Cybercrime linked to SIM swapping is no longer a problem limited to banks. A recent ruling in Spain has also brought telephone operators into focus, with the courts now demanding a much higher level of security from them when their processes facilitate financial fraud.
In an environment where personal finances are managed almost entirely via mobile phone , the decision of the Court of First Instance number 44 of Madrid serves as a clear warning: if a portability or a duplicate SIM card is processed without adequate controls and this allows bank accounts to be emptied, the telephone company may end up paying the bill along with the bank.
What happened in the Madrid case: fake number portability and theft of more than 4.000 euros
The case being examined by the Madrid court begins with a fraudulent number transfer from Movistar to Lowi (a Vodafone brand) that the line owner never requested. A third party managed to have a duplicate SIM card issued to the affected party and activated on a new line in their name, without anyone reliably verifying their identity.
With the line now under the criminals' control, they were able to receive the SMS messages and verification codes necessary to access WiZink's online banking. They changed the login credentials, requested new passwords, and made several transactions using two credit cards linked to the customer.
In total, unauthorized transactions amounting to €4.047,91 were charged through three separate transactions. The customer was traveling abroad when the incident occurred and therefore did not even have access to their original phone line, which had been taken over by the fraudsters.
The affected party detected unauthorized transactions on other accounts and notified both the police and the entities involved ( fund recovery ). WiZink initially refunded the charges, but later reinstated them, claiming it was a third-party scam and disclaiming responsibility.
In response to this situation, the Association of Financial Users (Asufin) took up the consumer's defense and sued both WiZink and Vodafone-Lowi, arguing that the fraud had occurred due to serious security flaws in number portability and payment authentication . The judge ultimately ruled in their favor on all points.
Why the courts are pointing the finger at the operators: “really lax” identity checks
One of the most striking elements of the ruling is the forcefulness with which the court criticizes Lowi's protocols. The judgment considers it proven that the company did not require effective identification when processing number portability or when sending the SIM card replacement , beyond providing a postal address to which the card should be sent—a problem linked to failures in operator verification.
The judge described the requirements as “really lax” compared to other telecom operators and emphasized that, in practice, anyone could receive the new SIM card at the address provided , without having to prove they were the account holder. The court considered this a “huge security flaw” at a time when mobile phones are the key to accessing online banking.
The argument also points out that Vodafone has a history of sanctions for identity theft and fraudulent SIM card duplication . The Spanish Data Protection Agency (AEPD) has already fined the company four million euros for allowing SIM card issuance in the names of third parties, which resulted in various bank frauds.
In this new case, the court understands that there is a direct causal link between the operator's negligence and the success of the fraud . Without the number portability process being handled without guarantees, the judge reasons, it would not have been possible to take control of the line, intercept SMS codes, or access the customer's online banking.
The ruling also notes that, despite knowing for years about the proliferation of SIM swapping , sufficient measures had not been taken to safeguard the portability process and the issuance of duplicate SIMs, which aggravates the assessment of the operator's conduct.
WiZink's responsibility: failures in strong payment authentication
The bank doesn't fare well either. The court considers that WiZink failed to comply with strong customer authentication requirements , highlighting the importance of selfie authentication . Payment services regulations in the European Union require combining several independent security elements (knowledge, possession, and biometrics, for example).
Specifically, the ruling highlights that the bank failed to detect that the "possession" element had been compromised : the terminal validating transactions was no longer in the hands of the legitimate owner, but rather the fraudster who had duplicated the SIM card. Despite this, the system allowed password changes and transactions to be executed without triggering any effective alerts.
The ruling also draws attention to how easily the credentials could be modified using only data such as the affected person's ID card, something which, combined with the usurpation of the mobile line, opened a virtually free path for cybercriminals.
In the court's view, WiZink failed to demonstrate that the transactions were carried out with an adequate level of security, nor did it provide the required technical documentation regarding authentication systems, devices used, or internal access logs. This lack of evidence works against them.
The judge ruled that both the insecure number portability and the lack of robust payment controls were contributing factors to the damage , and therefore, it was not appropriate to apportion blame. Both entities must be held jointly liable for the harm suffered by the customer.
Joint condemnation: banks and telecoms, in the same boat regarding SIM swapping
The ruling by the Court of First Instance No. 44 of Madrid does not simply order the return of the defrauded money. It declares that WiZink and Vodafone-Lowi are jointly and severally liable for the fraud, meaning that either company can be compelled to pay the full amount, plus legal interest and costs, and then internally claim against the other if it deems it appropriate.
