Spanish banks report 150% spike in fraud conducted from stolen devices

Average value per fraud attempt increases by 63%

MADRID (Oct. 14, 2026) — Over the last 12 months, Spanish financial institutions have seen increases in attempted fraud sessions, attempted scam sessions, the average value of those fraud and scam attempts, and the number of digital banking sessions conducted from stolen devices. Stolen device fraud allows its perpetrators to profit twice: once by draining the victim’s bank account and a second time by selling the stolen device.

“In the first half of the year, our Spanish customers also reported a 35% increase in sessions involving malware,” BioCatch Director of Global Fraud Intelligence Thomas Peacock said. “That spike is consistent with the local increases we’ve seen in both job and investment scams, which often direct victims to install a bogus trading app or work portal that then infects the device with a piece of malware.”

Bad actors targeting the region increasingly impersonate legitimate institutions and the family members of their prospective victims, combining AI-generated voice cloning with live photo and video calls to build a convincing sense of legitimacy.

The Spanish banks reporting this data all work with BioCatch, which prevents fraud and scams by recognizing patterns in user behavior. Attempted fraud sessions at those banks increased by 19% over the last 12 months, attempted scam sessions by 46%, and the average value of a fraud attempt by 63%.

Other key report findings:

• Scams most common fraud type: Social engineering scams accounted for 43% of all fraud and 60% of fraud losses in Spain over the last 12 months.
• Bot sessions decline: As Spanish banks have improved their defenses against bots, fraudsters continue to pivot to social engineering attacks.

The report also includes a case study showing how behavioral intelligence identified a remote access attack on a corporate account.

Click here to download the complete report.

###

About BioCatch:

BioCatch prevents fraud and financial crime by recognizing patterns in human behavior, continuously collecting more than 3,000 anonymized data points — keystroke and mouse activity, touch screen behavior, AI agent usage, jailbroken devices, and more — as people interact with their digital banking platforms. With these inputs, BioCatch's AI and machine-learning models continuously assess both user intent and any signs of coercion or manipulation throughout every millisecond of every digital banking session, allowing banks to distinguish the criminal from the legitimate in real time. Insights drawn from across the entire network of BioCatch institutions further amplify the power and accuracy of that real-time risk-scoring. As of the end of H1 2026, more than 370 financial institutions deploy BioCatch solutions, analyzing 19 billion user sessions per month and protecting more than 760 million users on more than 1.8 billion devices around the world from fraud and financial crime.

###

PR contact:

Mac King
BioCatch director of global marketing communications
Mac.King@BioCatch.com