The son in trouble scam and fake bank callers in Spain: how to spot them and what to do at once

The son in trouble scam in Spain makes you picture a stranger ringing you. In the case the Policía Nacional solved in Alicante in June 2026, it worked the other way round. The victim got a message that appeared to come from his bank, with a phone number in it, and he rang that number himself. The person who answered posed as a bank employee and asked for his access codes. Thirty thousand euros gone.

So the standard advice, do not answer unknown numbers, would not have saved him. He did the calling. That is why this piece is not about who rings, but about what gets asked. Below: how the two tricks work, what to do during the call, and what to do if you have already paid.

How the son in trouble scam works

You get a WhatsApp or a text from a number you do not know. It is short and it sounds like your child:

Mum, my phone is broken. This is my new number. Can you call me? Actually I cannot take calls, can you message instead?

Then comes the story. A bill that has to be paid today. A new phone. A fine. The amount is usually between three and four thousand euros. There is always a hurry, and there is always a reason why speaking is impossible.

That last part is the whole trick. If you rang, you would hear at once that it is not your child. So the scammer needs a reason to keep the phone out of it.

And that is where their story falls apart. A broken phone does not mean a new number. The SIM goes into another handset and the number stays the same. Anyone handing you a new number because their phone broke is telling you something that makes no technical sense.

How the fake bank caller works

The second trick is more businesslike, and more dangerous for it. In May 2026 the Guardia Civil dismantled an organisation doing exactly this: ringing on behalf of a bank, creating urgency and alarm, and prising verification codes out of people. Fifteen arrests, four hundred thousand euros.

The script is almost always the same:

1. A suspicious transaction has been spotted on your account.
2. They need to block it now, or your money is gone.
3. To do that they need a code you are about to receive by text.

That code blocks nothing. That code authorises their transfer. You type it in and you give away your own money.

Often the number on your screen looks right too. Scammers can spoof your bank’s phone number, so the call shows up in your history under your bank’s name.

What actually happened in Alicante

Three cases from 2026 in the province of Alicante, each with an arrest:

• June 2026. A man received a notification that appeared to be from his bank, with a contact number in it. He rang that number, got a fake employee and handed over his access codes. Thirty thousand euros transferred. The Policía Nacional arrested a nineteen-year-old in Alicante.
• May 2026. The Guardia Civil broke up a network that used fake bank calls to extract verification codes. Fifteen arrests, four hundred thousand euros.
• October 2026. A woman was arrested in Alicante after receiving 15,499 euros from a bank fraud into her account and forwarding it to accounts in tax havens.

One honest caveat. You will often read that this kind of fraud is rising in Alicante. We could not find an official figure showing an increase in 2026. What is established are these three cases. That is reason enough to pay attention, statistics or no statistics.

The warning signs, strongest first

Not every sign carries the same weight. Here they are, from certain to least certain:

1. You are asked for a code, a PIN or a password. This one is absolute. No bank asks for these, not by phone, not in an app, never. The conversation ends here.
2. You are asked to move money to a “safe account”. There is no such thing.
3. There is urgency and there is threat. Now, or you lose it.
4. Speaking is impossible. Messages only, chat only, email only.
5. A new number because the phone broke. Technically meaningless.
6. You are asked to keep it quiet. Do not tell dad, do not tell the bank.

One or two of these is already enough to hang up.

What to do during the call

Three things, in this order.

Hang up. Do not explain, do not argue, do not announce that you find it suspicious. Just hang up. You owe no courtesy to someone asking for your PIN.

Call back yourself, on a number you look up yourself. Not the number in the message. Not the number they give you. Do not press redial. Take the back of your bank card or the official app and ring that. For your child: ring the number you have had saved for years.

Wait a minute before calling back, or use a different phone. A call can be held open, so that your call back lands you with the same scammer.

The code word

The simplest defence costs one message and lasts a lifetime. Agree a code word within your family.

An ordinary word that appears nowhere online and that nobody could guess: the name of the dog you had as a child, the street your grandmother lived on, the dish you always eat on New Year’s Eve. Not a birthday, not a pet name that is on Facebook.

The rule is simple: anyone asking for money through a channel where you cannot hear each other gives the code word first. No code word, nothing happens.

It works the other way round too. If your mother rings you with an odd request, you can ask her for the code word.

Already paid? Do this, in this order

Shame is the real enemy here. People wait a day before they dare ring anyone, and that is exactly the day that matters.

1. Ring your bank immediately. Not tomorrow. Ask whether the transfer can still be blocked or reversed, and have your card or access frozen.
2. Ring 017. The free helpline of the Spanish cybersecurity institute INCIBE. They are there every day from 8am to 11pm, all year round, and they will help you with the report too.
3. Collect evidence. Screenshots of every message, the phone number, the time, the account the money went to and the transaction record.
4. Report it. How, is below.
5. Block the number only after you have the screenshots. Blocking before you have evidence costs you your evidence.

You will read everywhere that the first hours are critical. We could not confirm that in an official source, so we will put it this way: ring at once, because waiting can never help.

Where and how to report it

There are two forces and it does not matter which: both the Policía Nacional and the Guardia Civil will take your report. In towns it is usually the Policía Nacional, in rural areas and smaller coastal villages the Guardia Civil.

There are two routes:

• Online, through denuncias.policia.es. Practical if your Spanish is decent and you have all the details to hand.
• In person, at the station. The wiser route if your Spanish is limited, because you can hand over your evidence and ask questions.

Take photo ID, plus every screenshot and bank record printed out. Always ask for a copy of the report with its case number. Your bank will ask for it.

Note that the report matters even if you never get the money back. Without it, the case does not exist as far as your bank and your insurer are concerned.

The numbers you need

Put these four in your phone before you need them.

• 017, the free cybersecurity helpline. Every day from 8am to 11pm, 365 days a year, confidential. Also on WhatsApp at 900 116 117 and on Telegram at @INCIBE017.
• 091, Policía Nacional.
• 062, Guardia Civil.
• 112, the general emergency number, if there is immediate danger.

And the most important number is not on that list: your own bank’s, as printed on the back of your card. Add it.

Never lend out your account

This is the side of the story people underestimate. The woman arrested in Alicante in October 2026 had not defrauded anyone herself. She received 15,499 euros into her account and passed it on.

In Spanish criminal law that makes you a cooperador necesario, a necessary accomplice. You are not a victim then, you are a suspect.

The recruitment is often charming. An advert for working from home as a “financial agent”. A new online friend who cannot receive his money just now. Someone asking whether he might use your account number for a while, with a percentage for you.

The rule is short: your account is yours and nobody else’s. You do not lend it out, to anyone, ever, including people you like.

How to protect your parents and your neighbours

The people most at risk are often the people who will not read this article. On the Costa Blanca something else comes on top: many people live here without family nearby, and that is exactly what this scam exploits. Distance makes checking hard.

Four things that genuinely help:

• Agree the code word out loud, at the table, with everyone there. Not by message, because then nobody remembers it.
• Say in advance that you will never be angry. The reason older people raise the alarm too late is shame, not ignorance. Remove the shame before it happens.
• Agree that nobody ever transfers money without ringing first, however daft that feels in the moment.
• Put 017 in their phone, under a name they will recognise.

A neighbour who knows she can always ring you to ask “does this look right?” is better protected than someone who has memorised every trick.

About the authorLeonie

Leonie lives on the Costa Blanca. She writes about daily life on the coast: the markets, the walks and everything you only discover once you actually live here.