First you report the loss or theft of your DNI to the police, and only then do you apply for the replacement. Royal Decree 255/2025, which now governs the document, obliges the holder to obtain a replacement immediately and to file a police or administrative report of the loss or theft, and if you arrive at the office without one the official there will take down the administrative report. The date of that report is, moreover, the certified date from which you can prove you no longer had the document. If you reverse the order and leave the report for the following week, any contract, loan or account that someone opens with your DNI in those days is something you will have to contest without that backing, and the burden of explaining the delay will fall on you. At the firm we practise criminal defence in identity theft and fraud cases, and the first thing anyone checks in those files is when the report was made.
Loss and theft are not reported the same way
Losing a document is not a crime. Nobody has taken anything from you, and so what you formalise at the police station is a declaration of loss, recorded with its date, the document number and your identity. Theft is an event with the appearance of a crime, theft or robbery depending on how it happened, and what you file is a criminal report in the sense of the Spanish Criminal Procedure Act, governed by its articles 259 onwards, which can trigger an investigation if there is anything to investigate.
For the citizen the practical difference is small at the moment of reporting and large afterwards. In both cases the document number is entered in police systems as lost or stolen, and in the case of theft it also goes into the alerts consulted by law enforcement, including outside Spain. That entry is what makes a stolen DNI flag up when someone tries to use it at a border or a checkpoint, and it is the reason a document recovered later cannot simply be used again, as I explain below.
Organic Law 4/2015 on citizen security penalises the negligent failure to report the theft or loss of personal identity documents. It sets no deadline in days, but the longer the gap between the loss and the report, the harder it is to argue there was no negligence and, above all, the more exposed you are to whatever is done with the document in the meantime.
What the loss report is and what it does for you
It is worth keeping clear what the report does and what it does not do. It does not exempt you from anything, because you were never liable for what a third party contracts with your document without your consent. What it does is fix evidence. From its date onwards, any transaction carried out with that DNI carries a factual presumption in your favour, because it is officially on record that the document was not in its holder’s hands. Without a report, that same fact is something you will have to prove by other means, and in a civil court the difference between an official date and your word is considerable.
The Criminal Procedure Act allows a report to be made in writing or verbally, in person or through a representative with a special power of attorney, before a judge, a prosecutor or any police officer. It does not have to be the National Police. The Guardia Civil, local police and regional police forces all take the report and forward it. What is exclusive to the National Police is the issuing of the replacement, because it is the only force with authority over the DNI, which is why most people find it easier to report at the same station where they will later apply for the document.
Where to report and how to book the replacement without having the DNI
The National Police Virtual Reporting Office accepts both the loss and the theft of identity documents. An online report is not complete until you ratify it in person at the station of your choice, and there is a short deadline for doing so, after which it lapses. If you are in a hurry, going straight to the police station remains the fastest route, where the declaration is formalised on the spot and you leave with the receipt.
The appointment for the replacement is booked on the electronic DNI appointment portal, and the form has a specific entry for people who cannot identify themselves with the document number because they have lost it. You bring to the appointment a recent photograph meeting the DNI size and background requirements and the report, and you pay the current fee, twelve euros at the date of this article. If you did not report it beforehand, the issuing official takes down an administrative report at the same appointment. The document is issued and handed over at the same appointment. A third loss within one year is, moreover, an offence in itself, as the table further down shows.
The electronic certificate is not revoked by the report alone
The current DNI carries electronic certificates that allow you to sign and authenticate yourself before public bodies and private entities. Reporting the loss does not automatically revoke those certificates. They are revoked when the replacement is issued, because the new document carries different ones, but days can pass between the loss and the replacement. The National Police runs a free telephone line to revoke them immediately, and it is the first call to make if you had the PIN written down somewhere accessible or if the DNI was kept alongside a note with the code. Without the PIN the certificates cannot be used, but it is not worth the gamble.
What happens if you neither report it nor apply for a replacement
Failing to report and failing to hold the document are punished administratively, while someone else’s use of your DNI is prosecuted criminally. These are two separate planes and it helps to keep them apart.
| Conduct | Rule | Consequence |
|---|---|---|
| Negligently failing to report the loss or theft of the DNI | Art. 37.10 LO 4/2015 (minor offence) | Fine of 100 to 600 euros |
| Third loss of the DNI within one year | Art. 37.11 LO 4/2015 (minor offence) | Fine of 100 to 600 euros |
| Giving false details when identifying yourself to an officer | Art. 36.6 LO 4/2015 (serious offence) | Fine of 601 to 30,000 euros |
| Reporting a theft that never happened | Art. 457 Criminal Code (simulating a crime) | Fine of 6 to 12 months |
| Fully assuming another person’s identity | Art. 401 Criminal Code | 6 months to 3 years’ imprisonment |
| Knowingly using a false DNI | Art. 392.2 Criminal Code | 6 months to 1 year’s imprisonment and a fine of 3 to 6 months |
Being identified without your DNI is not in itself an offence. Organic Law 4/2015 requires you to identify yourself when an officer asks, and that requirement is met with a passport, a driving licence or, if you carry nothing, by accompanying the officer for identification. What is penalised is not having obtained the document when required to, not having reported its loss and, far more severely, lying about who you are.
