Spanish sms fraud: new system to shield users from scammers

Starting in mid-2026, a significant shift is coming to how you receive text messages in Spain. The National Commission of Markets and Competition (CNMC) is implementing a pioneering system designed to eradicate SMS fraud and bolster the security of user data, a move that promises to reshape the digital landscape for mobile users.

A fortress against smishing

For years, the insidious practice of “smishing”—SMS phishing—has plagued mobile users, with criminals impersonating banks, telecom providers, and insurance companies to pilfer personal data. These deceptive messages, often containing malicious links, have become a source of considerable frustration and financial loss. The CNMC's new initiative aims to dismantle this threat head-on.

The core of this defense lies in a mandatory registry for businesses wishing to send SMS or RCS messages to Spanish numbers. Companies must now register an “alias”—a unique alphanumeric identifier—and demonstrably link it to their brand, corporate name, or domain. Failure to comply will result in severe financial penalties and the complete blocking of their messages.

The system, dubbed “Registro de alias,” managed directly by the CNMC, will track these identifiers, allowing recipients to readily verify the sender's legitimacy at a glance. No more guessing whether that urgent notification from your “bank” is genuine or a cleverly crafted ruse.

But the scope extends beyond Spain's borders. Multinational corporations operating within the country will also be required to register, adding another layer of accountability. The CNMC will be scrutinizing aliases to ensure they genuinely represent the company's identity.

The CNMC’s circular, published on February 12th, outlines these requirements with exacting detail, emphasizing the need for transparent identification of services used for customer support. This represents a robust effort to curtail the ever-growing sophistication of cybercriminals who exploit social engineering tactics to gain access to sensitive financial information. The clock is ticking; providers have until June 6, 2026, to adapt their systems and conduct thorough testing.

The CNMC’s action is a significant escalation in the battle against digital fraud, complementing existing measures aimed at curbing unwanted phone calls. This collaborative approach between operators and the regulatory body establishes a foundation of trust, a vital ingredient in safeguarding consumers in an increasingly perilous digital environment.