Spain’s new text message rule starts next week. But don’t make this dangerous mistake

Spain is about to introduce a new system designed to make it much harder for scammers to impersonate banks, delivery companies, public authorities and other trusted organisations by text message.

From Tuesday, September 15, telecommunications operators in Spain will have to block phone messages using sender names that have not been registered with Spain’s National Commission on Markets and Competition (CNMC).

For anyone living in Spain, the change could eventually make suspicious messages easier to identify. There is one important catch, though: seeing a familiar company name on your phone will not automatically mean that a message is genuine.

Why Spain is changing the rules for SMS messages

Spanish authorities have been tackling a growing problem with fraudulent texts in which criminals pretend to be well-known companies or government bodies.

A message might appear to come from a bank, Correos, a delivery firm, an insurance company or a public administration. Instead of displaying an ordinary telephone number, the sender line can show a name such as a company or brand. Those names are known as aliases.

Spain’s new Alias Register, managed by the CNMC, records the names and brands that companies and public authorities are authorised to use when sending messages to Spanish telephone numbers.

From September 15, phone operators will be required to block messages using an alias that is not registered, as well as messages using a registered alias that have been sent through a provider not authorised in the register.

What happens if a company has not registered its name?

Customers should not necessarily expect their messages to disappear altogether. Businesses that have failed to register an alias can still communicate with customers, but they will no longer be able to send messages displaying that unregistered company or brand name as the sender. Instead, communications can be sent without the alias, meaning customers may see a telephone number rather than the familiar business name.

That distinction matters because a text arriving from a normal telephone number will not automatically be a scam. Some perfectly legitimate businesses may simply be contacting customers without using a registered sender name.

Does a registered sender name mean a text is safe?

No, and this is probably the most important point for phone users to remember. Spain’s new system is designed to check who is authorised to use a particular sender name. It does not check every word contained in the message or guarantee that every link sent by an authorised organisation is safe.

Consequently, anyone receiving a message claiming that their bank account needs updating, a parcel requires payment, a fine is waiting or personal information must be confirmed should still stop and think before clicking. A message could look extremely convincing while trying to get you to visit a fraudulent website or hand over sensitive information.

Recent EWN coverage has shown just how varied these scams can be, from fake bank messages to fraudulent Social Security texts and bogus delivery notifications.

Scammers have already been exploiting familiar names

Recent cases demonstrate why the new rules are being introduced. Fraudsters have used fake bank sender names to make messages appear inside the same conversation thread as genuine banking alerts. Other campaigns have impersonated Social Security, Hacienda, Correos and delivery companies.

There has been a wave of bank SMS scams in which criminals tried to persuade recipients that their accounts were about to be blocked. Another recent campaign offered victims a supposed €305 Social Security payment before asking for bank card information.

Spain’s authorities want to make one part of that deception much harder: simply putting a trusted company’s name in the sender field will no longer be enough to get the message through the Spanish telecoms system.

What should you do when a suspicious SMS arrives?

The safest approach is still surprisingly simple.

• Don’t click the link in an unexpected message, even if the sender appears to be a company you know.
• Don’t provide passwords, card details, banking information or verification codes through a link contained in an unsolicited text.

Instead, open the company’s official app yourself or type its website address into your browser. If you need to contact the organisation, use a telephone number or contact method obtained independently rather than one supplied in the suspicious message.

A familiar sender name should be treated as one piece of information, and not proof that the message is genuine. That little bit of caution could still save you a lot more than the few seconds it takes to check.