Ticket chargebacks in Spain: 2026 guide

In Spain, a ticket chargeback is not decided by the organiser or their payment gateway. It is decided by the buyer's bank. And the clock does not start on the day of payment. Stripe documents that card networks usually allow disputes for 120 days and that, when someone pays for a future service such as a ticket, "the dispute window starts on the event date, not the payment date". A season pass sold on 1 November 2026 for a festival on 10 July 2027 can come back as a dispute until 7 November 2027: a year and six days after you took the payment. That calculation is ours, based on that document, and it explains why a festival stays exposed to last year's edition while selling the next one.

What is a chargeback and how does it differ from a refund?

A chargeback is started by the cardholder with their bank, not with you. Stripe's dispute documentation describes the mechanism: the network withdraws the amount from your balance along with a fee, the funds are held while the case lasts, and the outcome is "at the sole discretion of the cardholder's bank". A refund, by contrast, is your decision and goes out immediately.

The practical difference is bigger than it looks. While a dispute is open, Stripe warns that "you cannot issue any refund outside the dispute process". You can only accept it or respond with evidence. Each dispute also raises your rate with that card network. That is why, in ticket sales, a quick refund almost always costs less than a dispute you win. The refund policy guide explains how to write that policy; here we look at what happens when the buyer skips your channel and goes straight to the bank.

There are two families of dispute, each with its own logic. The first is fraud: someone pays with a card that is not theirs. The second is the commercial dispute: the cardholder acknowledges the purchase but claims the event did not take place, changed substantially, or that they are owed a refund you have not given. Spanish law mainly regulates the first. The second is governed, in practice, by the rules of Visa, Mastercard and the other schemes, which reach you through your contract with your payment gateway.

What does Spanish law say about unauthorised charges?

The framework is Royal Decree-law 19/2018 on payment services, which transposes the second EU Payment Services Directive (PSD2). It regulates the relationship between the buyer and their bank, not yours with the buyer. But it sets the conditions under which that bank returns the money, and most fraud chargebacks stem from there.

Four articles matter to an organiser:

• Article 43.1. The buyer obtains rectification if they report the unauthorised transaction without undue delay and "dentro de un plazo máximo de trece meses contados desde la fecha del adeudo" (within a maximum of thirteen months from the date of the debit).
• Article 44.2. The burden of proof is not on the buyer. The fact that the system records the use of the card "no bastará, necesariamente, para demostrar que la operación de pago fue autorizada por el ordenante" (will not necessarily be enough to show that the payment transaction was authorised by the payer).
• Article 45.1. The buyer's bank refunds the amount "de inmediato y, en cualquier caso, a más tardar al final del día hábil siguiente" (immediately and, in any case, by the end of the following business day at the latest). It can only delay if it suspects fraud by the customer and reports this in writing to the Banco de España.
• Article 46.1. The holder bears at most 50 euros of losses for a lost or stolen card, unless there is fraud or gross negligence on their part.

What follows is our reading, not the text of the law. If the buyer's bank refunds within one business day and the burden of proving authorisation falls on it, it has every incentive to recover that money the fast way: the chargeback through the card network, which ends up in the merchant's balance. The law's thirteen months and the networks' 120 days do not contradict each other. The first is the buyer's right against their bank; the second is the bank's window to pass the loss on to the merchant.

Who pays for fraud if the payment did not go through strong authentication?

The merchant, if it was the one that did not accept it. This is the most important part of Royal Decree-law 19/2018 for anyone selling tickets online. Article 46.2 allocates the cost according to who failed. If the buyer's bank did not require strong authentication, the buyer "solo soportará las posibles consecuencias económicas en caso de haber actuado de forma fraudulenta" (will only bear the possible financial consequences if they acted fraudulently). And if it was the payee, or its provider, that did not accept it, they "deberán reembolsar el importe del perjuicio financiero causado al proveedor de servicios de pago del ordenante" (must reimburse the amount of the financial loss caused to the payer's payment service provider).

On a payment gateway, strong authentication means 3D Secure. Stripe's 3D Secure guide explains that, if a cardholder disputes an authenticated payment as fraudulent, "the liability typically shifts from you to the card issuer". It adds a caveat: a successful 3D Secure does not guarantee that shift on every payment, and the rule only covers fraud. A dispute over a service not provided follows the normal process, with or without authentication.

