Identity theft in consumer finance often leaves a paper trail that victims can uncover before the damage compounds. In Spain, two free checks reveal whether someone has taken on debt using your identity: the CIRBE risk report from the Bank of Spain and the right of access to delinquency files such as ASNEF and Badexcug. This guide explains how to request each one, what to do if an unfamiliar debt appears, and how to document the problem before it escalates.
- Two free checks: The CIRBE report and access requests to delinquency files are both free and can be completed online.
- Early detection: CIRBE captures loans and guarantees reported by banks and lenders, so it can flag a fraudulent loan before a missed payment reaches a delinquency file.
- Act fast: If you find a debt that isn’t yours, file a police report first, then request suppression with that report attached.
What the CIRBE Report Reveals and How to Request It
The CIRBE is not a delinquency file. The Central de Información de Riesgos collects loans, credits, and guarantees that banks, finance companies, and other entities report for each individual. That makes it a useful early-warning tool: it can expose a fraudulent loan before any missed payment lands in a delinquency register.
The report is free and can be obtained online in minutes. According to the Bank of Spain’s frequently asked questions, obtaining the report by its subject is free of charge. The procedure is available on the Bank of Spain’s electronic headquarters and requires an electronic certificate or advanced Cl@ve identification. If you request it on a business day for the latest available date, the report takes about 15 minutes; otherwise, it arrives the next business day. You are notified by email and can download it for 20 days. Those without digital identification can request it by appointment at any Bank of Spain branch or by post using form FDU-031, with a copy of the DNI, to Calle Alcalá, 48, Madrid. The maximum resolution period is ten business days.
Usage has surged. The CIR’s 2025 annual report puts direct report requests at 1,449,067 in 2025, up from 246,932 in 2016, with more than 95% now made online. In the same document, the Bank of Spain echoes INCIBE’s recommendation to request the report periodically as a precaution, not only when something already looks suspicious.
What to Look For and What You Won’t See
You will see each operation with its entity when the accumulated risk with that entity exceeds 1,000 euros. Below that threshold, only the entity’s name appears, without detail. If a finance company you don’t recognize shows up, even without an amount, that is already a clue.
The other limit is timing. Entities report end-of-month balances before the 10th of the following month, and the CIR publishes them on the 21st. A fraudulent loan signed yesterday will not appear until the following month’s report, so it is worth repeating the check.
Delinquency Files: How to Exercise Your Right of Access
You must ask each file separately, because the AEPD does not hold that information. The Spanish Data Protection Agency states that the right of access is exercised before the file’s controller, which must respond within a maximum of one month. It is the same mechanism used to request all the data any company holds about you.
- ASNEF (Equifax): the query is made through the eDerechos platform, which Equifax describes as free. You must create an account linked to your identity document.
- Badexcug (Experian): requests go through Experian’s Consumer Portal, with prior registration, or by post with identity verification. Experian states it does not provide this data by phone.
One useful legal detail: Article 20 of Organic Law 3/2018 requires the file manager to notify you of inclusion and keeps the data blocked for the following 30 days. The debt must be certain, due, and payable, and it cannot appear more than five years after its due date. If you receive an inclusion notice for a debt you do not recognize, that window is your chance to act.
What to Do If a Debt That Isn’t Yours Appears
First, file a report; then request suppression with the report attached. That is the order set by the AEPD for debts that are not yours, whether due to error or identity theft.
- File a report with the National Police or the Civil Guard for suspected fraud in contracting. Keep the receipt: you will attach it to everything.
- Write to the entity and the file requesting suppression or rectification, with a copy of the report and by a means that leaves proof of sending. Equifax indicates that, in identity theft cases, correction can be requested free through eDerechos or by sending the DNI and proof of the report to Apartado de Correos 10.546, 28080 Madrid.
- If it appears in CIRBE, file a claim through the Bank of Spain’s disagreement procedure. The entity has 15 business days to respond and, meanwhile, the CIR stops transferring that data to third parties. If the entity does not accept the correction, the suspension remains for two more months.
- If there is no response within a month or the answer is unsatisfactory, file a complaint with the AEPD, attaching proof that you first asked the entity. The Agency does not accept complaints from those who have not gone through that prior step.
Note: the AEPD does not decide whether a debt exists or how much it is; only whether your data is processed in accordance with the law. The fraudulent contract is disputed through the police report.
If the fraud includes charges on your card, the path is different and has its own deadlines, covered in the guide on how to claim an unrecognized card charge to your bank.
Lost Your DNI: What to Do the Same Day
The Bank of Spain’s Banking Customer Portal urges reporting the theft as soon as possible at a National Police station or Civil Guard barracks, and notifying the National Police of accidental loss even without filing a report. It recommends keeping a copy of that report or notification: it is what lets you prove that later operations were not yours.
Royal Decree 1553/2005, which regulates the DNI, also requires requesting a duplicate immediately. The replaced document loses its status as a DNI, which does not stop someone from trying to use it with a careless entity.
Afterward, make checking a routine: one CIRBE report that month and another the next. Equifax also offers a free Identity Protection Service with alerts for attempts to use your identity; it does not replace CIRBE, but it adds another signal. And if your data has appeared in a breach, review how to check whether it is in a leak and what to do in the first hour, because a leaked DNI and date of birth are the raw material for this fraud.
The most effective tool against this fraud is free, official, and takes fifteen minutes, and it should be consulted the way you review a bank statement: without waiting for something to go wrong. Financial identity fraud is won or lost by weeks, and with a month’s lag between reporting and publication, those who look late arrive with the debt already in motion.