Digital identity theft: how to spot it and protect yourself
What digital identity theft is and why it is on the rise in Spain
Cybercriminals often pose as trusted individuals, companies or devices to commit fraud. It is important to pay attention to the information they request, the urgency with which they ask for it and the risk involved in sharing certain personal information.
Identity theft is one of the techniques most commonly used by cybercriminals to commit fraud online. Attackers pose as a trusted person, entity or device to obtain confidential information, install malicious software on a device, such as a computer or mobile phone, or carry out criminal activities under another name.
According to a report by technology consultancy NTT Data, cybersecurity-related crimes in Spain in the first half of 2026 rose by up to 45% compared with the second half of 2025. This increase is due, in part, to a rise in ransomware (data hijacking), phishing, digital extortion and data leak campaigns. Many of these crimes involve digital identity theft. Researchers warn that the growing professionalisation of criminal groups and the use of new technologies, such as artificial intelligence, are increasing the frequency and effectiveness of these attacks.
In Spain, one in five crimes is cybercrime, meaning it takes place online, and scams account for 90% of these cases. Digital fraud has become one of the main threats to companies and users, particularly because of the use of data obtained through identity theft, phishing and other forms of deception. To combat these crimes, companies and public institutions are adopting new technologies and cybersecurity measures.
Online identity theft: phishing, smishing and vishing
Identity theft is often a means of obtaining some kind of benefit, such as information, money, anonymity or the installation of malicious software. Depending on how the victim is contacted, we can speak of phishing, vishing or smishing.
In these cases, the communications pretend to come from legitimate sources such as energy companies, banks or public institutions. It is therefore important to pay attention to the information they request, the level of urgency with which they ask you to act and the risk involved in sharing that information.
How to protect yourself from digital identity theft on social media and the internet
Phishing messages can also arrive via social media, in posts or direct messages. We therefore need to be alert to the senders of fraudulent messages. If you receive a strange message, you can check that the account profile is verified, that the account was not created recently and that the link is safe and leads to official channels. Remember that urgent notifications and additional charges are warning signs, and you can contact us to verify these announcements.
How to spot digital identity theft that uses the name of Iberdrola España
Warning signs depend on the channel used to send the supposed Iberdrola España message. For example, in a case of phishing or smishing, you may spot grammatical errors, unusual expressions in the message, or suspicious links that do not match our domains.
It is also wise to be wary of messages demanding urgent action over supposed debts, supply cuts or any other notification that you cannot verify in your customer area or on our website.
Conversely, if the cybercriminal calls you, pay attention to what they ask for, as in this type of crime it is common for them to request sensitive information such as personal details, passwords and security codes. At Iberdrola España, we never ask for private data or passwords. If we need any personal information, we will first contact you through official channels to let you know what details we will require.
Warning signs of online identity theft using the name of Iberdrola España
What Iberdrola España will never ask for by SMS, phone call or email
- Passwords, banking access codes or one-time verification codes.
- Urgent payments by prepaid card or Bizum under threat of supply cuts without prior notice.
Iberdrola España may send notifications via the app, email and phone, but it does so in good time, identifies itself and uses secure communication and payment methods. Notifications may include outstanding bills, previously agreed scheduled maintenance or customer service, always through official channels.
How to report digital identity theft: steps and official resources
If you have been a victim of identity theft, it is advisable to file a report with the National Police, the Civil Guard or through the AlertCops app.
The National Cybersecurity Institute (INCIBE) also recommends the following actions if you have been a victim of this type of fraud:
- Inform the company concerned: if the fraudsters posed as Iberdrola España, notify the company through its official channels.
- Contact your bank: tell them what has happened so that any suspicious transactions can be blocked, and change your access credentials.
- Change your passwords: if you have shared any access codes, update all your passwords to prevent other types of theft.
- Monitor your accounts: regularly review your bank transactions to detect any suspicious activity.
- Report the fraud: file a report with the competent authorities in Spain.
- Warn those around you: share your experience with family and friends so that they know how to recognise this type of scam.
Official Iberdrola España channels: how to check that a communication is genuine
If you are unsure whether you have actually received a call or message from Iberdrola España, use our official channels to check:
Discover more articles on cybersecurity
Explore key topics in greater depth and stay up to date with the latest information on cybersecurity in Spain. Read our featured content.
Find out how to spot and act with telephone scams
Digital fraud: what it is, the most common types and how to protect yourself in Spain
