Suffering a fraud requires two distinct reactions: reporting the event to the authorities and attempting to limit or recover the financial loss. If the scam occurred online, you might wonder whether it constitutes fraud or computer fraud, how much time you have to file a complaint, and whether the bank is required to return the money.
In this guide, I explain how to distinguish the main protective tools. We will see why a complaint does not automatically produce a refund, when a payment can be defined as unauthorized, and what facts change the bank's position. I also want to clarify a point that is often decisive: a transfer executed personally because of deception does not necessarily coincide, in relations with the intermediary, with an operation carried out without consent.
When the Scam Is Fraud and When It Is Computer Fraud
Fraud presupposes effective deception. Article 640 of the penal code concerns anyone who, by means of artifice or deceit, induces a person into error and obtains unfair profit causing them harm. This can happen with a fake investment, a nonexistent sale, an artfully constructed payment request, or the simulation of the identity of a bank, a relative, or a business.
A simple breach of contract is not enough. The seller who delivers late or the debtor who does not pay may be civilly liable, but they do not necessarily commit fraud. For criminal relevance, it matters that the deceit preceded or accompanied the victim's decision and induced them to hand over money, goods, or data. False promises from the outset, fictitious identities, and fabricated documents can assume relevance; a difficulty that arose subsequently may instead indicate a contractual dispute.
Computer fraud acts on the system or data. Article 640-ter concerns the alteration of the functioning of an IT or telematics system, or unauthorized intervention on data, information, or programs, directed at obtaining profit with damage to others. The difference compared to traditional fraud thus lies in the mechanism: in the former, a person is induced into error; in the latter, the result derives from intervention on the system or data.
The two figures are not distinguished merely because the event took place on the internet. A false e-mail can be the tool of a fraud, while unauthorized access to credentials and subsequent data alteration can lead to a different qualification. Furthermore, computer fraud that produces a money transfer falls under the aggravated hypothesis provided for by the second paragraph of Article 640-ter. The text of Articles 640 and 640-ter and the relative rules of procedibility are reported in legislative decree no. 150 of October 10, 2022, on Normattiva.
Complaint for Fraud: Content, Term, and Procedibility
For non-aggravated fraud, a complaint is normally required, that is, the declaration by which the injured party manifests the will that criminal proceedings be instituted. Fraud is instead prosecutable ex officio in the aggravated hypotheses indicated in Article 640. For computer fraud, procedibility changes based on the concrete case and aggravating factors: it is therefore not prudent to deduce it solely from the label used to describe what happened.
The general term is three months from the day the injured party acquires news of the fact constituting the crime, barring different legal provisions. This is established by Article 124 of the penal code, consultable in the page of Article 124 in the Official Gazette. The starting date does not always coincide automatically with the date of the payment: the moment in which sufficient elements emerge to recognize the fraudulent nature of the operation may assume relevance. Waiting, however, exposes one to avoidable challenges.
The complaint can also concern unknown persons. It is not necessary to personally identify the responsible party before filing it. Instead, it is useful to describe in an orderly manner the initial contact, the deceptive statements, the payments, the recipient accounts, the telephone numbers, the digital addresses, and the moment you discovered the scam. The request that proceedings be instituted for the exposed facts must clearly result.
The injured party can present a report or complaint orally or in writing to the public prosecutor or to an officer of the judicial police, including at the Carabinieri, State Police, or Guardia di Finanza. A simple informal report may not contain the will required for crimes prosecutable upon complaint. Essential information on the methods of presentation and the rights of the victim is summarized by the Public Prosecutor's Office at the Court of Latina.
The First Moves to Stop the Damage and Preserve Evidence
The bank or payment service provider must be notified immediately. If cards, credentials, or applications have been compromised, it is necessary to request the blocking of the instruments involved and secure access through a reliable device. For a transfer that has already started, a recall or freezing attempt can be requested, but recovery is not guaranteed and also depends on the status of the transfer.
Digital evidence must be preserved in its context. Do not limit yourself to transcribing the content of messages: keep e-mails, chats, attachments, receipts, account statements, operation identifiers, site addresses, and profiles used. Screenshots are useful, but they do not always replace original files. If you deliver subsequent integrations, precisely connect each document to the fact it demonstrates.
Avoid continuing improvised negotiations with those asking for more money to unlock a refund, pay taxes, or recover the investment. The request for a second payment can prolong the scam. Even any recovery services that spontaneously contact the victim must be verified before sharing documents, codes, or additional sums.
Unauthorized Operations: When to Ask the Bank for a Refund
The bank dispute is autonomous from the complaint. Filing the criminal act does not replace communication to the intermediary and, similarly, the claim to the bank does not replace the complaint when the latter is necessary. The two initiatives have different objects: one concerns the ascertainment of the crime, the other the contractual relationship and the rules on payment services.
Legislative Decree No. 11 of January 27, 2010, establishes that consent is necessary for an operation to be considered authorized. The dispute must be transmitted without undue delay after discovery and, in any case, within thirteen months of the debit for the payer, barring the hypothesis in which the intermediary has omitted the due information on the operation. The thirteen-month term is a maximum limit, not an invitation to wait.
The technical registration of the payment does not prove everything. When the user denies having authorized the operation, the simple registered use of the instrument is not necessarily sufficient to demonstrate consent, user fraud, or intentional or grossly negligent conduct on their part. The intermediary must provide the proof required by Article 10, taking into account the concrete functioning of the authentication and the contested operation.
