Someone is using your identity: stopping misuse of your documents

Terms used

• Denuncia — The denuncia is the formal police report you file when you are the victim of a crime.
• CIRBE — The CIRBE is the Banco de España report listing all loans and credit registered in your name.
• Cl@ve — Cl@ve is the government electronic identification system used to log in to public services online.
• Informe de vida laboral — The informe de vida laboral is the Seguridad Social report listing every employer and period you have worked.
• NIE — The NIE is the identity number Spain gives to foreigners.
• AEPD — The AEPD is Spain's data protection agency, which handles misuse of personal data.
• DEHú — The DEHú is the electronic mailbox where public bodies send you official notices.

Key rules

• Police report: File a denuncia first and attach it to every claim you send.
• Company first: Complain to the bank or company before going to the Banco de España.
• Data misuse: Wrongful listing in a debt file goes to the AEPD.
• Free checks: Your credit file data and your CIRBE report are free.

Start with the police report, then check where your name appears

If you think someone is using your identity, file a denuncia (police report) with the Policía Nacional or Guardia Civil and keep your copy. You will attach it to every claim. You can also file at the juzgado de guardia, the duty court. Regional police such as the Mossos or Ertzaintza take reports too.

How to detect misuse

Check each of these places. Each one shows a different kind of fraud.

• Credit files. Ask ASNEF-Equifax and Experian BADEXCUG for a free copy of your data. Use their online forms, or write to them with a copy of your ID. They must reply within one month.
• Loans and credit. Ask the Banco de España for your CIRBE report. It is free and lists every loan and credit in your name. Request it online with Cl@ve or an electronic certificate, or in person.
• Tax. Log in to the Agencia Tributaria with Cl@ve or a certificate. Look at your tax data and your notifications, including the DEHú, the electronic mailbox where official notices arrive.
• Work. Request your informe de vida laboral from the Seguridad Social. Look for employers or periods you do not recognise.
• Everyday signs. Go through bank statements, unknown letters and debt collection calls. Ask your bank to set up alerts.
• Lost or copied documents. If your NIE or passport was lost or copied, report it to the Policía Nacional and ask for a replacement. There is no public register where you can see who has used your documents.

How to challenge a contract opened in your name

Do it in this order.

1. File the police report.
2. Write to the company, such as the lender or phone provider, through its customer service department or its data protection contact. Say you never signed the contract. Attach the report and a copy of your ID. Ask for the contract, the proof of signature and cancellation of the debt. Also ask it to stop using your data for collection.
3. Ask the credit file to correct or delete the entry. The creditor must also stop reporting the debt. A debt you dispute generally cannot be reported as undisputed.
4. If the company does not fix it, escalate to the right office (below).
5. If needed, bring a civil claim to declare the contract void and claim damages. A lawyer is advisable for court action.

Companies must answer a complaint within 15 business days under bank rules. In some cases they have up to one month.

Which office handles what

• Police or court: the crime itself, meaning impersonation and fraud.
• Banco de España: complaints about a bank or lender that opened a product or made payments in your name. Complain to the entity first. You can go to the Banco de España after its reply, or after two months without one.
• AEPD (Agencia Española de Protección de Datos): misuse of your personal data and wrongful inclusion in debt files. You can file online with Cl@ve or a certificate, in person or by post.
• Consumer offices (OMIC) and regional consumer bodies: phone, energy and other non-bank contracts.
• Seguridad Social and Agencia Tributaria: correcting false records in your work history or tax data.
• INCIBE (017): advice only. It does not investigate.

The checklist, documents list and timeline below carry the step details.

Timeline and deadlines

• File a police report with the Policía Nacional or Guardia Civil and keep a copy: first, before you write to anyone

• Send a written claim to the company denying the contract: right after the police report

• Wait for credit files to answer your request for your data: within 1 month of your request

• Expect the company's reply to your complaint: within 15 business days for bank complaints, up to 1 month in some cases

• Complain to the Banco de España if the bank has not answered: after the bank replies, or 2 months without a reply

Documents you need

• Copy of your police report (denuncia) from the Policía Nacional or Guardia Civil, to attach to every claim.

• Copy of your ID, NIE or passport, to send with your written claim to the company and your requests to credit files.

• Your CIRBE report from the Banco de España, which lists the loans and credit in your name. It is free.

• Your work history report (informe de vida laboral) from the Seguridad Social, to spot employers you do not recognise.

• The company's reply, the contract and the proof of signature you ask it for, to use if you escalate.

Checklist

• Request your CIRBE report from the Banco de España to see every loan in your name.

• Check your tax data and notices with the Agencia Tributaria, Spain's tax agency, using Cl@ve or a certificate.

• Request your work history report from the Seguridad Social and look for employers you do not recognise.

• Send the company a written claim denying the contract, with the police report and ID, and ask for the contract and proof of signature.

What to watch out for

• A fraudulent debt can stay in credit files: A debt opened in your name can stay listed in a credit file and block loans or contracts for you until it is removed. Send the company your police report and ID, then ask the credit file to correct or delete the entry.

• Going to the regulator too early: The Banco de España will not take your complaint until you have complained to the bank first. Complain to the bank in writing, then go to the Banco de España once it replies or after 2 months without an answer.

• Unknown employers or tax records: Unknown employers on your work history or odd entries in your tax data can mean someone is using your identity. Ask the Seguridad Social or the Agencia Tributaria to correct the records, and include your police report.

• Calling the wrong office: The 017 helpline gives advice but does not investigate or take police reports.

• Lost or copied NIE or passport: A lost or copied NIE or passport can be used again, and there is no public register that shows where it was used. Report it to the Policía Nacional and request a replacement.

Frequently asked questions

Can I get a free copy of what credit files hold on me?

Yes, you can ask credit files such as ASNEF-Equifax and Experian BADEXCUG for a free copy of your data, online or by post with a copy of your ID.

Which office do I complain to if a bank opened a loan in my name?

Complain to the bank first, then to the Banco de España once the bank has replied or two months have passed with no answer. The Banco de España handles complaints against banks and lenders over products opened in your name.

Which office handles my data being wrongly listed in a debt file?

The AEPD, Spain's data protection agency, handles wrongful inclusion in credit files and misuse of your personal data.

Who handles a phone or other non-bank contract I never signed?

Your town hall's consumer office (OMIC) or the regional consumer body handles contracts that are not financial. Send your written claim to the company first, with your police report attached.