A Spanish retiree named Jose Luis avoided losing more than 2,000 euros to a phone scam after a routine detail about his son's work schedule prompted him to delay a bank transfer.
The fraudulent attempt began on a Thursday when he received a message from an unknown number claiming to be one of his four children. The sender claimed his mobile phone was broken and instructed Jose Luis to communicate through the new number from then on.
The conversation initially seemed plausible because one of his sons was away on vacation. The scammer claimed he needed to pay an urgent bill and requested a bank transfer of more than 2,000 euros to a hotel, as well as a photograph of the payment receipt.
Jose Luis grew suspicious when he checked the time and saw it was nearly 2 p.m. His son is a doctor who would normally be finishing his shift at the hospital at that hour.
Instead of sending the money, Jose Luis replied that they had better discuss the matter that afternoon. He later went to his son's house and confirmed that none of his children had sent the messages, acknowledging that he had come close to falling for the scheme out of good will and naivety.
How the child in distress scam works
Fundacion Telefonica featured the story of Jose Luis in Reconectados, its free digital skills initiative for older adults. The case illustrates the standard mechanism of the child in distress scam, where a fraudster uses an unfamiliar number to announce a broken phone, fabricates an urgent financial crisis, and demands an immediate response.
Spain's National Cybersecurity Institute, known as INCIBE, issued a renewed warning in May 2025 regarding nearly identical fraudulent messages. The agency recommends attempting to reach the child through their usual contact details or speaking with another family member before making any financial decisions.
Cybercriminals often combine plausible details with persuasive writing to exploit family trust. Fraudsters may also use phone calls claiming a child has been involved in an accident or a crime to cause panic, or send messages from hijacked social media and messaging accounts.
Steps to protect accounts and report fraud
If a suspicious message is received without any money being sent, INCIBE advises blocking and deleting the number. Victims should save screenshots beforehand if they intend to report the incident to authorities.
Cybersecurity experts warn users never to share SMS security codes or share their device screens during video calls. Screen sharing can expose the six-digit verification code required to gain access to a WhatsApp account, which serves as a private security key.
For individuals who have already executed a money transfer, INCIBE stresses contacting the bank as quickly as possible to attempt a cancellation and block any compromised payment cards. Victims should gather all evidence and file a report with law enforcement agencies.
Family prevention strategies and helpline
Families can prepare for potential scams, including deceptive links asking users to vote for a child, by agreeing on a secret family word or choosing a verification question that cannot be answered using public social media profiles.
Individuals seeking guidance or needing to report cybercrime can contact INCIBE's free and confidential Line 017 helpline for support.
