Losing mobile coverage for no apparent reason is more than an inconvenience—it can be the first sign that someone has convinced your carrier to issue a duplicate SIM card in your name. This fraud, known as SIM swapping, turns your phone number into a weapon: the duplicate disables your original SIM, and the attacker receives every SMS sent to your line, including the one-time codes your bank uses to authorize payments. For anyone who relies on their phone to confirm transactions, understanding the mechanics and the response protocol is essential.
- Two-stage attack: Criminals first steal online banking credentials, usually through phishing, then impersonate the victim to obtain a duplicate SIM.
- Regulatory gap: Spanish telecom law does not prescribe step-by-step identity checks for SIM duplicates; the obligation has been shaped by data protection fines.
- Fast response matters: If your line goes dead, contact your carrier from another phone immediately, then alert your bank and change passwords.
How the duplicate SIM fraud unfolds
The scheme operates in two phases. First, the attacker obtains the victim’s online banking credentials, typically via phishing. Second, they contact the carrier posing as the account holder to request a duplicate SIM. Once issued, the original SIM is deactivated, and the fraudster begins receiving the SMS codes that banks send to confirm transfers.
Spain’s data protection authority, the Agencia Española de Protección de Datos (AEPD), described this pattern in a legal report, emphasizing that the duplicate alone is not enough—it is the key that completes a prior data theft. The national cybersecurity institute, INCIBE, explains how impersonation works in practice: in a physical store, a forged document must pass inspection; over the phone or online, personal details such as name, national ID number, date of birth, billing address, or the last four digits of a bank account may suffice. Those details leak through phishing, fake shops, viral surveys, data breaches, or social media oversharing.
Case files resolved by the AEPD illustrate both attack vectors. In one case that ended with a €70,000 fine for Digi, a third party called on September 2, 2021, pretending to be the customer. The carrier issued a duplicate request code, and the SIM was handed over at a distribution point the same day. The victim suffered numerous transfers from her account. The carrier argued it had followed its protocol, but the AEPD applied Article 6.1 of the GDPR and rejected the appeal. According to reporting by Bandaancha, the agency had already fined Spain’s four largest carriers a combined €5.8 million in February 2022 for fraudulent duplicates, with €3.94 million falling on Vodafone alone.
The other side is also documented. In a 2024 case against Xfera that the AEPD ultimately archived, the carrier explained that it requires the original identity document for a duplicate. In that instance, the criminal had it because he had stolen it from the victim days earlier. The carrier’s anti-fraud system flagged the first Bizum movements minutes later and blocked SMS reception on the line. The AEPD concluded the carrier had followed its protocol with reasonable diligence and closed the file.
The protection you have depends largely on how each carrier designs its process, and the AEPD punishes the outcome when the process fails—but it does not return your money.
Spanish telecom law offers no closed legal checklist. The Ley 11/2022 General de Telecomunicaciones does not mention SIM duplicates. The most recent anti-fraud rule, Orden TDF/149/2025, published on February 15, 2025, and amended by Orden TDF/558/2026 on June 5, 2026, addresses calls and SMS with spoofed identifiers, not the issuance of duplicates. The real limit comes from the GDPR: the AEPD treats issuing a duplicate to a non-holder as unlawful processing of personal data.
What to do in the first minutes without coverage
If your phone loses service in a place where you normally have coverage and you cannot explain why, call your carrier from another phone as soon as possible. This is INCIBE’s first recommendation, and it makes sense: activating a duplicate SIM deactivates the original, so losing the line is usually the first indication. Then, in this order:
- Alert your bank and ask them to block transactions and review recent movements. INCIBE recommends contacting the institution if you see unrecognized charges.
- Change your passwords for email, social media, and messaging from another device, enable two-step verification, and review the recovery options for each account.
- Preserve evidence: the time you lost coverage, calls to the carrier, bank movements. You will need them to file a report with the National Police or the Civil Guard.
- Seek guidance if you feel lost: INCIBE’s 017 line is free and operates from 8:00 to 23:00, 365 days a year.
If your ID document was stolen or you sent a copy to someone you should not have, add one more check: confirm that no one has applied for credit in your name.
Reducing risk before it happens
The most effective measure is to stop relying on SMS as a second factor wherever possible. If your bank or email provider allows an authentication app, a physical security key, or confirmation through its own app, a duplicate SIM loses almost all its value. The second step is to guard the data that makes impersonation credible. INCIBE’s list is telling: nearly all of it comes from something we handed over ourselves, from a fake SMS to a survey promising a coupon. Third, ask your carrier whether it offers a customer password or PIN for sensitive procedures; if it exists, activate it. If you use an eSIM, it is also worth understanding how the line transfers between phones.
The uncomfortable but useful conclusion is that SIM swapping is above all a shared design failure: banks turned the mobile number into a master key, and carriers continue issuing copies of that key with controls that vary from one company to another. Until that changes, the user’s defense is to remove SMS from the equation and react in minutes, not hours, when the phone goes silent.