If the claim reaches you as a payment order procedure (proceso monitorio) and you do not file an opposition within the twenty working days the court grants when it demands payment (articles 815 and 816 of the Civil Procedure Act), the judge orders enforcement and the creditor can attach your salary and your accounts for a loan you never signed, without anyone having checked whether the signature was yours. Outside the courtroom, inaction also has a price. Loan debts become time-barred after five years (article 1964.2 of the Civil Code), but paying one instalment “so they stop calling” or accepting a repayment plan interrupts that period and resets it to zero (article 1973 of the Civil Code), and an entry in a debtor register that nobody disputes can remain for up to five years (article 20 of Organic Law 3/2018).
If you are being claimed a debt you do not owe, do not pay it, do not acknowledge it, and ask the claimant in writing for the contract and the documents with which they say they identified you. Whoever asserts that you owe money has to prove it (article 217 of the Civil Procedure Act), and a loan taken out with your details by someone else is not a contract, because consent is missing (article 1261 of the Civil Code). What exists is a crime, and the debt is fought with the police report in one hand and the lender’s contracting file in the other.
Keep, report and do not acknowledge, what is in your hands from today
The first thing is to date the fraud with documents you already have. Keep the claim letter or message with its envelope or header, and do not delete the text messages or emails with verification codes, user registrations or signature notices you received from institutions you never dealt with, because they place on the calendar the moment when someone was operating with your identity. Download the statements of all your accounts for the month in which the loan was supposedly paid out. The fact that the money never entered an account of yours is, on its own, a fact the lender will struggle to rebut.
Check how much is in your name. The report from the Bank of Spain’s Central Credit Register is requested free of charge with a digital certificate or Cl@ve and shows the loans that institutions have declared against you, and the credit reference agencies (ASNEF-Equifax, Experian and similar) are obliged to tell you what data they hold on you and who supplied it (article 15 of the General Data Protection Regulation). Often the loan being claimed is not the only one.
Report the identity theft to the National Police, the Guardia Civil or the duty court (articles 259 et seq. of the Criminal Procedure Act), with a copy of the claim and of whatever you have gathered. Do not wait to find out who did it. The police report is the document that turns your denial into a fact with an official date, and without it the lender and the register treat your version like that of any debtor who does not want to pay.
And what you must not do. Do not give out details or confirm anything to whoever calls you by telephone, even if they claim to be from the bank or from a court, a pattern I describe in bank impersonation scams. Do not pay any amount “on account” or sign debt acknowledgements or payment agreements, because an acknowledgement makes enforceable what was not and interrupts the limitation period (article 1973 of the Civil Code). Any reply to the collection agency goes in writing and denies the debt, it never negotiates it.
Non-existent, someone else’s, paid, time-barred or sold, five problems that arrive in the same letter
The claim letter is identical in every case, but the law responds to each one differently.
If the loan was taken out with your identity without your involvement, there is no contract and the debt is void from the outset. The lender was deceived by a third party and must pursue that person, and it is also liable for the damage it causes you if it failed to check who it was contracting with (article 1902 of the Civil Code).
If the debt belongs to someone else who shares your name or whose ID number was mistyped, the problem is a data error and the remedy is rectification (article 16 of the GDPR). If it was a relative or a partner who used your ID, the legal position is the same as with a stranger, even if you later decide not to direct the complaint against them.
If the debt existed and you paid it, the proof of payment closes the discussion and obliges the creditor to remove you from the register. If the debt existed and more than five years have passed without any claim or payment, it is time-barred (article 1964.2 of the Civil Code). A time-barred debt is not enforceable, so it does not meet the requirements for appearing in a debtor register, but the judge does not apply limitation of his own motion, it has to be raised.
If the claimant is a collection company that bought the portfolio, it has acquired exactly the right the original creditor had (articles 1526 et seq. of the Civil Code), not one more. If the credit was void because of identity theft, it bought nothing, and it also has to prove both the assignment and the original loan.
Without your consent there is no loan, and the lender had to check who was signing
Article 1261 of the Civil Code requires consent, object and cause for a contract to exist. A loan on which someone else put your name lacks the first, which is why it does not need to be annulled, it is enough to show you were not involved. The burden of proving otherwise lies with the lender (article 217 of the Civil Procedure Act), which is the party holding the contracting file and asserting that you signed.
