Identity fraud in Spain: the free Bank of Spain check that can reveal credit taken out in your name

A tidy bank statement proves less than you think

Most people judge whether their identity is safe by glancing at their own bank account. Nothing odd has left it, so all must be well. That’s the mistake. Look elsewhere for the clues. According to INCIBE, Spain’s national cybersecurity institute, victims often spot indirect signs: unexpected communications, invoices they don’t recognise, notices about services they didn’t request, or warnings of unpaid debts.

The Bank of Spain will show you what’s on file

There is a more direct way to look. The CIRBE (Central de Información de Riesgos) is the risk register kept by the Banco de España, and anyone can see the information it holds about them free of charge. It is also confidential, the Bank points out, because nobody can look up another person’s data. So how do you ask for yours? INCIBE lists three routes. Online, the request goes through the Banco de España’s sede electrónica (electronic office), using a digital certificate, an electronic DNI or Cl@ve. No certificate yet? The report can still be requested in person at a Banco de España office, or by post with the required documentation enclosed.

Since 28 October, new accounts in one sector must match names to payment methods

Spain’s Ministry of Social Rights, Consumer Affairs and Agenda 2030 has applied similar thinking to one regulated corner of the internet. In a press note dated 28 October 2026, it said a measure to strengthen the prevention of identity theft in online gaming was entering into force that Wednesday. The measure is the fourth final provision of Royal Decree 813/2026, which obliges online gaming operators with a state licence to verify their users’ payment methods. What does that mean in practice? The person named as the account holder has to be the same person named on the means used for payments and withdrawals, and the ministry says the aim includes making it harder to use payment methods belonging to third parties. New accounts are covered from that day; existing ones get a six-month transitional period for operators to adapt their payment methods and technical systems.

The same note puts a number on the problem: complaints about identity theft in that sector rose by 12 per cent in Spain last year, the ministry says. On the online casino side of that market, the games at casino777 ES are offered under the regulation of the DGOJ, Spain’s gaming regulator, according to an iGamingBusiness report from March 2026. A letter about an online account of this kind, one you never opened, is one more of the warning signs INCIBE describes. Even with a licensed operator, money staked on gambling can be lost, so adults of 18 or over should gamble responsibly and set limits before they start.

What to do if the report shows credit you never took out

When the report arrives, read it line by line against what you know you owe. Remember who the register was built for, though. Each month, the Banco de España explains, the CIRBE gives reporting institutions aggregated information on people whose accumulated risk exceeds 1,000 euros, so it’s a lenders’ tool first and a consumer check second. Homeowners who have been reviewing their loan terms since Spain’s mortgage payments went up will have their own figures to hand.

If a line on it isn’t yours, don’t sit on it. INCIBE’s helpline is 017, or you can write on WhatsApp (900 116 117) or Telegram (@INCIBE017); its guide to the CIRBE service also sets out the request routes. Keep a copy of the report. It’s a dated record of what was registered against you, worth having in front of you when you raise the matter with your bank.

Yearly checks help, but a clean report is not proof

Asking for the report once a year, and again whenever an unexpected letter or an unfamiliar bill lands on the mat, costs nothing. The caveat is what the register can’t tell you. It is built around the institutions that report to it, so a clean CIRBE isn’t evidence that nothing else has been opened in your name. A notice about a service you never ordered still deserves a phone call, whatever the report says.

18+ only. Please gamble responsibly. Spain: jugarbien.es  900 200 225. UK: GamCare gamcare.org.uk. USA: National Problem Gambling Helpline 1-800-522-4700