A text claims to be from my bank but arrives from an ordinary mobile number. Is that automatically fraud now?

No — and that is the most important sentence here. Article 8.3 covers sender names, not phone numbers, and on 1 September the CNMC expressly allowed firms to keep writing without an alias. So treat the sender as unproven: tap no link, open the app instead or ring the number on the back of your card.

Does the rule cover MMS, RCS and WhatsApp too?

MMS and RCS yes: articles 6, 7 and 8 all speak of "SMS/MMS/RCS". WhatsApp, Telegram, Signal and email fall outside it — they do not travel over the mobile network's number identifier.

My health service appointment reminder never came. Have I lost the appointment?

No. The text is a reminder, not a condition. Check the appointment in the SCS app, in the health portal or on 012. Whether a missing message has anything to do with the new rule cannot be established from outside.

Can firms that left it too late still do something?

Yes, register — the register stays open. But the relief in Circular 3/2026 applies only to applications made before 14 September at 15:00, in the Annex III format and with the Annex V declaración responsable. Anyone later may, per the CNMC, keep writing — just without a brand name as sender.

I tapped a link in a fake text. What now?

INCIBE advises anyone who entered credentials to change their online banking password at once, tell the bank and report it to the police. The free advice line 017 is open daily from 8am to 11pm, according to a government statement of 14 July 2026.

CANARY ISLANDS · CONSUMER

Since Tuesday Spain blocks texts sent under an unregistered sender name — and the Canary health service sends 13,000 a day

Since Tuesday an obligation has applied in Spain that lands in the inbox of every mobile phone: anyone sending a text under a name rather than a number — "CaixaBank", "Correos", "GobCan" — must have registered that name in advance with the market regulator CNMC. If they have not, the network operators must block it. That cuts both ways: the classic fake bank text becomes much harder to send, and messages people depend on may simply stop arriving, without warning.

16 September 2026 · By Julia Roca Bethencourt · 5 min.

A smartphone held in the hand (illustrative)

Photo: Jernej Furman from Slovenia, CC BY 2.0 (illustrative image).

The key points

BOE, Orden TDF/149/2025, de 12 de febrero (BOE-A-2025-2870), final provision three: "Los artículos 7.2 y 8 … producirán efectos a partir del día 15 de septiembre de 2026." In force since 7 March 2025, with no "norma derogada" flag.
BOE, article 8.3: operators must block messages "mediante alias que no hayan sido inscritos en el registro" — and registered aliases that arrive from a provider not authorised for them.
CNMC, 1 September 2026: a company that does not register "no podrá seguir enviando mensajes identificados con su … marca comercial". Firms may keep writing to customers — just without the name.
CNMC, Circular 3/2026, de 8 de septiembre (BOE-A-2026-19053, in force since 13 September): aliases whose registration was requested in the proper form before 14 September at 15:00 peninsular time may keep operating provisionally until the CNMC resolves — within three months.
CNMC public register, queried on 16 September 2026: the Gobierno de Canarias has four names listed, activated on 17 July. For the Servicio Canario de la Salud a single entry was found, "SCSLanzarot", carrying the marker "(En tramitación)".

What an "alias" is — and why you cannot reply to one

Article 3 of the order defines it: a string of characters carried in the field meant for the phone number, "que informa del remitente, pero no es un recurso público susceptible de devolver el mensaje" — it names the sender but is not a number you could write back to. That is exactly what made it attractive to fraudsters: a name can be chosen freely, a number cannot. Article 8.1 therefore requires it to be registered "con carácter previo a su utilización". The order speaks throughout of "SMS/MMS/RCS" — so MMS and RCS, often just called "chat" on Android phones, are covered; WhatsApp, Telegram and email are not.

Article 7.2 took effect at the same time: messages entering Spain through an international interconnection interface while carrying a Spanish alias must be blocked — "salvo que se trate de un caso de itinerancia internacional", roaming excepted. The same has applied to phone numbers since June 2025.

The 8 September reprieve — and what "En tramitación" means

That the date wobbled twice says a good deal about the size of the task. Under the final provision the BOE records: "Se modifica el apartado 3 por el art. único de la Orden TDF/558/2026, de 4 de junio" (BOE-A-2026-12045); as late as March the CNMC was still announcing 7 June. A week before the new deadline came the third correction: Circular 3/2026 keeps applications filed in time provisionally able to send — "estrictamente temporal y limitada", as the circular itself puts it. The register shows the consequence: some holder names carry the marker "(En tramitación)".

