Seeing your bank’s genuine phone number light up on your smartphone screen is no proof that your bank is actually on the line. Caller ID spoofing lets fraudsters display a number different from the one originating the call, and since March 2025 a Spanish ministerial order has required telecom operators to block a large share of these manipulated calls — though not all of them. Understanding where the loopholes sit is essential for anyone who receives calls purporting to come from a bank, a public administration or a utility company.
- The core problem: The number displayed travels with the call and can be falsified, so a familiar caller ID is a hint, not a guarantee.
- The legal response: Spain’s Order TDF/149/2025, in force since 7 March 2025, obliges operators to block several categories of manipulated calls.
- The remaining gaps: Roaming exceptions and spoofed domestic numbers that are real and active may still slip through.
- The golden rule: Hang up and call your bank back on its official number.
How a fraudster can display your bank’s number
The identifier you see is data carried in the call’s signalling. In technical terms it is the CLI (calling line identifier), which travels in the SIP protocol’s PAI (P-Asserted-Identity) field and can also appear in the From field. If the party originating the call controls those fields and nobody along the chain verifies them, your phone simply shows whatever the scammer has written. The Banco de España, Spain’s central bank, explains in its financial education blog that telephone impersonation consists of making the caller ID show a number different from the phone actually placing the call, and that bank-related attacks typically mimic customer service lines.
Among the real cases the Banco de España documents is the fake employee who warns of a fraudulent transaction on your card and, while still talking to you, makes genuine purchases and asks for the SMS codes you receive under the pretext of cancelling the operation.
What Spain’s rules actually block
The regulation is Order TDF/149/2025 of 12 February, issued by the Ministry for Digital Transformation and the Civil Service. It was published in the official state gazette on 15 February 2025 and took effect on 7 March 2025. For voice calls, it requires operators to block:
- Calls with no number, or with a Spanish number not assigned to any service or whose format does not fit the national numbering plan — the Banco de España cites empty numbering beginning with 3 or 4 as an example.
- Calls using numbers the CNMC has not allocated to any operator, which requires consulting the regulator’s database.
- Calls using numbers assigned to an operator but not yet delivered to any customer.
- Calls arriving at an operator showing a number that belongs to that same operator, unless the caller is roaming.
- Calls entering from abroad showing a Spanish number, again excepting roaming. This obligation had a maximum deadline of three months from the order’s entry into force.
The order also bans the use of mobile numbers for customer service and unsolicited commercial calls, effective three months after it came into force, and opens the 800 and 900 ranges for such services, which remain free if you return the call.
SMS sender aliases follow their own timetable: after an amendment approved by Order TDF/558/2026 of 4 June (in force since 6 June 2026), the mandatory alias registry and the blocking of unregistered aliases take effect from 15 September 2026, with a registry managed by the CNMC under its Circular 1/2026, amended in June by Circular 2/2026.
Does this mean nobody can call you with your bank’s number?
No. The order narrows the margin considerably, but the text leaves at least two gaps worth keeping in mind.
The first is roaming. The rule blocking foreign calls with Spanish numbers allows an exception for customers travelling abroad. When an operator cannot verify whether roaming applies, the order permits it to mark the call as unverified or hide the number, leaving it to the Secretary of State to set a date from which that marking becomes mandatory.
The second is calls originating inside Spain with a real, active number, such as a bank’s customer service line. The blocking provisions target empty, unallocated or undelivered numbers, and calls arriving at the operator that owns the number. A legitimate, active number spoofed from another operator’s network does not fit cleanly into any of those categories. The order contains no cryptographic origin verification mechanism for all domestic calls, so it should not be assumed to exist.
And no regulation solves the essential problem: a fraudster does not need the bank’s number if they can get you to reveal what they want. A convincing voice is enough — as with AI-cloned voice scams, which are countered with a family code word.
What to do if «your bank» calls
The Banco de España’s golden rule: if a call seems suspicious, hang up and call the official number yourself. The supervisor’s other guidelines include:
- Your bank will never ask for full passwords or keys. Legitimate institutions already hold your data and do not need to request it by phone.
- No code cancels an operation. If you have not made a transaction, a temporary key makes no sense — and the bank certainly will not ask for it aloud.
- Verify it yourself in online banking. If you are told there is a fraudulent charge, log into the app on your own and check.
- Never share card or account details on calls you did not initiate.
- Note the number in case they call again, and consider a call-blocking app, which the Banco de España mentions as a helpful measure.
- Report it to the police, the Civil Guard or the courts.
Order TDF/149/2025 is a solid regulation: it targets highly profitable tricks such as foreign calls disguised as Spanish numbers or the use of mobiles for commercial calls. But summarising it as «they can no longer call you with a fake number» is dangerous, because it is not accurate. Caller ID remains a clue, not proof. The only verification within your control is to hang up and dial the number listed on your bank’s website or card. It takes a minute and dismantles the entire deception.