Digi Spain Telecom faces 120,000 euro fine over SIM swapping

The Spanish Data Protection Agency (AEPD) has upheld a 120,000 euro fine against Digi Spain Telecom for violating GDPR regulations. The sanction stems from an unauthorized SIM card duplicate issuance that allowed a third party to intercept bank verification messages and perform unauthorized transfers.

Digi contested the ruling, arguing that its security systems were bypassed using fraudulent documentation. However, the AEPD rejected these arguments, stating that SIM swapping is a foreseeable risk in the telecommunications sector and that the company acted negligently by failing to verify active system alerts. This latest fine brings Digi’s total accumulated penalties from the regulator to approximately 2 million euros. The payment remains suspended pending a decision by the National Court.