For an effectively unauthorized operation, Article 11 generally provides for an immediate refund and in any case by the end of the business day following knowledge or communication of the operation. The refund can be suspended in the presence of a motivated suspicion of fraud, to be communicated in writing to the Bank of Italy. The discipline also contemplates cases in which the payer can bear a loss of up to 50 euros and cases of integral liability when they have acted fraudulently or violated their obligations with intent or gross negligence.
These rules, including the burden of proof, strong authentication, and liability limits, result from Legislative Decree No. 218 of December 15, 2017, on Normattiva, which amended Legislative Decree No. 11 of 2010. Gross negligence does not automatically stem from the use of a code: what counts is the way the scam was carried out, the warnings received, the sequence of authentications, and the system's ability to make the operation understandable.
The most delicate distinction concerns the transfer personally disposed of by the victim. A payment materially wanted, but obtained through deception, can be authorized for the purposes of the payment service, while remaining at the center of a criminal scam. In this case, the refund mechanism provided for operations lacking consent does not automatically apply; any service anomalies, contractual obligations, and other possible responsibilities remain to be verified.
Recovering Sums: Bank, Criminal Proceedings, or Civil Action
The first path is the dispute to the intermediary, when the money has come out through an unauthorized operation or there are specific anomalies in the execution and security of the payment. The request must identify each debit, expressly deny authorization when this corresponds to the facts, and punctually dispute the reasons for any refusal.
The second path passes through criminal proceedings. The complaint allows the initiation of investigations in cases where it constitutes a condition of procedibility. If the proceeding reaches the trial phase, the injured party can join as a civil party to request restitution and compensation pursuant to Articles 74 and following of the code of criminal procedure. A conviction, however, does not alone ensure that the author still has useful assets that can be attached.
During investigations, real measures, such as seizure, can be adopted only when the relative prerequisites are met and the authority identifies money or assets connectable to the fact. Rapidity favors traceability, but does not create a guarantee of recovery. Funds can be transferred between multiple accounts, withdrawn, or sent abroad before the intervention of the authority or intermediaries.
The third path is civil action against the author or against other subjects whose legally founded responsibility emerges. It can be useful when the responsible party is identified, attachable assets exist, or the claim also concerns obligations different from criminal liability. The choice between autonomous civil action and joining as a civil party requires attention, because the code regulates the relations between the two judgments and certain initiatives can affect the timing and prosecution of the case.
The paths must not be confused or duplicated without a purpose. The real objective is to identify who can be held responsible for restitution, what proof supports the claim, and whether recoverable resources exist. The person who materially received a credit, the author of the scam, and the intermediary play different roles; the mere presence of money in an account does not automatically make the holder responsible for every damage.
Errors That Can Weaken Protection
Waiting for a response from the scammer can waste precious time. Promises of restitution, receipts without verification, and continuous postponements do not automatically suspend the term for the complaint. If the fraudulent character is already recognizable, it is prudent to simultaneously activate the criminal report and the relevant bank dispute.
Nor should the account be adapted to the desired legal qualification. The facts must be described without omissions, including any insertion of credentials, communication of codes, installation of programs, or personal execution of the transfer. It is precisely these details that distinguish an unauthorized operation from a payment induced by deception.
Another error consists in generically asking for a refund without indicating operations, dates, and reasons for the dispute. Complaint and claim must remain coherent: any differences must be explained, not hidden. Before sending documents, it is advisable to prepare an essential chronology, keeping the original versions and receipts of the communications made.
Frequently Asked Questions
Can I file a complaint if I don't know the scammer's name?
Yes, the complaint can be proposed against unknown persons. You must describe the fact, manifest the will that proceedings be instituted, and provide all available elements: telephone numbers, profiles, e-mails, IBANs, receipts, and operation identifiers. The identification of the author is the subject of investigations and does not constitute a requirement to be completed independently before filing.
Do the three months always run from the day of payment?
Not necessarily. The general term runs from the news of the fact constituting the crime, which can be acquired after payment if the fraudulent character emerges subsequently. Establishing the precise date may require distinguishing a simple suspicion from knowledge of the essential elements. To avoid forfeitures, it is not convenient to wait for the conclusion of negotiations or promises of refund.
Can the bank reject the claim because an OTP code was used?
The registered use of a code is not always sufficient to prove that the operation was authorized or that the user acted with gross negligence. It is necessary to reconstruct how the code was requested, what operation the device showed, and what controls the intermediary performed. An OTP communicated consciously remains in any case a relevant fact to be explained with precision.
Does the complaint allow me to get the money back automatically?
No, the complaint is not equivalent to a refund. It serves to activate criminal ascertainment when required by law. Recovery can depend on the dispute to the intermediary, the identification and seizure of funds, joining as a civil party, or a civil action. Even a conviction does not guarantee payment if the responsible party does not have useful assets that can be attached.
Can I dispute a transfer that I personally disposed of?
You can dispute it, but the reason must be correct. If you consciously confirmed the beneficiary and amount because you were deceived, the payment can result authorized in relations with the bank, while being connected to a scam. If, on the other hand, the order was altered, executed by third parties, or different from the one approved, the discipline of unauthorized operations can find application.
Promptly Identifying Relevant Protection
The first distinction concerns the path of the money: who issued the order, what credentials were used, and what the device showed at the moment of confirmation. Criminal qualification, the bank dispute, and recovery possibilities depend on these facts. If you need to reconstruct the affair and coordinate complaint, claim, and compensation demand, you can contact me bringing an essential chronology and the documents still available.