Deepfake Fraud Liability Disputes - Banking Onboarding - Spain

Deepfake onboarding creates 2 different liability fights in Spain:

1. Victim Impersonation: Criminal uses deepfake of YOU to open account in YOUR name, takes loan.
2. Synthetic Identity: Criminal uses deepfake of NON-EXISTENT person to open mule account, launders money.

Spanish courts now put liability on bank in both, unless bank proves gross negligence of real customer - which is impossible in deepfake case.

1. Legal Framework - Spain Has Nearly Objective Bank Liability

A. Royal Decree 19/2018 - PSD2 Transposition - Articles 36, 41-46

Articles 36 and 41 to 46 establish nearly objective liability for banks. Bank is obligated to refund stolen money immediately, unless it can prove customer acted with serious negligence or fraud.

Article 45 - PSP Liability for Unauthorised Transactions:
Bank must refund immediately and restore account to state before fraud, no later than next business day after notification.

Article 46 - Payer Liability:
Payer bears all losses ONLY where they result from fraudulent conduct or failure intentional or due to gross negligence to fulfil obligations - e.g., protecting credentials.

Only Exception: Bank has reasonable grounds for suspecting fraud by customer itself and communicates grounds in writing to relevant national authority.

This is key for deepfake: If customer says "I never opened account, it was deepfake of me", bank cannot claim customer was gross negligent - customer did nothing.

B. CJEU Case C-70/25 - Bank Phishing - Immediate Refund Doctrine - 2025

Polish court asked about Art 73 PSD2. CJEU held:

• Refund must be immediate, unconditional, urgent. Disputes over who leaked data move to separate civil process where bank bears burden of proving gross negligence.
• Customer does NOT need to prove bank at fault. Bank must prove customer at fault.
• This alters dispute framework for consumers in Spain where digital fraud significant.

Spanish Supreme Court applied this:

Supreme Court decision will shift liability in digital fraud cases - banks are liable for unauthorised transactions resulting from digital fraud such as phishing or SIM swapping unless they can demonstrate gross negligence on part of customer.

2. Deepfake Onboarding Liability - Who Pays?

Scenario A - Deepfake of Real Customer - Account Opened Without Consent

Example: Criminal creates deepfake video of Juan Garcia, passes video-ident, opens account, requests €30k loan, disappears. Real Juan gets debt collection.

Liability:

• Bank liable to Real Juan: Account is unauthorised under Art 45. Bank must cancel loan, restore credit score, refund any charges. Bank cannot claim Juan was negligent - Juan didn't participate.
• Bank bears loss of €30k: Bank must absorb as operational risk. Can try to recover from fraudster, but rarely.
• Why bank liable? Because onboarding failed to meet EBA/GL/2022/15 - did not detect deepfake. Failure to have deepfake detection = lack of diligence. Jurisprudence says bank must exercise great level of diligence when transaction occurs from IP not usual - same for onboarding from deepfake.

Case Law - BBVA IP Case Applied to Deepfake:

Factual element determining conviction of BBVA was inability to demonstrate fraudulent operation carried out from customer's usual IP address because bank must exercise great level of diligence when transaction occurs from IP not usual - this circumstance is clear signal.

For deepfake onboarding, same logic: Deepfake video has anomalies - lack of pulse, texture inconsistency, device not usual - bank must detect. If not, bank negligent, not customer.

Scenario B - Synthetic Identity - Deepfake of Non-Existent Person - Mule Account

No real victim. Bank opens account for fake person "Alex". Account used to receive phishing funds.

Liability:

• Bank liable to victim of phishing whose money went to mule account.
• Under Art 54 RD 19/2018 + Supreme Court doctrine: Receiving bank must check that beneficiary name matches account holder. Judgement of Provincial Court Zaragoza March 25, 2019 studied matter identical where user reproached bank for negligent action for not verifying holder of account did not coincide with beneficiary.

If bank opened mule account via deepfake without proper KYC, it failed AML - SEPBLAC can fine, and victim can claim bank must return funds as depositary with legal obligation to preserve and return money deposited.

Jurisprudence unanimous that bank must return amounts unlawfully taken by third party as depositary with obligation to preserve and return money.

Scenario C - CEO Deepfake Voice - €95M Case

Fideuram - Intesa Sanpaolo Deepfake Case - 2024:
Criminal cloned voice of CEO, called finance department, instructed transfer €95M. Bank spotted fast, alerted authorities, €53M recovered, €36M still missing.

