Until 18 November 2026 the Bank of Spain’s Central Credit Register, the CIRBE, is governed by Circular 1/2013 of 24 May, and from 19 November it is governed by Circular 1/2026 of 21 October (BOE-A-2026-22720), the technical rule that sets which loans lenders must report, with what data, and how wrongly reported data are corrected. If you are being chased for a debt you do not owe because someone took out a loan in your name, the Circular does not alter the essentials, that a contract signed by an impostor does not bind you because you never consented, and that you can require the CIRBE to rectify or cancel that entry under article 65 of Law 44/2002. Until that is resolved, do not pay or acknowledge anything over the phone, obtain your credit report and report the crime, because without a police report neither the lender nor the Bank of Spain has any basis to treat the loan as someone else’s.
The CIRBE is not a defaulters’ file. It records the loans, credit facilities and guarantees that lenders report to the Bank of Spain, whether or not they are being paid, and lenders consult it before granting finance. That is why a fraudulent loan appears there even if the impostor paid the first instalments, and why the damage usually surfaces when you apply for a mortgage or a card and are refused because of a liability you do not recognise.
Your CIRBE report and the paperwork of the claim, what depends on you this week
The first step is to see exactly what is recorded. Anyone can ask the Bank of Spain, free of charge, for the report of the liabilities registered in their name, through its electronic office with a digital certificate, electronic DNI or Cl@ve, or in person at its offices. The report shows the reporting lender, the type of transaction, the amount and the date, which is what you need to know who the claim is addressed to and since when the loan has existed. Also exercise your right of access with Asnef-Equifax and Experian, because the impostor’s default usually ends up there.
Keep everything you have received. The letter or email demanding payment, the envelope with the postmark, the text messages, the name of the company that calls and the dates of the calls. Ask whoever is claiming, in writing, to prove where the debt comes from, and do not give your DNI number, your account number or any password over the phone, because one variant of this fraud consists of using that call to complete the data missing for the next loan, as explained in this article on bank impersonation calls.
Do not pay anything, not even a part «to make them stop». A partial payment is read as an acknowledgement of the debt and weakens your defence. Do not sign a payment plan or any document the debt collection company sends you.
Check whether your DNI was lost or out of your control at any point, and if you reuse a password across several services, change it today. Many of these loans begin with someone getting into an email account.
Non-existent debt, a namesake’s debt, a paid debt, an assigned debt or one taken out by an impostor
Not every debt you do not recognise is defended in the same way. When the debt does not exist, because you never contracted with that company and nobody did so with your data, the origin is usually a data error or a name coincidence, and it is resolved by requiring them to show where it comes from. When the debt belongs to a deceased relative, to a former flatmate who left the utility contract in your name or to someone you guaranteed, the debt exists and what is in dispute is whether you are liable for it, which depends on the contract and, in the case of an inheritance, on whether you accepted it. When the debt was paid, the defence is the receipt. When it is claimed by a collection company that bought the credit, that company only has the rights the creditor had and must prove the assignment.
The case in this article is different. Someone obtained your data, applied for a loan with it, and the lender granted it and reported it to the CIRBE in your name. Here there is no debt to argue about because there is no contract, but there is a crime to report, an entry to rectify at the Bank of Spain and, frequently, an inclusion in credit files to annul. The three go together and the order matters.
Article 65 of Law 44/2002, the right to correct the CIRBE that the new Circular does not create
The CIRBE is regulated in articles 59 to 69 of Law 44/2002 on Measures to Reform the Financial System. Article 60 obliges lenders to report their customers’ credit exposures, and article 65 gives any person the right to access the information affecting them and, if the data are inaccurate or incomplete, to demand their rectification or cancellation. The claim may be addressed to the lender that reported the data or to the Bank of Spain, which passes it on to the lender. While it is being processed, the Bank of Spain provisionally suspends the disclosure of the disputed data to other lenders, so the contested loan stops appearing in the information received by banks that consult your record even before it is deleted.
That is the point that decides the case. Circular 1/2026 regulates how lenders report and how corrections are processed, but the right is in the law. The lender does not rectify because you say you never applied for the loan. It rectifies when it is shown that the contract is not yours, and for that the police report, the CIRBE report and the signs of impersonation, a signature that does not match, an address that was never yours, a disbursement account that is not yours or a phone number you do not recognise, must be put before it in a way it cannot dismiss as one more complaint. If the lender refuses or does not reply, Law 44/2002 itself opens the way to court against it.
How that claim is framed, what is asked of the lender and what of the Bank of Spain, and in what order, is the lawyer’s work. At the firm we act for people who suffer this type of banking fraud, from the claim against the reporting lender to the criminal complaint and the proceedings, as explained on our banking fraud page.