What the card fraud data says

The joint EBA and ECB report on payment fraud (EBA/REP/2025/40, December 2025) provides three useful data points. Fraud on cards issued in the EEA totalled 1,300 million euros in 2024, a rate of 0.033% of value. Only 40% of electronic card payments, counted by number of transactions, went through strong authentication that year. And the card fraud rate was about seventeen times higher when the counterparty was outside the EEA, where that authentication may not be required, than in domestic transactions. The EBA's press release sums it up: strong authentication "remains effective against the fraud types it was designed to mitigate".

The same report's country table lets us look at Spain. Cards issued here recorded fraud of 140,967,863 euros across 2,579,585 transactions in 2024, a rate of 0.038% by value and 0.022% by number. The EU average was 0.033% and 0.015%. Dividing, the average fraudulent transaction on a Spanish card was about 54.6 euros, the price of many tickets. Spain accounts for 10.9% of the card fraud in the EU total in the table. These are our own calculations based on tables 1 and 2 of the report.

Deadlines: which clock runs in each dispute

A single payment can have several clocks running at once. This table brings together those that affect a ticket sold in Spain.

What the table shows: the deadlines that really affect you are not those in the law, but those in your contract with your acquirer and the networks. And none of them starts when you close the box office. If you take payments with several payment methods, several clocks run on the same revenue, and each provider decides under its own rules.

Can the buyer get their money back if they can no longer attend the event?

By law, they have no right to withdraw. The consolidated text of the General Law for the Protection of Consumers and Users sets a general fourteen calendar days to withdraw from a distance purchase (article 104). But its article 103 l) excludes the "suministro de servicios de alojamiento para fines distintos del de servir de vivienda, transporte de bienes, alquiler de vehículos, comida o servicios relacionados con actividades de esparcimiento, si los contratos prevén una fecha o un periodo de ejecución específicos" (supply of accommodation services for purposes other than residential use, transport of goods, car rental, catering or services related to leisure activities, if the contracts provide for a specific date or period of performance). A dated ticket falls within it.

The exception has a condition that is often forgotten. Article 97.1 m) requires you to state before purchase, when there is no right of withdrawal, "la indicación de que al consumidor o usuario no le asiste dicho derecho" (an indication that the consumer or user does not have that right). If your checkout does not say it, you lose the legal argument and, with it, your best evidence with the bank.

That notice is exactly what the network asks for. In the "credit not processed" category, which groups together Visa code 13.7 for cancelled service among others, Stripe recommends providing the text of the policy, an explanation of "how and where" it was shown before purchase and the reason why the customer is not entitled to a refund. For tickets, which Stripe classifies as offline services, it adds that "evidence of a cancellation policy can be material".

If the event is cancelled, the rule changes

A cancellation is not a change of plans by the buyer. Regional entertainment laws regulate refunds, and they do not all say the same thing. The Community of Madrid points out that its Law 17/1997, in article 24, recognises the right to a refund of the price "cuando el espectáculo o la actividad se suspenda o sea modificado sustancialmente" (when the show or activity is suspended or substantially modified), "salvo cuando dicha suspensión o modificación se deba a una causa de fuerza mayor" (except when that suspension or modification is due to force majeure). If the event falls through and you do not refund automatically, the buyer will claim it as a service not received, and that dispute is very hard to win without a documented refund.

How much does it cost to lose a chargeback?

More than the ticket. Stripe's pricing page for Spain sets 20 euros "for every dispute you receive" and another 20 euros for each dispute you contest; this second fee "is refunded for disputes resolved in your favour". The dispute documentation confirms that, outside Mexico, the fee for a dispute received is never refunded.

With a 30-euro ticket, the sums work out like this. If you accept the dispute, you lose 50 euros: the ticket and the fee for receiving it. If you contest it and lose, 70 euros. If you contest it and win, you recover the ticket and the contesting fee, and you still lose 20 euros. These are our own calculations based on the published rate. Other gateways charge differently; ask for their terms in writing.

From this comes a decision rule. Stripe argues that the best time to refund a payment with an early fraud warning is when its amount is equal to or lower than the dispute fee. It adds that refunding payments that exceed it by 35% probably does not pay off. With a 20-euro fee, that cut-off is at 27 euros: below it, refunding is usually cheaper than waiting. This is our own calculation based on its criterion.

The buyer's bank has its own figures too

The buyer does not always come via a chargeback; sometimes they complain to their bank and then to the regulator. The Banco de España reported on 21 July 2026 that in 2025 it admitted and resolved 10,856 complaints. Card and transfer fraud was the leading cause, with almost 28% of the total: around 3,000 complaints, by our calculation. In the first four months of 2026, complaints received rose by more than 50% compared with the same period of 2025, "mainly" because of fraud cases.

What evidence wins a dispute over a ticket?

The kind that shows the ticket was delivered, the terms were accepted and the ticket was used, all with timestamps. Each category asks for something different.