That file is where the case is won or lost. Law 16/2011 on consumer credit agreements obliges the lender to assess the consumer’s creditworthiness before granting credit (article 14) and regulates distance contracting (article 7), and Law 10/2010 on the prevention of money laundering requires it to formally identify its customer with a reliable document (article 3). A loan granted in minutes with a photograph of an ID card, a mobile number that is not yours and a payout account that is not yours either does not pass those controls. When the lender cannot produce a serious identity verification, its position for claiming against you collapses, and yours for claiming damages from it strengthens.
If, besides opening the loan, they accessed your online banking or emptied your account, that is a different front, which I cover in getting the bank to refund after phishing. For the debt obtained through identity theft, the claim against the lender, supported by the police report and by the failures in its own contracting process, is the one we draft at the firm within the cybercrime and bank fraud practice, and if the lender does not put things right, a complaint to the Bank of Spain remains open. How that is framed, with which documents and in what order, is the lawyer’s work.
Usurpation of civil status, fraud and forgery, what the Criminal Code sees in a loan in your name
Someone who takes out a loan with another person’s identity usually commits several offences at once. The Criminal Code punishes usurpation of civil status (article 401) with six months to three years’ imprisonment, although the Supreme Court reserves that offence for the full and persistent assumption of another’s personality, so the one-off use of your name to sign a contract is more often punished through the following routes.
Fraud (articles 248 and 249) punishes with six months to three years’ imprisonment anyone who deceives another to obtain a transfer of assets, with a fine of one to three months if the amount defrauded does not exceed 400 euros, and since 2022 article 249 includes fraud by computer manipulation. If the amount defrauded exceeds 50,000 euros, the penalty rises to one to six years’ imprisonment plus a fine (article 250). The deceived party is the lender, but you are an injured party and may join the proceedings.
Document forgery (articles 390 to 393) comes into play when a tampered ID card is presented or a signature is made in your name. A private individual who forges an official or commercial document faces six months to three years’ imprisonment and a fine of six to twelve months (article 392), and whoever uses it knowing it is forged, the penalty one degree lower (article 393). Obtaining your data, if it was done by seizing it without authorisation, falls under article 197.2, with one to four years’ imprisonment and a fine of twelve to twenty-four months, and if they broke into your email or your accounts to get it, under the unlawful access offence of article 197 bis.
| Offence | Criminal Code article | Penalty |
|---|---|---|
| Usurpation of civil status | 401 | Six months to three years’ imprisonment |
| Basic fraud | 248 and 249 | Six months to three years’ imprisonment (fine of one to three months if not exceeding 400 euros) |
| Aggravated fraud, amount above 50,000 euros | 250 | One to six years’ imprisonment and a fine |
| Forgery of an official or commercial document by a private individual | 392 | Six months to three years’ imprisonment and a fine of six to twelve months |
| Seizure of protected personal data | 197.2 | One to four years’ imprisonment and a fine of twelve to twenty-four months |
| Unlawful access to a computer system | 197 bis | Six months to two years’ imprisonment |
Many of these cases are provisionally closed because the perpetrator operated from abroad or through third-party accounts. That closure does not harm you. The proceedings will have established, with judicial involvement, that you reported the identity theft as soon as you learned of it, and that fact weighs in the civil dispute with the lender and in the claim against the register. If the perpetrator is identified, the civil liability arising from the offence includes the damage caused to you.
Getting out of ASNEF and being compensated for having been there, what article 20 of the LOPDGDD requires
For a creditor to list you in a credit reference file, Organic Law 3/2018 requires that the debt be certain, due and enforceable, that its existence or amount has not been the subject of an administrative, judicial or arbitral claim on your part, that you were informed beforehand of the possible listing in the contract or when payment was demanded, that the principal exceeds 50 euros and that the entry remains no longer than five years (article 20). A debt born of identity theft is not certain, and a debt you have disputed in writing can no longer appear even if the creditor still believes it exists. That rule explains why the police report and the dated written claim come before anything else.
Against the register you have the rights of access, rectification and erasure (articles 15, 16 and 17 of the GDPR), and the data controller has to answer you within one month (article 12.3). If it does not, or keeps the entry, a complaint can be filed with the Spanish Data Protection Agency, which can order the cancellation and sanction the creditor that supplied the data without meeting the requirements.
