Cybersecurity threats and scams in Spain

The National Cybersecurity Institute (Incibe) has reported a significant rise in cybersecurity inquiries and online scams in Spain. During the first half of 2026, the organization’s 017 helpline handled 95,064 consultations, nearly doubling the volume from the same period in 2025. Common issues reported by citizens and businesses include identity theft and fraud through vishing, smishing, and phishing.

Following this surge, Incibe issued a specific alert regarding a smishing campaign impersonating the General Social Security Treasury (TGSS). These fraudulent SMS messages lure victims with claims of pending updates or economic benefits, such as a fake ‘2026 energy adaptation assistance’ payment. The attacks direct users to malicious websites designed to mimic official government portals to steal personal identification and banking information.

In August 2026, the Guardia Civil expanded on these warnings, alerting the public to scammers posing as official agents. These criminals use phone calls to pressure victims into installing malicious technical support applications, which allow them to gain remote access to devices.

On August 20, 2026, the Guardia Civil issued further alerts regarding telephone spoofing and WhatsApp-based fraud. Scammers are reportedly manipulating caller ID displays to impersonate agents from the Madrid Command, using threats of arrest or frozen bank accounts to create urgency. These criminals often attempt to move conversations to WhatsApp to facilitate the installation of remote-control software. Additionally, authorities identified a hijacking modality where scammers impersonate known contacts to solicit SMS verification codes, allowing them to seize control of WhatsApp accounts and solicit money from the victim's contacts.