- "Virtual scam" is not a criminal offense: the conduct is usually framed as scam (art. 172) or computer fraud (art. 173 subsection 16).
- In BCRA regulations there is no general obligation to return what was lost; the only automatic refund when fraud is found covers pull transfers between accounts belonging to the same holder.
- As of December 1, 2026, Communication "A" 8471 requires financial institutions to have fraud reporting channels and a single database of reports.
Someone who searches for "virtual scam" has almost always just lost money or fears they may have lost it. The Central Bank of the Argentine Republic (BCRA) adopted the expression in its communication to the public; the Criminal Code does not use it even once.
For the user it is a virtual scam; for BCRA complaints, a "possibly fraudulent unknown transaction"; for the justice system, a scam or computer fraud; and for the financial institution, as of December 2026, a report that goes into a single database.
"Virtual scam" is the user’s term, not a criminal offense
The Argentine Criminal Code does not define "virtual scam" as an offense. It has the scam under art. 172, for anyone who defrauds "using any other artifice or deception," and the special cases under art. 173, among them subsection 15, card fraud, and 16, which Law 26.388 added in 2008 for anyone who defrauds "through any computer manipulation technique".
Whether art. 172 or 173 applies depends on whether a person was deceived or a system was manipulated, and the justice system decides it case by case. The penalty is the same.
The Specialized Cybercrime Prosecutor’s Unit (UFECI) speaks of "online fraud" and the Buenos Aires Province Ombudsman’s Office, of "cyber scam." The BCRA defines "virtual scams" as practices in which people "are deceived into revealing personal or financial data, authorizing transactions, or transferring funds": it includes the user who operated themselves, while deceived, unlike someone who never made the transaction.
For the institution, a virtual scam looks like a legitimate transaction
For the institution, most virtual scams look like legitimate transactions: the victim provides a password, a code, or a transfer. According to the BCRA’s 2025 user protection report, in complaints about unknown transactions, users are "induced, in increasingly sophisticated ways, to provide their access credentials".
The modalities named by the BCRA and UFECI:
- Fake representatives who guide the victim by phone while they operate, sometimes with remote access.
- Messages and calls that imitate a bank or an agency: phishing and smishing.
- Duplication of the line to enter banking apps, or SIM swapping.
- Fake loans or benefits, and supposed transfers "by mistake" that ask for money to be returned before verifying whether the money was credited.
- Taking over a WhatsApp account to ask the victim’s contacts for money.
Since mid-2021, according to UFECI, direct access to accounts decreased and voluntary transfer after a message from a supposed acquaintance increased. If the attacker already controls access, the case is an account takeover.
To report a virtual scam, the first step is the institution
In Argentina there is an administrative path, which always begins with the institution, and a criminal path, which should be started in parallel. The BCRA lays out the first one as follows:
- Contact the bank or wallet immediately to block access and cards, file a formal complaint, and keep the number they assign you.
- If at least 10 business days pass without a solution, or you are not satisfied with the response, file an online complaint with the BCRA using the option "Complaint for fraud or scam".
- Attach a copy of the complaint, the response if there was one, your ID, and the details of the transactions (dates, amounts, channels, and type).
The BCRA assists users who do not operate for commercial purposes and, if the problem continues, refers it to Consumer Protection.
The criminal report for a virtual scam is filed at a prosecutor’s office, a police station, or before UFECI. Which prosecutor’s office investigates depends on the jurisdiction; the official reporting directory on argentina.gob.ar lists the channels.
Regarding evidence, argentina.gob.ar asks: "Do not delete or destroy information related to the incident." That includes screenshots, phone numbers, emails, and transfer receipts, according to the Buenos Aires Province Ombudsman’s Office.
There is no general rule requiring the bank to return everything
In the BCRA texts we reviewed, there is no obligation to return what was lost in a virtual scam. There is a deadline: according to the consolidated text on Protection of Users of Financial Services, the institution must resolve every complaint within a maximum of 10 business days.
The refund under point 2.3.5 covers wrongly charged fees, not fraud, and the refund after a denial applies only to pull transfers between accounts belonging to the same holder. The BCRA FAQ on virtual scam does not mention refunds.
In October 2024, according to the court’s official summary, the Second Chamber of Appeals in Civil and Commercial Matters of La Plata upheld the ruling ordering a bank to reimburse the funds of a retiree who was a victim of phishing, due to "the bank’s passivity in the face of security failures".
In March 2025, the Federal Chamber of Resistencia upheld by majority the rejection of a claim, in a self-satisfying measure (an urgent avenue with limited evidence): the court had concluded that "it is not shown where the banking institution’s failure would be".
In both, the evidence of how the transactions were carried out carries weight.
As of December 2026, each report is a regulated input
Three BCRA communications from 2026 change what the institution does with each report, even though the current consolidated text on user protection does not contain the word "fraud":
- Communication "A" 8471, of August 27: a documented fraud risk management program, with "reporting channels and response mechanisms in the event of fraud", and a single database of reports, with data such as "the amounts recognized to the customer". It takes effect on December 1, 2026 for financial institutions and in stages until September 2027 for payment account providers.
- Communication "B" 13117: institutions and payment account providers report to the Fraud Prevention Center "all fraud events of their customers" and consult it, also at onboarding.
- Communication "A" 8473, of September 3: a fraud risk score by CUIL or CUIT, prepared by the administrators of immediate transfer schemes with data from the BCRA and that center. Institutions and providers use it in onboarding and when monitoring transfers, for both the sender and the recipient (where the money mule appears); no decision may be based solely on it.
Read together (the reading is ours; none of the three rules states it), a user’s report ends up feeding prevention across all institutions.
What VU does
Several actions that these scams need (changing the contact, adding a new account, requesting a pre-approved loan) are the ones that Communication "A" 7783 has required since November 2023 to be confirmed with multifactor authentication or digital identification, and for non-face-to-face onboarding it requires liveness detection.
VU ONE’s multifactor authentication works with seven factors. The VU capability that provides context about the device is Protect against fraud, with recognition of the device from which the user operates based on browser and mobile signals. The decision about what to do with that signal, and the monitoring of the transaction, are resolved in another layer that VU does not provide.
As of December 2026, each virtual scam report is, for the financial institution, a record it must keep as fraud and report to the Fraud Prevention Center.
schedule a conversation.