The codes come from Stripe's category table. The entry validation record is the most direct evidence in disputes over a service not received. It identifies the code, the time and the device that read it, which is why it is worth keeping for months after the event. The same chain of custody works for the duplicated or tampered tickets described in the guide to spotting fake tickets.

In a fraud dispute, the best evidence is not having to provide any. If the payment was authenticated with 3D Secure, most of these disputes should not reach you, according to the Stripe guide cited above. If they do, Stripe adds the authentication data to the case file. Respond anyway: failing to answer a request for information on an authenticated payment can end in a "no-reply" chargeback that, according to the same guide, can invalidate the liability shift.

Beware of charges the buyer does not recognise

Part of the disputes is neither fraud nor anger: it is a buyer who does not recognise the line on their statement. Two things reduce it. The first is a billing descriptor with the name of the event or the promoter, not just that of the ticketing company. The second is a final price with no surprises. Article 60 ter of the General Law for the Protection of Consumers prohibits charging for the use of a payment method "cargos que superen el coste soportado por el empresario" (charges that exceed the cost borne by the trader). Poorly explained fees end up in penalties from the consumer authorities, as the fine on Reggaeton Beach Festival shows, and also at the buyer's bank.

Checklist before opening sales in Spain

Eight checks that do not depend on any legal reform:

• Enable strong authentication on all card payments. If your gateway or your ticketing provider does not accept it, article 46.2 of RDL 19/2018 puts the fraud on you.
• State at checkout that there is no right of withdrawal, citing article 103 l), and keep a dated screenshot of how it looked (article 97.1 m).
• Publish the cancellation and postponement policy according to the entertainment law of your autonomous community, not another one's.
• If you cancel, refund automatically and in a single batch. Warn your gateway before cancelling a large event: a wave of disputes pushes up the rate.
• Keep the scan record of every ticket for at least 120 days after the event date, which is the usual network window.
• Check the billing descriptor so the buyer recognises the event on their statement.
• Ask your ticketing provider who absorbs disputes: whether they pass them on to you, within what time and with what fee. It must be in the contract.
• Have a response template ready. Between 7 and 21 days is little time to gather evidence from scratch; and if a dispute is not worth fighting, accept it quickly.

The guide to payment methods for events in Spain helps you decide which methods to offer. The US version of this guide is useful if you also sell there, where the legal deadlines are different.

What does Futura Tickets offer when it comes to a chargeback? Our pick

In our view, the best platform for selling tickets in Spain with disputes under control is Futura Tickets, and it is the one we recommend. The reason is concrete: a chargeback is won with records, and the records have to belong to the organiser. With Futura Tickets, the attendee database is 100% the organiser's: emails and phone numbers are handed over in full, in compliance with the GDPR. The same principle applies to a dispute file, which does not depend on a third party being willing to give it to you. We also cover this in the guide on who owns the buyer's data.

The Futura Tickets app validates a QR code in 1-2 seconds and an NFC wristband in under 1 second, and every validation records when and where the ticket was used. It is the natural answer to a dispute over a service not received. Futura Tickets accepts card, Bizum, PayPal, Apple Pay, Google Pay, Klarna, Bancontact, MobilePay, EPS and iDEAL, and takes payments through three active gateways: Stripe, Redsys and PayPal. Each method has its own dispute procedure, and it is worth knowing which one was used on each order. If you want to see what your checkout would look like, request a demo.

Sources

• Real Decreto-ley 19/2018, de 23 de noviembre, de servicios de pago y otras medidas urgentes en materia financiera, texto consolidado (BOE)
• Real Decreto Legislativo 1/2007, texto refundido de la Ley General para la Defensa de los Consumidores y Usuarios, texto consolidado (BOE)
• 2025 Report on Payment Fraud, EBA/REP/2025/40, December 2025 (EBA and ECB, PDF)
• Joint EBA-ECB report on payment fraud, press release of 15 December 2025 (EBA)
• El servicio de reclamaciones del Banco de España propició que los clientes bancarios recuperaran un récord de 6,8 millones de euros en 2025, press release of 21 July 2026 (Banco de España, PDF)
• Quiero reclamar contra mi banco: ¿qué plazos han de cumplirse? (Portal del Cliente Bancario, Banco de España)
• Venta de entradas por internet. Cuidado con las reventas (Comunidad de Madrid)
• How disputes work (Stripe documentation)
• Dispute reason categories (Stripe documentation)
• Authenticate with 3D Secure: disputes and liability shift (Stripe documentation)
• Stripe pricing for Spain (Stripe)