The Canary picture: four names for the government, one for the health service

At numeracionyoperadores.cnmc.es the CNMC runs a public search window: anyone can check whether a sender name is registered and who holds it. A query on 16 September returned four entries for the Gobierno de Canarias — GobCan, GobCanarias, GobCanPre and "Gobcan Verifica" — all activated on 17 July and with no marker. Also registered: the Cabildo de Gran Canaria ("CabildoOIAC", En tramitación), the ULPGC, the Autoridad Portuaria de Las Palmas, Cajasiete and DISA.

For the Servicio Canario de la Salud the picture is thinner: a single entry, "SCSLanzarot", held by the Gerencia de Servicios Sanitarios de Lanzarote, carrying "(En tramitación)" and activated on 9 September — six days before the deadline. The query found no central sender name for the appointment reminders. That does not prove there is none: the search matches on the start of a word, and neither the CNMC nor the SCS has published anything on the point. What gives the question weight is the volume: according to Canarias7 on 13 August, drawing on SCS figures, the service sends "más de 13.000 sms al día".

And phone calls? There the rule has applied for longer

The question is bound to come, because the spoofed call is commoner than the spoofed text. The same order covers it — only earlier: the obligations in articles 5.1 and 7.1 had to be met "en el plazo máximo de tres meses desde su entrada en vigor", that is by early June 2025. Article 5.1 requires blocking calls from abroad that present a Spanish number, roaming excepted; article 4 adds calls with no number at all. Article 9 bans mobile ranges for customer service and unsolicited marketing calls; article 10 assigns the 800 and 900 ranges for that purpose, which remain free to the person called. A marketing call from a 6 or 7 mobile number has breached the order ever since.

If a message you were expecting does not arrive. First: do not wait, change channel — health service appointments are in the app and the health portal, and 012 answers by phone. Second: with a bank, an airline or a courier, ask through the app or the number printed on your card, never through a number taken from the message. Third: look the sender name up in the CNMC's public register. Fourth: anyone who writes to their own customers by text should check that register now — the provisional clearance runs out after three months.

The rule raises the bar — it does not remove the risk. Article 8 covers sender names only. Anyone writing from a genuine, properly allocated Spanish mobile number falls outside it — and that is where fraudsters are known to move. The converse also holds: a text from an ordinary number is no proof of fraud; plenty of firms are deliberately writing without an alias, as the CNMC itself suggested they should. So the sender still does not work as proof of authenticity — only the content and your own return channel do. On 27 February 2026 the Servicio Canario de la Salud stated that it "no solicita la renovación ni la actualización de la Tarjeta Sanitaria Individual mediante SMS". This is information, not legal advice.

FAQ

A text claims to be from my bank but arrives from an ordinary mobile number. Is that automatically fraud now?: No — and that is the most important sentence here. Article 8.3 covers sender names, not phone numbers, and on 1 September the CNMC expressly allowed firms to keep writing without an alias. So treat the sender as unproven: tap no link, open the app instead or ring the number on the back of your card.
Does the rule cover MMS, RCS and WhatsApp too?: MMS and RCS yes: articles 6, 7 and 8 all speak of "SMS/MMS/RCS". WhatsApp, Telegram, Signal and email fall outside it — they do not travel over the mobile network's number identifier.
My health service appointment reminder never came. Have I lost the appointment?: No. The text is a reminder, not a condition. Check the appointment in the SCS app, in the health portal or on 012. Whether a missing message has anything to do with the new rule cannot be established from outside.
Can firms that left it too late still do something?: Yes, register — the register stays open. But the relief in Circular 3/2026 applies only to applications made before 14 September at 15:00, in the Annex III format and with the Annex V declaración responsable. Anyone later may, per the CNMC, keep writing — just without a brand name as sender.
I tapped a link in a fake text. What now?: INCIBE advises anyone who entered credentials to change their online banking password at once, tell the bank and report it to the police. The free advice line 017 is open daily from 8am to 11pm, according to a government statement of 14 July 2026.

Read on

CITA News on WhatsAppFollow the channel and keep up with the islands.Follow