Spanish Banks Hit by 150% Surge in Fraud from Stolen Devices

Spanish financial institutions are grappling with a significant escalation in digital crime, as social engineering scams now drive 60% of total fraud losses in the region. This shift toward behavioral manipulation, often enhanced by AI-generated voice and video, signals a critical need for banks to move beyond traditional bot detection toward deeper behavioral intelligence.

What was announced

The latest data reveals a complex threat landscape where stolen device fraud has become a lucrative "double-profit" enterprise for criminals. Perpetrators first drain the victim’s bank accounts through digital banking sessions and subsequently sell the physical hardware. Over the last 12 months, Spanish banks utilizing behavioral intelligence have seen a 19% rise in attempted fraud sessions and a 46% surge in attempted scams. Most notably, the average value of these fraud attempts has climbed by 63%, suggesting that criminals are successfully targeting higher-value transactions.

While bot-driven sessions are on the decline—a result of Spanish banks successfully hardening their perimeters against automated scripts—the vacuum is being filled by malware and remote access attacks. Social engineering now accounts for 43% of all fraud incidents in Spain. These attacks often involve bad actors impersonating legitimate financial institutions or even family members. By combining AI-generated voice cloning with live photo and video calls, fraudsters are creating a convincing sense of legitimacy that bypasses standard skepticism. A specific case study illustrates how behavioral intelligence was used to identify a remote access attack on a corporate account, a high-stakes vector that traditional security often misses. The 35% spike in malware sessions is particularly concerning, as it is often the payload for bogus trading apps or fraudulent work portals used in investment scams.

"In the first half of the year, our Spanish customers also reported a 35% increase in sessions involving malware. That spike is consistent with the local increases we’ve seen in both job and investment scams, which often direct victims to install a bogus trading app or work portal that then infects the device with a piece of malware."

Thomas Peacock, Director, Global Fraud Intelligence at BioCatch.

The companies involved

BioCatch is a specialist in behavioral biometrics, focusing on identifying criminal activity by analyzing how users interact with devices and applications. By recognizing patterns in user behavior rather than relying solely on static credentials, the company aims to distinguish between legitimate customers and bad actors. The company is currently a portfolio firm of Permira Advisers LLP, a global investment firm that has supported its expansion in the fraud prevention market. However, the corporate structure is in a state of transition following significant M&A activity. In August 2024, Visa announced an agreement to acquire BioCatch for $2.4 billion. This acquisition is intended to integrate advanced behavioral intelligence into Visa’s global payments network, reflecting the increasing importance of behavioral data in combating the rise of AI-driven fraud and sophisticated social engineering tactics across the global financial ecosystem.

What FF News has reported before

FF News has tracked the global expansion of these threats, recently noting that BioCatch Report: 90% of Banking Scams Now Target Mobile Devices as Global Fraud Rises 35%. This trend is mirrored in the U.S. market, where BioCatch Report: U.S. Impersonation Scam Losses Skyrocket 130% as AI Accelerates Fraud Evolution. We also covered the landmark Visa to Acquire BioCatch for $2.4 Billion to Combat AI-Driven Fraud and Scams, highlighting the premium placed on behavioral data by major payment networks. Furthermore, as governments react to these shifts, we reported on how the UK and Cambodia Unite Against Scam Centres as BioCatch Warns of AI-Powered Fraud Shifts to disrupt the physical infrastructure behind these digital attacks.

What this means

The decline in bot-driven attacks in Spain suggests that banking defenses against automated threats are maturing, forcing a pivot in criminal strategy. The industry is entering a phase where the "human element" is the primary vulnerability, with fraudsters utilizing AI to bridge the trust gap through voice cloning and deepfakes. This puts immense pressure on traditional Multi-Factor Authentication (MFA), which is increasingly bypassed through social engineering or remote access. For the broader fintech sector, the challenge is no longer just verifying a user's identity at login, but continuously verifying their intent throughout a session to distinguish a legitimate user from a manipulated one.