Spanish police expose how a fake 'mom needs cash' text drains bank accounts in seconds

Your phone buzzes. A WhatsApp message claims your child lost their phone and needs €300 right now. You reply, you pay, you panic—then you discover it was a stranger on the other end. That exact script has hijacked more than 12,000 Spanish smartphones since January, according to data the National Police shared with TechBloom, and the curve keeps climbing.

The scam that feels like family

Cyber-criminals harvest real names from social media, clone profile photos, then spoof a relative’s first words: ‘Hi, it’s me, new number, don’t call the old one, it’s broken.’ Once the target answers, the fraudster floods the chat with urgency—hospital bills, traffic fines, a rent deadline—always solvable with a Bizum transfer or a SEPA code that empties the account in seconds.

INCIBE quietly raised the alert level to Category 4 last quarter, a label reserved for cons that end in confirmed monetary loss. The reason: 78 % of victims who engage beyond the first message eventually send money, a hit rate almost triple that of old-school phishing emails. ‘Voice notes are the clincher,’ a fraud analyst at the agency told us. ‘Hearing a trembling “Mom, please” triggers the amygdala faster than any written plea.’

How to build a two-euro fortress

Police comms teams tweet theatrical warnings, yet the most effective defence costs less than a café con leche. Pick a ‘family password’—a nonsense word like ‘Tiburon-43’—share it in person, and never over the phone. If the frantic texter can’t produce it, the conversation ends. No password, no cash. ‘It’s medieval cryptography for the smartphone era,’ laughs Lt. Arantxa Gómez, who tracks organised scam rings from Madrid’s cyber precinct.

Banks could slam the brakes; some already delay first-time Bizum transfers above €150 until a second factor—a voice call to the registered line—clears the transaction. Yet only three of Spain’s top eight lenders have switched the friction on by default. The rest still prioritise user convenience over fraud drag, and scammers know it.

So the equation stays brutally simple: a five-minute family huddle beats every AI filter the banks haven’t installed. Fail that, and the only Oscar on offer is the con artist’s performance, paid for with your balance.