Without your consent there is no contract, article 1261 of the Civil Code against the lender and the collector
Article 1261 of the Civil Code requires the consent of the contracting parties for a contract to exist. A loan signed by someone else pretending to be you lacks your consent and does not bind you, even if the lender acted in good faith and even if the impostor had a copy of your DNI. Nor is the action to assert that lack of consent subject to the four-year period for voidable contracts in article 1301, because the contract never came into being for you. In practice that means nothing is running against you, no debt to acknowledge, no article 1964 limitation period to watch, unless you create the debt yourself by paying or signing.
If the impostor also moved money out of one of your accounts, or the loan was paid into your account and left it without your instruction, the payment services rules apply, which oblige the bank to refund unauthorised transactions. How that claim is made is the lawyer’s work, and that side of the problem is covered in this article on what the bank must refund.
The position with the collection company is the same. Whoever buys a credit acquires what the seller had, and the seller had nothing against you. A collection company cannot seize assets, enter your home or discuss your supposed debt with your employer or neighbours, and insistent calls or messages to third parties can amount to an intrusion into your privacy and unlawful data processing that can be reported to the Spanish Data Protection Agency. Reply in writing and through a channel that leaves a record.
ASNEF and Experian, article 20 of the Data Protection Act and compensation for damage to honour
The fraudulent loan often ends up in the private credit files because the impostor stops paying and the lender reports the default. Article 20 of Organic Law 3/2018 only allows those files to record debts that are certain, due and enforceable and whose existence or amount has not been disputed, requires that the creditor has demanded payment beforehand, and obliges the file to notify the person of the inclusion within thirty days. A debt arising from a contract you did not sign and have denied in writing is neither certain nor undisputed, so its inclusion is unlawful from day one.
Articles 16 and 17 of the General Data Protection Regulation entitle you to have the file rectify inaccurate data and erase data processed without a legal basis, and the Spanish Data Protection Agency fines companies that list people without meeting article 20. That is the route out of the file. The route to compensation is different. The Supreme Court has consistently treated wrongful inclusion in a defaulters’ file as an unlawful intrusion into the right to honour protected by Organic Law 1/1982, whose article 9.3 presumes that the intrusion causes harm, so no specific loss needs to be proven to obtain compensation. Its amount is set by the courts according to how long the entry was published, how many lenders consulted it and what consequences it had, for instance a refused mortgage. I will not give a figure because it depends on those factors and the ones circulating online are of no use for your case.
Fraud, forgery and usurpation of civil status, articles 248, 392 and 401 and when each one becomes time-barred
Taking out a loan with another person’s data is fraud under article 248 of the Criminal Code, because the lender is deceived for gain into handing over the money, and article 249 punishes it with six months to three years in prison if the amount exceeds 400 euros. When the amount defrauded exceeds 50,000 euros, article 250.1.5 raises the penalty to one to six years in prison and a fine of six to twelve months. The party deceived is the lender, but you are an injured party, because the debt, the credit history and the demands fall on your name, and you may join the proceedings.
If a forged DNI was used or your signature was imitated on the contract, there is also documentary forgery. Article 392 punishes a private individual who commits any of the forgeries in article 390 in a public, official or commercial document with six months to three years in prison and a fine of six to twelve months, and its second paragraph punishes knowingly using a forged identity document with six months to one year in prison. Passing yourself off as someone else on a continuing basis is usurpation of civil status under article 401, punished with six months to three years in prison, although the courts reserve this offence for sustained impersonation and not for a one-off use of your data. If the data were obtained by breaking into your email or your accounts, unlawful access under article 197 bis is added.
| Conduct | Criminal Code article | Penalty |
|---|---|---|
| Taking out the loan with your data by deceiving the lender, over 400 euros | 248 and 249 | 6 months to 3 years in prison |
| The same where the amount defrauded exceeds 50,000 euros | 250.1.5 | 1 to 6 years in prison and a fine of 6 to 12 months |
| Forging your DNI or your signature on the contract | 392.1 in relation to 390 | 6 months to 3 years in prison and a fine of 6 to 12 months |
| Knowingly using a forged DNI | 392.2 | 6 months to 1 year in prison and a fine of 3 to 6 months |
| Passing yourself off as someone else on a continuing basis | 401 | 6 months to 3 years in prison |
| Breaking into your email or accounts to obtain the data | 197 bis | 6 months to 2 years in prison |
Under article 131 these offences become time-barred after five years where the maximum penalty does not exceed three years in prison, and after ten in aggravated fraud, whose penalty reaches six. The period runs from the date of the offence, even if you only found out years later, so a loan taken out in your name some time ago may be close to expiring when the first letter arrives.
