Published on August 24, 2026 · The mitza.es team
Spain's national and civil police registered more than 380,000 reports of digital scams in Spain during 2025, 58% more than in 2020, with an economic impact of over €1.5 billion in losses. Within that landscape, Bizum is the most impersonated payment system in the country, with more than 60,000 scams recorded in 2024 alone.
What exactly the "reverse Bizum" is
The technique is simple, which is exactly why it works: the scammer contacts you as if they were about to pay for a product or service, but actually sends you a payment request, not a money transfer. If you don't check the notification carefully and accept it thinking you're receiving payment, you end up being the one sending money to the scammer.
The "fake refund" variant
There's a second, even more damaging pattern: the scammer sends an initial Bizum payment from a stolen account. Since it looks like a legitimate payment, many businesses refund it in good faith, thinking the customer made a mistake. When the bank detects and reverses the original fraudulent transaction, the money you voluntarily refunded can no longer be recovered, because it left your account legitimately.
Another common vector: fake refund SMS messages
There are also SMS messages circulating that mimic notices of pending refunds from official bodies, with a link that actually leads you to authorize a payment, not receive one. The pattern repeats itself: urgency and trust in anything that looks official are the levers the scammer uses so you don't check the details.
How to protect your business
- Before accepting or refunding any unexpected Bizum, contact your bank first to verify the actual transaction.
- Always check whether the notification is a payment request or an actual money transfer before tapping "accept."
- Train anyone on your team who handles payments to recognize these patterns.
- Be wary of any urgency related to refunds from official bodies sent by SMS or messaging apps.
Part of a broader problem
This scam fits the same trend we already saw with AI-powered phishing: increasingly personalized messages that are harder to distinguish from legitimate communication. The best defense remains the same: verify through a different channel before moving money, and don't rely solely on whether a message "looks" right. If you want to strengthen your business's overall security, you can request an audit or check our guide on cyber insurance for SMEs as an additional safety net.