Which operators concentrate the most numbers reported as spam

Does it feel like spam always seems to come from the same ranges? It is no coincidence. The concentration of numbers reported as spam is not spread evenly across all operators or across all prefixes. Here we explain, qualitatively and with NoCall data, which patterns by operator concentrate the most fraud and why.

Before we start, an important clarification: in this article we talk about structural patterns, not "good" and "bad" operators. The operator listed as associated with a number is not the one making the call. What we are going to see is why certain numbering ranges, because of how the market works in Spain, end up accumulating more reports than others.

Why does a number "belong" to an operator?

In Spain, telephone numbering is organised into blocks. The CNMC (National Markets and Competition Commission) assigns numbering ranges to each operator. These ranges are identified by their prefix: the first three digits after the +34 mark, at origin, which block a number belongs to.

That is why, when you look up a number in our directory, we can associate it with an operator based on its prefix. We do this by cross-referencing the CNMC database with the ranges assigned to each operator. You can see that cross-reference on our operators page and understand how we calculate it in methodology.

So far, simple. The problem is that this prefix → operator map no longer reflects the reality of who controls each line. And that is where things get interesting.

The problem of number portability

Number portability lets you keep your number even when you change provider. It is good news for the consumer, but it breaks the "prefix equals operator" logic.

When a number is ported, it still shows the prefix of the original block assigned by the CNMC, but the real line is managed by another company. The result: the prefix tells you where the numbering came from, not who operates it today. This means the operator-prefix association is structural (which block the range was assigned to), not operational (who bills the line right now).

For spam analysis this has a direct consequence: the ranges of the legacy operators —the ones that received large numbering blocks years ago— appear overrepresented, simply because they are enormous and because a lot of ported numbering still carries its original prefix.

Which types of numbering concentrate the most reports?

Rather than singling out specific operators, it is more useful to look by type of numbering. Each type has a distinct fraud dynamic. This table summarises how each one behaves:

If you want to dig deeper into any of these families, we have specific guides. For the most flagged mobile ranges, see most reported mobile prefixes in Spain. For the premium-rate ranges, read what to do about a call from an unknown international number. And for the overall picture, our X-ray of phone spam in Spain.

Why do mobile ranges concentrate the most fraud?

Because they work better for whoever is committing the fraud. A mobile number generates more trust than a premium-rate one: it looks like a person, not a company. People are more likely to pick up a 6 or a 7 than an 806.

On top of that, mobile ranges are the easiest to obtain in volume. This is where virtual lines come in.

What are virtual lines and why do they matter?

A virtual line is a phone number that is not tied to a physical SIM or to a specific person. It is managed by software, through voice over IP (VoIP) platforms or mobile virtual network operators (MVNOs) that resell numbering from the big networks.

Why do they matter for spam? For several mutually reinforcing reasons:

• Volume and rotation. A platform can activate and deactivate hundreds of numbers in a short time. When a number gets burned —that is, accumulates reports and blocks— it is discarded and another one is used. Fraud at scale needs disposable numbering, and virtual lines provide it.
• Almost zero cost. There is no shop, no SIM, no traditional contract. This makes mass campaigns cheaper.
• Distance from the real culprit. The numbering may be assigned to an operator, resold by an MVNO and used by a third party through a VoIP platform. That chain of intermediaries makes it hard to know who is behind each call.

The net effect: certain ranges —those behind wholesale resale and VoIP— accumulate more reported numbers, not because the operator holding the block is the culprit, but because its numbering is the one that ends up in the hands of whoever sets up disposable campaigns.

Does spoofing also distort the breakdown by operator?

Yes, and a lot. Spoofing consists of falsifying the number that appears on your screen. The caller can display a number they do not control: that of a bank, of a public administration or, very commonly, one with your own prefix to seem "from your area" (so-called neighbour spoofing).

This introduces noise into any analysis by operator. A number from operator A's range can appear in reports without that operator, or the real line, having anything to do with it: it was simply the number the fraudster chose to display. That is why, when you see spam statistics by prefix, it is best to read them as a trend signal, not as an accusation against a company.

If you want to understand how this signal is interpreted before answering or returning a call, we recommend how to read the risk signals of a number.

How do we read the data by operator?

At NoCall we group reported numbers by their prefix and cross-reference them with the CNMC ranges. This gives us a count of distinct numbers associated with each operator and each family of prefixes. You can explore that directory in operators and the list of ranges in prefixes.

That said, we are the first to call for caution when interpreting that count. These are the three rules we read it by —and the ones we recommend you read it by too:

1. Block size rules. An operator with more assigned numbering will have more reported numbers in absolute terms, even if its fraud rate is similar to others'. The raw ranking rewards the big players for being big.
2. Portability muddies attribution. The prefix indicates the block of origin, not who operates the line today. Many numbers "belonging to" a legacy operator have long since moved to another company.
3. Spoofing adds false positives. Some of the reports point to numbers that never actually called; they were just the disguise.

That is why on our pages we avoid headlines like "operator X is the most spam". It would not be honest. What is useful is to look at which families of prefixes concentrate which type of threat, because that is where the pattern really is actionable for protecting yourself.

A practical table: what to do depending on the prefix calling you

Beyond the operator, what really helps you is knowing how to react depending on the type of number. This is our recommendation by family:

The golden rule is always the same: if they rush you or ask you for details, hang up and verify through a channel you know. This applies whoever is calling you, from whichever operator.

What changes in 2026 with the CNMC register?

There is a development that directly affects this breakdown. The CNMC is rolling out a mandatory register of alphanumeric sender identifiers for SMS and RCS. Once it comes into force, SMS senders that are not registered will be blocked automatically by the operators.

This is not exactly "by voice number operator", but it goes in the same direction: bringing order to who can use which identifier to contact you. It is a step towards reducing the smishing that impersonates brands. We cover it in more detail in how to verify whether a call or SMS from your bank is real.

For the voice side, the best defence is still the community: the more numbers that get reported, the better the burned ranges are identified, regardless of which operator is listed behind them.

What do you take away from all this?

• The prefix tells you the block of origin of a number, not who operates the line or who makes the call.
• Legacy operators appear more in absolute terms because they have enormous blocks and because portability carries over their prefix.
• Mobile ranges concentrate the most fraud because they generate trust and are easy to obtain in volume.
• Virtual lines (VoIP and resale MVNOs) feed the disposable numbering used by mass campaigns.
• Spoofing distorts the breakdown: some of the reports point to numbers that only served as a disguise.
• For all these reasons, we read the data by operator as a trend signal, not as a ranking of culprits.

The practical conclusion is liberating: you don't need to memorise which operator is "worst". You need to recognise the type of number calling you and apply the same golden rule. To dig deeper into specific blocking methods, you have our guides, including how to block spam calls on iPhone and blocking spam calls on Android by manufacturer.

Have you received a suspicious call or SMS? Look it up and report it in our directory of spam numbers. Every report helps the community identify burned ranges sooner —and, with them, whoever is trying to slip in behind a trusted prefix. Also check the up-to-date trends to see which patterns are most active this week.