The complaint can be filed at any National Police station or Guardia Civil post, or at the duty court, even if the loan was arranged online or from another province. Which court investigates is determined by the Criminal Procedure Act according to the place of commission, which in remote fraud is often disputed between courts, and making sure the complaint does not get lost in that allocation is part of the lawyer’s work. If your DNI was lost or stolen, report that too. The lender itself, once it confirms the loan is fraudulent, must report it under article 262 of the same Act, which imposes that duty on anyone who learns of an offence through their profession or trade, and your claim is frequently what prompts it to do so.
Two further risks. If the impostor also opened an account in your name or passed other victims’ money through it, you may be summoned as a suspect for money laundering under article 301, and you do not attend that summons without a lawyer. And if the police do not identify the perpetrator, the court will usually order a provisional dismissal under article 641 of the Criminal Procedure Act. That does not close your case. The proceedings are reopened if new evidence emerges, and the complaint and the dismissal order continue to serve as proof of the impersonation before the lender, the Bank of Spain and the credit files.
When the claim reaches court, the order for payment under article 812 and the twenty days to oppose
If neither the lender nor the collector rectifies, their next step is usually an order-for-payment procedure, the monitorio, regulated in articles 812 and following of the Civil Procedure Act for claiming documented money debts. You will receive a court demand to pay or file a written opposition within twenty working days. If you do neither, the court orders enforcement for the amount claimed and your account or salary can be seized without anyone having examined whether the contract was yours. If you oppose, the matter continues as an oral trial, the juicio verbal, when the amount does not exceed 15,000 euros, the threshold set by Royal Decree-Law 6/2023 and in force since 20 March 2024, and above that figure the creditor has one month to file an ordinary claim or the procedure is closed. The opposition must be signed by a lawyer and a procurador when the amount exceeds 2,000 euros.
That opposition is where the impersonation is pleaded, with the police report, the CIRBE report and the evidence gathered, and where the lender is forced to prove that it was you who contracted and how it verified your identity. How it is built depends on each contract and on whether it was signed in a branch or remotely with an electronic signature. The order for payment is not to be ignored, because it is the only point on the road where silence has immediate financial consequences.
When it is worth going beyond rectification
If all that has happened is that the loan appears in your CIRBE report and the lender, on seeing the police report, removes it within a few weeks, a damages claim is not always worthwhile. If nobody consulted the entry and you were refused nothing, the cost and time do not pay off, and it is enough to keep the paperwork in case the problem returns.
It is worth claiming with a lawyer when the lender does not reply or insists the loan is yours, when the entry has gone to Asnef or Experian and stayed there for months or has cost you a mortgage, a tenancy or a card, when you have received a payment demand from a court, when there is more than one loan or the amount is high, which indicates your data are circulating and the problem will not end with the first letter, or when you have been summoned as a suspect. In those cases the matter has three fronts open at once, the criminal one, the banking one and the data protection one, and what is achieved on one serves as evidence on the others, so it is best that the same person directs all three.
The report and the complaint this week, the claim in the firm’s hands
The step to take now is to obtain your CIRBE report and file the police complaint with whatever you have received, without waiting for the lender to explain itself further or for the collector to stop calling. With the stamped complaint and the report, the firm drafts the claim against the reporting lender and the Bank of Spain, applies for removal from the private credit files, joins the criminal proceedings and, if the order for payment arrives, prepares the opposition. At the firm we conduct the criminal defence and the civil claim in these frauds, as explained on our banking fraud and cybercrime pages, and you can bring us your case on +34 677 841 007 or through the contact form. We reply as soon as possible, and the first consultation is a study of the report, the letter and the complaint to determine what is claimed and from whom.
Frequently asked questions
What happens if I ignore the letters and calls? Can the debt expire on its own, or does silence harm me?
Silence is not an acknowledgement of the debt, but it does not make it time-barred, because each claim by the creditor interrupts the limitation period under article 1973 of the Civil Code, and the entry stays in the CIRBE and the files until you act. Ignoring a court demand does harm you. After identity theft no debt expires, there is only a void contract and a crime to report.
How long do I have to oppose an order for payment, and what happens if I do not?
You have twenty working days from service of the court’s payment demand, under article 815 of the Civil Procedure Act. If you neither pay nor oppose within that period, the court orders enforcement for the amount claimed and your account or salary can be seized without anyone examining whether the contract was yours. The opposition must be signed by a lawyer and a procurador when the debt exceeds 2,000 euros.