Having been wrongly listed also carries a price paid by whoever listed you. The Supreme Court has consistently treated inclusion in a debtor register for a non-existent or disputed debt as an unlawful interference with the right to honour (article 7.7 of Organic Law 1/1982), and in that area harm is presumed (article 9.3), so you do not need to prove that you were refused a mortgage to be entitled to compensation. Its amount is graded by the time you were listed, the number of institutions that consulted the entry and the consequences it had, and the action is directed against the creditor that supplied the data and, depending on the case, against the register itself. That claim is civil, runs separately from the criminal case, and the figure worth seeking and against whom depends on what the register’s consultation records reveal.
The payment order, the twenty days and the difference between a collection agency that calls and a court that serves
Collection agencies’ letters imitate judicial styling, with stamps, reference numbers and deadlines in bold, but they have no power whatsoever over your assets. A collection agency cannot attach your property, enter your home or disclose the debt to your employer. A court can, and the difference shows on the paper. A judicial communication comes from the Court of First Instance of your domicile, is delivered by a court officer or by the postal service with acknowledgement of receipt, and identifies a procedure with a number and year.
The payment order procedure (articles 812 et seq. of the Civil Procedure Act) is the usual channel for claiming documented monetary debts, and portfolio buyers use it on a massive scale because it is cheap and fast. The court demands that within twenty working days you either pay or explain in writing why you do not owe the money (article 815). If you do neither, an order for enforcement is issued (article 816) and from then on the attachment of accounts and salary does not wait for you to explain anything. If you oppose (article 818), the matter is converted into ordinary proceedings or into the simplified procedure (juicio verbal), the latter when the amount does not exceed 15,000 euros following Royal Decree-Law 6/2023, and there the creditor has to prove the contract with you. The opposition requires a lawyer and a court agent (procurador) when the amount claimed exceeds 2,000 euros, and in any case it must be founded on grounds, denial alone is not enough.
Some people discover the payment order once their salary has already been attached, because service was carried out at an old address. In that scenario there are still ways to set aside what has been done, but they require reacting as soon as the first debit appears on the account.
The debt of a deceased relative or of your partner
Collection agencies call children, widows and partners to claim the deceased’s debts, and often obtain payments from people who owed nothing. The debts of a deceased person pass only to whoever accepts the inheritance, and whoever accepts it outright is also liable with his own assets (article 1003 of the Civil Code). Until you have accepted, you are not a debtor, and if you accept with benefit of inventory you are liable only up to what you inherit (article 1023). Paying one instalment of the deceased’s loan may be interpreted as tacit acceptance of the inheritance, with everything that entails, so nothing is paid before the full picture is known.
Something similar happens with a partner. The separate property of the spouse who did not sign is not liable for the other’s loan, unless he or she appears as borrower or guarantor. Under the community property regime the marital estate may be liable for certain debts incurred by one spouse, but that does not make the other a personal debtor towards the creditor, still less an unmarried partner.
Frequently asked questions
Which articles and which law support my right to demand proof of the debt before paying?
Article 1261 of the Civil Code, which requires consent for a contract to exist, and article 217 of the Civil Procedure Act, which places the burden of proving the debt on whoever claims it. Added to these is article 15 of the General Data Protection Regulation, which allows you to obtain from the lender and from the register all the data and documents they hold about you.
Within what period does a debt become time-barred and how is it counted?
Loan debts become time-barred after five years (article 1964.2 of the Civil Code), counted from the moment each instalment or the total could be claimed (article 1969). Any judicial or extrajudicial claim by the creditor and any acknowledgement or payment by the debtor interrupts the period and restarts it (article 1973). Debts predating 7 October 2015 became time-barred, at the latest, on 7 October 2020.
The step that falls due today is the police report, and you file it. With that in hand, the written denial to the lender, the claim against the register and, if the entry is already circulating, the action for damage to honour are drafted by us within the cybercrime and bank fraud practice, from which the firm acts in this kind of matter. If what you have received is a demand from a court, the twenty days are already running and the opposition brief is signed by a lawyer, so that call comes before any other step. The telephone is +34 677 841 007 and the form is at contact.