, according to an October 2026 report by BioCatch based on data from Spanish financial institutions using its technology.

Attempted scam sessions increased by 46% during the same period, highlighting the growing pressure on banks to detect fraud that exploits customers and their devices rather than relying solely on conventional security checks.

The findings point to a shift in criminal tactics as financial institutions strengthen their defences against automated attacks. Fraudsters are increasingly using social engineering to persuade customers to disclose credentials, install malicious applications or grant remote access to their devices.

Social engineering scams accounted for 43% of reported fraud cases in Spain and 60% of attempted fraud losses recorded in the report. Common methods include impersonating bank employees or law enforcement officials to create urgency and pressure victims into transferring money. Fraudsters are also exploiting Spain’s instant payment service, Bizum, by tricking users into accepting requests that authorise outgoing payments.

Fraud moves beyond account security

The report highlights how stolen devices can provide criminals with multiple opportunities to profit. After accessing a victim’s banking account and attempting to transfer funds, fraudsters can also sell the stolen device.

Malware is another growing concern. Sessions in which malware was detected increased by 35% between the first and second quarters of 2026, according to the report. Job and investment scams have contributed to the trend by directing victims to download fraudulent applications disguised as trading platforms or work portals.

Remote access tools present a separate challenge. These applications allow criminals to operate a customer’s device and banking session remotely, potentially making fraudulent activity appear to originate from a legitimate device and location. The report found a 9% increase in digital banking sessions involving remote access tools between the first and second quarters of 2026.

In a separate corporate banking case study, the report describes attempted transfers exceeding €42,000 following the installation of remote access software on a customer’s Android device. The fraudster reportedly remained inactive for approximately two weeks before attempting the transfers, illustrating how attacks can unfold over an extended period rather than immediately after a device is compromised.

Implications for banks

The findings suggest that transaction monitoring and device recognition alone may not be sufficient to identify increasingly sophisticated attacks. Fraudulent payments can take place within authenticated sessions, using legitimate customer credentials and devices that have been compromised or remotely controlled.

Spain’s Ministry of the Interior recorded 489,248 cybercrimes in 2025, of which 430,493 were online scams primarily driven by malware and social engineering, according to figures cited in the report.

For banks, the challenge is to identify suspicious behaviour before a payment is completed, while also addressing the activities that precede a fraudulent transaction. Monitoring changes in device use, unusual account activity and deviations from established customer behaviour could help strengthen existing controls.

As criminals adapt to improvements in automated fraud detection, financial institutions face a broader challenge: protecting customers throughout the digital banking journey, not simply securing the final transaction.

Tighten the opening for faster impactMake the banking implications more specific

Over the last 12 months, Spanish financial institutions have seen increases in attempted fraud sessions, attempted scam sessions, the average value of those fraud and scam attempts, and the number of digital banking sessions conducted from stolen devices. Stolen device fraud allows its perpetrators to profit twice: once by draining the victim’s bank account and a second time by selling the stolen device.

“In the first half of the year, our Spanish customers also reported a 35% increase in sessions involving malware,” BioCatch Director of Global Fraud Intelligence Thomas Peacock said. “That spike is consistent with the local increases we’ve seen in both job and investment scams, which often direct victims to install a bogus trading app or work portal that then infects the device with a piece of malware.”

Bad actors targeting the region increasingly impersonate legitimate institutions and the family members of their prospective victims, combining AI-generated voice cloning with live photo and video calls to build a convincing sense of legitimacy.

Key findings:

• Scams most common fraud type: Social engineering scams accounted for 43% of all fraud and 60% of fraud losses in Spain over the last 12 months.
• Bot sessions decline: As Spanish banks have improved their defenses against bots, fraudsters continue to pivot to social engineering attacks.