Spaniards trust banks more than police to stop cyber-scams

Barely a week passes without a fresh SMS phishing wave emptying current accounts across Spain, yet citizens still hand their confidence to the same sector that charges them overdraft fees: banking. A nationwide poll released Monday awards lenders 7.1 out of 10 for cyber-defence, outranking the State security forces, Big Tech platforms and every layer of public administration.

The reputational shield that money buys

The score is not pulled from thin air; it is built on the perception that CaixaBank, Santander, BBVA and their peers have skin in the game when customer data bleed. The survey, commissioned by the Spanish Banking Association (AEB) and the savings bank lobby CECA, shows 83.5 % of the population now logs on to digital banking at least once a week. That habitual exposure has paradoxically fed comfort rather than fear: the share of users who feel “quite or very safe” operating online has jumped five percentage points in twelve months to 78 %.

Trust peaks with Bizum, the instant-payment app that has turned mobile phones into digital wallets for half the country. No other online service—neither public-tax gateways nor streaming accounts—enjoys comparable perceived security.

Fraud moves faster than perception

Here is the catch: most scams no longer breach bank firewalls. They bypass them. Two-thirds of respondents admit receiving bogus e-mails; half have fielded sham calls; one in four has been approached through social media. Criminals harvest credentials outside the reinforced perimeter of banking apps, then stroll through the front door with stolen keys. Older customers—those supposedly most vulnerable—are in fact the least hit, proof that experience still trumps digital over-confidence.

The industry line is clear: “Our systems are sound; the weak link is the customer.” Yet 60 % of citizens confess they lack the know-how to spot an advanced ruse, and one-third of 18-to-29-year-olds still believe their bank might legitimately request passwords via WhatsApp. The education gap is a time bomb.

Marketing victory, regulatory target

Brussels will not care about perception metrics when the new Payment Services Directive (PSD3) lands next year, shifting liability further toward payment providers. A single authorised-push-payment fraud could erase the reputational premium captured in Monday’s glossy presentation.

Banks have spent millions on TV spots warning against smishing; they now run Aula Digital tutorials for schoolchildren and retirees alike. But tutorials do not trend on TikTok, where the next generation of account holders sources its financial advice. The clock is ticking.

Meanwhile, cyber-crime-as-a-service kits sell on Telegram for €99 a month, complete with Spanish-language scripts and ready-made fake bank pages. The survey shows the brand halo surrounding lenders remains intact—for now. The next breach, when—not if—it comes from a customer’s own handset, will test whether that 7.1 score was a vote of confidence or merely the calm before a reputational rout.