Social engineering fraud and bank claims: what really happens when the customer authorises the transaction

The typical case

A customer makes several international transfers in a short period of time: to different beneficiaries, in different countries and completely outside their usual transactional pattern.

Later, it is discovered that the customer has been the victim of fraud. They file a police report, provide documentation and formally claim against the bank.

The bank's response is usually clear: the operations were correctly authenticated and, therefore, authorised.

The key point: authorisation vs. real consent

This is the core of the problem. From a technical and regulatory perspective, if the customer enters their credentials and validates the operation through the security systems, the operation is considered authorised.

However, this ignores a fundamental element: consent may be vitiated by deception. In social engineering fraud the customer does not act freely; they act under manipulation, taking decisions conditioned by a carefully crafted narrative.

Even so, in administrative practice the equation remains: authentication equals valid consent, with no further nuance.

The role of banks

Financial institutions rely on two pillars: correct authentication and the principle of irrevocability of payment orders. These two elements allow them to argue that the operation was valid, that the bank acted correctly and that there is no liability on their part.

Analysis of anomalous patterns, unusual behaviour or the need for additional alerts based on the customer's profile remains, in many cases, in the background.

And the central bank?

When the customer turns to the central bank's complaints service, they expect a deeper review. The reality, however, is different. It works fundamentally with documentary evidence, does not carry out technical or expert investigation and does not assess the psychological context of the fraud.

Consequently, in many cases it concludes that it cannot determine who actually performed the operation, cannot assess whether there was deception sufficient to invalidate consent, and cannot identify reviewable bank conduct.

Usual outcome: the file is archived without a substantive ruling.

A structural limit of the system

This scenario is not a one-off anomaly. It is a structural limit. Payment services regulation protects the technical security of operations, but it is not designed to address fraud based on psychological manipulation.

This generates a grey zone where the customer is a victim, but the operation remains formally valid.

What this means for the user

Three practical conclusions. First: prevention is key. Once the operation is authorised, the real chances of recovery are very limited.

Second: the administrative system has limited scope. Neither the bank nor the central bank tend to enter the substance of these cases.

Third: judicial action is, in many cases, the only alternative. But it implies cost, time and uncertainty, and requires building solid evidence of vitiated consent.

Final reflection

Social engineering does not attack systems. It attacks human decisions. And as of today, the administrative framework continues to evaluate those decisions as if they had been taken under normal conditions of information and freedom.

That is the gap. And that is where the future evolution of customer protection should focus.