How and where to report a scam or fraudulent call in Spain

Getting a fraudulent call is more common than it seems, and knowing how to react makes the difference between a scare and a real loss. In Spain there are several official channels for asking for help and reporting fraud, each with a distinct role. In this guide we go over which body covers each situation, what evidence you need and in what order it makes sense to act.

Before you report: gather the evidence

Your report will be far more effective if you arrive with the information in order. Whether the fraud was just an attempt or actually cost you money, try to collect:

1. The phone number the call or messages came from, exactly as it appeared on your screen.
2. The date and time of each contact, as precise as possible.
3. Screenshots of SMS messages, call logs, emails or related WhatsApp messages.
4. Amounts and transactions: if there were charges, transfers or subscriptions, note the sums, dates and the recipient.
5. Links or websites you were directed to, without entering any data into them again.

Keep everything in a safe place and don't delete anything from your phone until you have formally filed the report. These details are what allow investigators to group cases together and track down those responsible.

1. INCIBE and the 017 Helpline

If you're unsure how to act, suspect a fraud or don't know whether your data has been compromised, the first resource is 017, INCIBE's Cybersecurity Helpline (the National Cybersecurity Institute). It is free, confidential and serves individuals, businesses and minors.

The 017 line doesn't handle criminal complaints, but it advises you on the steps to take, helps you assess the severity and points you to the right body. It's especially useful when you're not sure whether what happened amounts to a crime, or when you want technical advice to limit the damage. You can also contact INCIBE through its online channels (chat and forms available on its official website).

If the call matched voice or identity impersonation techniques, it's worth fully understanding what vishing is so you can recognise the pattern and describe it precisely when you ask for help.

2. Reporting to the National Police or the Guardia Civil

When a crime has taken place —fraud, identity theft, account access or theft of money— the route is to file a report with the State Security Forces: the National Police or the Guardia Civil. Both have jurisdiction; you can go to whichever is closest to you.

You have several options:

• In person, at any National Police station or Guardia Civil post. This is the most complete option, because you can hand over the evidence directly.
• By phone or online to start the process. Bear in mind one important detail: even if you start the report online or by phone, formal reports usually require in-person ratification at police premises within a set deadline. Without that ratification, the report may have no effect.

To find the exact form or procedure, look for the official National Police website or that of the Guardia Civil; they set out the current channels. Bring your national ID (DNI) and all the evidence you've gathered. Always ask for a stamped copy of the report: you'll need it for your bank, your insurer or any future claims.

If you're still weighing up how to react to a suspicious contact before taking this step, review what to do about a suspicious call.

3. Filing a complaint with the AEPD over misuse of data

If the fraud involved a misuse of your personal data —for example, a company that shared it without permission, a third party who obtained it by deception, or processing without a legal basis— you can file a complaint with the Spanish Data Protection Agency (AEPD).

The AEPD won't recover your money or prosecute the crime as such; its remit is data protection. Filing a complaint makes sense when the underlying problem is that someone handled your personal information unlawfully. The complaint is submitted through the AEPD's electronic registry (its official website), where you'll find the forms and the documentation you need.

It's best to file the complaint with the AEPD in addition to the police report, not instead of it: they are complementary procedures that address different aspects of the same incident.

4. Alert your bank if there were charges

If the fraud involved money —a charge, a transfer, card details or banking credentials— contact your bank immediately, even before you finish the rest of the steps. Time is critical:

• Block the affected card or account.
• Request a reversal or cancellation of any unauthorised charges.
• Change your online banking passwords.
• Ask about their anti-fraud protocols and put your claim in writing.

Give the bank a copy of the police report once you have it. If you ended up sharing sensitive data during the call, calmly go over what to do if you gave away your data to close off any doors that might still be open.

Recommended order of action

So you don't get lost among so many bodies, here is a sensible order:

1. Was money involved? Call your bank first and block whatever's affected.
2. Do you need guidance? Dial INCIBE's 017 so they can guide you.
3. Was there a crime? File the report with the National Police or the Guardia Civil and keep the copy.
4. Was your data misused? File the complaint with the AEPD.

Not every case requires all four steps. A suspicious call you hung up on in time may only need reporting; an unauthorised charge calls for nearly all of them.

And one more step: warn the community

Reporting protects your own case, but sharing the fraudulent number protects everyone else. Every time someone reports a call, it helps another person identify it before they pick up. You can check the spam number directory to see whether that number has already been flagged by other people.

If you've been targeted by a scam or a fraudulent call, report the number on NoCall and leave a comment: your warning could stop the next person who gets that call from falling for it. Do it from our spam number directory and help build a safer community.