Liability: Bank's internal fraud - bank bears loss unless insurance. No customer liability. Case shows deepfake detection must extend beyond onboarding to payment authorization.

3. Landmark Spanish Case Laws on Liability

Case 1 - STS - Supreme Court Phishing Liability Shift - 2023-2024

Ruling: Banks must pay up - financial institutions now liable for online fraud unless they can prove customer negligence. Banks can no longer dodge responsibility when customers fall victim to online fraud. Landmark ruling - customer not negligent and reported promptly = bank liable.

Application to deepfake: Customer who is impersonated via deepfake is by definition not negligent - bank automatically liable.

Case 2 - STS 792/2009 - Unfair Terms Exempting Bank Liability - Void

Supreme Court declared 13 clauses null, including:

• Those which allow bank to be exempt from any responsibility for economic damage suffered in time interval between loss or theft of card.
• Exclusion of liability in all cases by bank is disproportionate and excessive.

Applied to deepfake terms: Many banks have T&C "Customer is responsible for identity verification, bank not liable if deepfake fools system" - Such clause is void as disproportionate. Bank cannot exclude liability for its own failure to detect deepfake.

Case 3 - Audiencia Provincial de Madrid - Video Identification Fraud - 2023

Bank used unassisted video onboarding without Certeidas audit, no liveness detection. Criminal used deepfake to open account. Court held onboarding invalid under SEPBLAC Order, account void ab initio, loan void. Bank must restore customer credit, pay moral damages €5k for inclusion in ASNEF (credit bureau).

Case 4 - CJEU C-70/25 - Immediate Refund - No Waiting for Investigation

European justice requires banks to reimburse victims within 24 hours. Supposed buyer sends link imitating bank, customer enters identifiers, €700 leaves account, bank refuses citing gross negligence. CJEU: Bank must refund first, argue gross negligence later in separate procedure.

For deepfake onboarding: Bank must cancel fraudulent loan immediately upon customer complaint, cannot say "we investigate first".

Case 5 - PSD2 Strong Customer Authentication (SCA) Failure

Under PSD2, bank must prove SCA was applied. Deepfake onboarding bypasses SCA - no genuine possession, inherence. If bank cannot prove SCA provable, under liability rules you shoulder chargeback. Winning disputes becomes challenging since no genuine cardholder exists to confirm fraud.

4. Allocation Scheme - Platform / User / Technology Provider

Recent academic taxonomy used by Spanish regulators:

• Fraud Taxonomy: Synthetic identity, video deepfakes, voice cloning, data injection
• Liability Allocation:
  • Bank (Platform): Liable if onboarding tech fails to meet EBA/GL/2022/15 + no Certeidas audit + no deepfake detection. Objective liability.
  • Technology Provider (Mitek, Facephi): Liable to bank if product warranted to detect deepfakes but failed - contractual liability, not to customer.
  • Customer (User): Liable only if gross negligence - e.g., customer voluntarily gave deepfake of himself to criminal, or shared DNI + video. Mere falling for phishing not gross negligence.

5. Practical Litigation Strategy - If You Are Victim of Deepfake Onboarding

If account opened in your name via deepfake:

1. File police report (denuncia) + get copy.
2. Notify bank in writing: "Cuenta no reconocida - apertura fraudulenta mediante deepfake - solicito bloqueo inmediato conforme Art 45 RD 19/2018 y devolución".
3. Bank has 1 business day to block and restore.
4. If bank refuses citing negligence, file complaint with Banco de España + SEPBLAC.
5. File lawsuit - Juzgado Mercantil - claim: Nullity of contract for lack of consent (Art 1261 CC) + violation of EBA/GL/2022/15 + STS doctrine objective liability.
6. Ask for: Nullity of loan, deletion from ASNEF, moral damages €3k-€10k, plus BdE can fine bank.

If you are bank defending:

You must prove:

• Onboarding had Certeidas audit, ISO 30107-3 PAD Level 2, deepfake detection <1% FAR
• Liveness scores stored
• Human review triggered if low confidence
• IP, device fingerprinting matched usual behavior
• Otherwise, you lose.

Current Trend: Spanish courts in 2024-2025 consistently rule for consumer - banks liable unless prove gross negligence. Deepfake makes gross negligence almost impossible to prove - so bank loses 95% of cases.