The ruling emphasizes that “ without portability there would have been no access to WiZink, and without WiZink's breach of contract, the provisions would not have been made.” In other words, both negligent actions were essential for the fraud to have been carried out.
For Asufin, this element is key because it breaks with the idea that only banks should bear the legal burdens of digital fraud. The association has long argued that, in a fully digitalized financial system, all technology intermediaries involved in the payment chain must share responsibility when their actions open the door to crime.
The ruling also highlights the affected party's conduct: the court understands that the client acted diligently, was not careless with his data , and reported the fraud as soon as he had any indications, which rules out any attempt to impute part of the blame to him.
Although the ruling can be appealed within twenty days, its symbolic significance is clear: it sets a relevant precedent in the fight against SIM swapping in Spain and sends a clear message to banks and telecommunications operators about the obligation to strengthen their systems.
A growing problem: Digi, Orange and O2 fined for similar failures
The WiZink and Vodafone-Lowi case is not an isolated incident. Alongside this ruling, the Spanish Data Protection Agency (AEPD) has been compiling a history of sanctions against several telecom companies for serious deficiencies in their identity verification processes and in the handling of fraudulent number portability requests.
Among the most recent rulings is a €200.000 fine levied against Digi for a SIM swapping case in which a third party obtained a duplicate SIM card without the company properly verifying the applicant's identity. The scheme was very similar: with the line registered in their name, the perpetrator was able to access the victim's online banking and operate the system in their place.
This fine is in addition to another €150.000 penalty imposed on the same operator for a serious breach of the General Data Protection Regulation. In that case, a fraudulent contract was registered, and subsequently, the affected individual was improperly included in debt collection databases for a debt they had never incurred.
Orange has also been under scrutiny. The National Court confirmed that the company violated data protection regulations by issuing duplicate SIM cards without properly verifying the applicant's identity in incidents that occurred between 2019 and 2020. Although the Spanish Data Protection Agency (AEPD) initially imposed a fine of €700.000, the court reduced it to €300.000 in recognition of the company's swift action, which included removing self-service kiosks and tightening its activation protocols.
For its part, O2 registered the first case of eSIM swapping detected by the Spanish Data Protection Agency (AEPD) in 2023. In this incident, the attackers changed the customer's contact email address and requested a virtual duplicate of the line. Since it was an eSIM, activation was done remotely, without the need for a physical card, taking advantage of the weak validation procedures to gain complete control of the number and, consequently, the associated services.
Institutional response: from the Good Practices Forum to the anti-fraud brigade
The string of frauds and sanctions has finally placed SIM swapping firmly on the political and regulatory agenda . Asufin, which has taken many of these cases to court, is part of the Forum for Good Financial Practices created by the Ministry of Economy, Trade and Business in 2022.
From this platform, the association has been pressing for financial fraud to be considered one of the most urgent problems for consumers and for coordinated measures with the new tax authorities . The goal is for banks, telecom companies, and authorities to coordinate concrete measures, both preventative and compensatory for victims.
Following the last session of this forum, held on December 10, the Minister of Economy, Carlos Cuerpo, announced the launch of an anti-fraud unit specializing in digital financial crimes . This unit will have the direct participation of the telecommunications sector, acknowledging that the problem can no longer be addressed solely from a banking perspective.
The Madrid court's ruling fits perfectly into this strategy: it reinforces the idea that data and communications security is a legal obligation , not an accessory to the service. If the protocols fail, the economic cost of the crime can fall directly on the companies.
For users, these steps represent progress in protecting themselves against increasingly sophisticated scams. The expectation is that, faced with the risk of having to pay millions in compensation and fines, new anti-fraud techniques and technological improvements will encourage banks and telecom companies to raise their security standards and react more quickly when suspicious transactions are reported.
All this legal and regulatory activity paints a picture in which SIM swapping ceases to be an "orphan" fraud with no clear culprits and becomes a problem shared by the entire digital ecosystem: from the operator managing the line to the entity authorizing payments, including the public regulators who set the rules of the game; and, although there is still a way to go, the latest rulings indicate that those who do not secure their processes will have increasingly less room to look the other way when a customer's account is emptied after a simple SIM duplication.
