Protecting your digital ID (Cl@ve), SIM and accounts from takeover

Terms used

• Cl@ve — Cl@ve is Spain's government digital ID system for logging in to tax and public services online.
• Cl@ve Permanente — Cl@ve Permanente is the version of Cl@ve with a lasting password, which can add a one-time code for extra security.
• Certificado digital — The certificado digital is an FNMT-issued electronic file that proves your identity for online procedures with the administration.
• FNMT — The FNMT is the national mint, which issues and revokes Spain's digital certificates.
• INCIBE — INCIBE is Spain's national cybersecurity institute, with a helpline on 017 for reporting fraud.

Key rules

• SIM: Ask your operator for a security PIN or password and for alerts on SIM changes.
• Cl@ve: Never share your Cl@ve details, and enter them only on official government sites.
• Certificate: If your certificate is lost or stolen, ask the FNMT to revoke it at once.
• Second step: Prefer a passkey, security key or authenticator app over SMS codes.
• Public Wi-Fi: Do not bank on open public Wi-Fi; use mobile data.

Start with your phone number

Your phone number is the weak point. If a criminal gets a duplicate of your SIM, they receive your SMS codes and can reset passwords. Do three things now:

• Ask your operator to add a security PIN or password to your account.
• Turn on SMS or app alerts for SIM changes and number transfers.
• Know what a normal request looks like. For a duplicate SIM, operators generally ask for identity checks: original ID with you present in a shop, or security questions or a one-time code online or by phone. Stronger checks are now required for duplicates, but details differ by operator and by prepaid or contract line, so ask your own operator which options it offers.

If your phone suddenly loses signal for no reason, treat it as an emergency. Call your operator from another phone and ask whether a SIM change or number transfer was started.

Protect Cl@ve

Cl@ve is your digital ID for tax and government services. Keep it safe like this:

• Never share your ID number, password or PIN codes with anyone.
• Use Cl@ve Permanente with the extra one-time code, sent by SMS or the Cl@ve app. The app is the safer choice because SMS can be intercepted.
• Type your details only on official sites, such as the official website or the tax agency's own site. Do not follow links in messages.

If you think it is compromised, change the password straight away. You can also re-register or cancel your Cl@ve Permanente at a registration office, through the app or by video-ID. Then check recent activity with the tax agency and Social Security, and report suspected fraud to the police or to INCIBE on 017.

Protect your certificado digital

The certificado digital is a file on your computer that proves who you are online. Protect it:

• Use a strong password on the private key.
• Keep the .pfx backup offline, not in email or cloud storage.
• Do not install it on shared computers. If you had to, remove it from the browser afterwards.

If it is lost, stolen or compromised, ask the FNMT to revoke it. You can do this through its online revocation service, by phone or in person at a registration office. Then apply for a new one.

Move bank and email off SMS codes

SMS is the weakest second step because of SIM swapping. Use the best option each service offers. The choices are compared in the decision below.

• Even with an authenticator app, never read a code out to anyone. Fake sites can ask for it in real time.
• Save backup or recovery codes somewhere safe, offline.
• Secure the recovery email and phone for your email account. If those are weak, the rest falls too.
• Plan for a lost phone. Know how you would get back into each account.
• Spanish banks increasingly require confirmation in their own app, which is tied to your registered phone.

Use Wi-Fi carefully

Open public Wi-Fi can be fake or tampered with. Attackers copy a venue's network name and capture what you type.

• Avoid banking and other sensitive tasks on public networks. Use mobile data instead.
• If you must connect, confirm the network name with the venue, check the site uses HTTPS and use a reputable VPN.
• Use your bank's official app, keep your phone and apps updated, and turn off automatic connection and file sharing.
• Log out afterwards and forget the network.

Choosing between options

Which second step should protect your bank and email accounts?

• Passkey or hardware security key: Your provider offers it and you want the strongest protection, since it resists fake sites.

• Authenticator app: Passkeys are not available. It generates time-based codes and is much safer than SMS, but never share a code.

• Your bank's own app confirmation: You bank online, because it is tied to your registered device.

• SMS codes: Nothing else is offered. It is the weakest option because of SIM swapping and interception.

Choose the strongest option your provider offers, in this order: passkey or security key, authenticator app, bank app confirmation, then SMS.

Documents you need

• Your original ID (DNI, NIE or passport), needed in person at an operator shop to get a duplicate SIM, with you present as the line holder.

• Your .pfx backup file of the certificado digital, issued by the FNMT, kept offline and protected by a strong password so you can restore it if needed.

Checklist

• Enter your Cl@ve details only on official sites such as the official website or the tax agency's own site.

• Protect your certificado digital with a strong password and store the .pfx backup offline.

• Remove your certificate from the browser after using a shared computer.

• Switch your bank and email accounts from SMS codes to a passkey, security key or authenticator app.

• Save your backup or recovery codes somewhere safe, and secure your recovery email and phone.

• Turn off automatic Wi-Fi connection and file sharing on your phone and laptop.

• Use mobile data instead of public Wi-Fi for banking, and forget any public network after use.

What to watch out for

• SIM swap: A criminal who gets a duplicate of your SIM receives your SMS codes and can reach accounts that rely on them. Add a security PIN, turn on alerts and move key accounts to an app-based code. If your phone suddenly loses signal, call your operator at once.

• Sharing Cl@ve details: Giving your DNI or NIE, password or PIN codes to anyone, or typing them on a copycat site, hands over your digital identity.

• Stolen or lost certificate: A certificado digital left on a shared computer or in a stolen backup can be used to act in your name. Ask the FNMT to revoke it online, by phone or at a registration office, then apply for a new one.

• Fake or open Wi-Fi: Fake hotspots with a similar name can capture your passwords and send you to fake sites. Use mobile data for banking, and confirm the network name with the venue if you must connect.

Frequently asked questions

Can someone get a duplicate of my SIM card without me?

Not easily, because operators ask for identity checks before issuing a duplicate SIM. In a shop they want your original ID (DNI, NIE or passport) with you present; online or by phone they use security questions or a one-time code.

What should I do if my certificado digital is stolen or lost?

Ask the FNMT, Spain's certificate issuer, to revoke it straight away, then apply for a new one. You can revoke online, by phone or in person at a registration office.

Is an authenticator app enough to protect my bank and email accounts?

An authenticator app is much safer than SMS codes, but it can still be phished in real time, so never share a code with anyone. A passkey or hardware security key is stronger still. Keep your backup or recovery codes somewhere safe in case you lose your phone.

Is it safe to check my bank on a café's public Wi-Fi?

No, avoid banking on public Wi-Fi, because attackers can set up fake hotspots with a similar name and capture your details. Use your mobile data instead. If you have no choice, use the bank's official app, a reputable VPN, and log out and forget the network afterwards.

References

1. clave.gob.es