Messaging apps and instant payment platforms have become everyday tools that make our lives easier, but they've also become the perfect target for cybercriminals. In recent weeks, a scam known as the "penny scam" has resurfaced , using Bizum to trick users and empty their bank accounts. The method is as simple as it is dangerous: a payment request for just €0,01 that, once accepted, opens the door to massive charges.
The trust we place in services like Bizum, coupled with the inertia of accepting notifications without a second thought, creates the perfect breeding ground for this type of fraud. The latest victim to expose the case on social media, under the username Papá en apuros (@Padre_en_apuros) , recounted how he received a one-cent payment request in the early hours of the morning, supposedly from Amazon. Luckily, the request expired before he clicked "Accept," but not everyone is so fortunate.
How does the penny scam work?
The scam begins with a mobile notification: a Bizum request for a negligible amount, usually one euro cent, appearing under the name of a well-known company like Amazon. The amount is so small that many users think it's a mistake or a routine bank verification and tap the accept button without reading the details . That's the fatal error.
By accepting this minimum charge, the victim isn't making a one-time payment, but rather digitally signing an account linking authorization for recurring payments. In other words, they're giving scammers permission to make automatic charges from that moment onward without requiring new passwords, SMS codes, or two-factor authentication. The PSD2 banking regulation allows the system to recognize the merchant as trustworthy once the first payment is authorized, without requiring further verification.
The stages of theft: from one cent to hundreds of euros
Once the criminals establish a connection, they act quickly. Within minutes, they begin issuing consecutive charges of between €100 and €500, without the bank requesting any further confirmation. The victim, who reported the case on social media, explained that after speaking with his bank, he confirmed that the attempted charge had been made, although he had not authorized it. The charges continued uninterrupted until the account was empty.
The key is that when the user accepts the penny, they activate a merchant-initiated transaction protocol, similar to the one used by platforms like Netflix to collect payments for subscriptions. That's why the bank doesn't hold subsequent charges or ask for more codes: it assumes you've already given your consent. The scammers impersonate Amazon, but they could use any other brand that inspires confidence.
How to protect yourself and what to do if you have fallen?
Security experts are unequivocal: reject any Bizum payment request that you didn't initiate , regardless of the amount or the name on the sender. If you've already accepted even a small amount, you must act immediately: cancel the associated bank card, contact your bank to disable recurring payments, and file a police report. It's also advisable to review your account activity to detect any unauthorized charges.
This scam has gone viral on social media and is already active in Spain. The National Police and the Internet Security Office (OSI) have issued alerts warning about this practice. Don't trust ridiculously small amounts: a single cent could cost you hundreds of euros. The best defense is to be suspicious and carefully review every notification you receive on your phone.