If you report a theft that never happened
Some people report a loss as a theft because they think the process will be quicker or because they are embarrassed to admit they lost it. It is a mistake with a name in the Criminal Code. Article 457 punishes with a fine of six to twelve months anyone who reports a non-existent offence to the police and thereby triggers proceedings. The replacement process, moreover, is no faster for reporting a theft. And a false theft can leave you in an awkward position if the DNI later turns up in a drawer at home after you have declared it was taken from you in the street.
What offences the person using your DNI commits
Identity theft is not an offence with its own name in the Spanish Criminal Code. There are several offences that apply depending on what the impersonator does with your document, and the classification changes the penalty and how it is prosecuted.
Article 401 punishes the usurpation of civil status with six months to three years’ imprisonment. The courts reserve it for someone who passes themselves off as another person completely and permanently, assuming their personality to exercise their rights and obligations, and not for someone who uses another’s name in an isolated act. Using your DNI to sign a finance agreement one afternoon is not usually usurpation of civil status but something else.
That something else is almost always fraud. Article 248 defines the sufficient deception that leads another to make a disposition to their detriment, and article 249 sets the penalty at six months to three years’ imprisonment when the amount defrauded exceeds 400 euros, with a fine if it does not. Someone who presents your DNI so that a lender approves a loan deceives the lender, which is the party parting with the money. The deceived party is the creditor, even though the demand for payment lands on you.
If the DNI has been tampered with, the photograph swapped for example, document forgery comes in. Article 392, read with article 390, punishes a private individual who forges an official document with six months to three years’ imprisonment and a fine, and its second paragraph punishes anyone who knowingly uses a false identity document with six months to one year’s imprisonment and a fine of three to six months. And if the document has been used to get into your online banking or your email, unlawful access to systems is added, which I cover in this article on bank impersonation scams.
All these offences, whose penalties do not exceed three years’ imprisonment, become time-barred five years after they are committed, except minor fraud below 400 euros, which is time-barred after one year. Jurisdiction lies with the court of the place where the act was committed, which in a contract taken out with your DNI is where it was signed or approved, not necessarily where you live. The report can be filed anywhere and is forwarded to the competent court.
They are demanding a debt I never took on
The usual scenario arrives months later. A letter from a finance company, a call from a debt collector or a court notification for a consumer loan, a phone line or a credit card you never applied for. The legal starting point is that this contract does not exist as far as you are concerned. Without consent there is no contract, and whoever signed was not you.
Law 16/2011 on consumer credit agreements requires the lender to assess the consumer’s creditworthiness before granting credit, and anti-money-laundering rules require entities to identify their customers with reliable documents before establishing the business relationship. An entity that lent money to someone who showed your DNI without further checks breached those obligations, and it is the entity that has to prove you were the one who contracted. You do not have to prove you did not. You have to deny the signature and produce the report with its date, and from there the burden is on the other side.
At the firm, when someone arrives with a demand of this kind, the first thing we do is cross-check the date of the report against the date of the contract and request the full contracting file from the entity, and on that basis we decide whether a written objection is enough or whether it has to go to court. You can see what we do in identity theft and fraud.
If a bank account has been opened with your DNI and other victims’ money has passed through it, you may appear as the holder of a laundering account. That is the position of so-called money mules, and the difference between being investigated and being ruled out as a suspect in the first days is, once again, usually a prior report dated before the transactions.
Credit blacklists for a debt that is not yours
Inclusion in a credit information file is governed by article 20 of Organic Law 3/2018 on data protection. Only debts that are certain, due and enforceable may be included, and the creditor must have demanded payment beforehand. A debt taken on by an impersonator is not certain as regards you, because you do not owe it, and its inclusion is unlawful. You are entitled to demand deletion from the file and from the creditor, and the Spanish Data Protection Agency fines wrongful inclusion. In addition, inclusion without basis damages your financial reputation, which the courts have been compensating as a breach of the right to honour. How that claim is framed, in what order and against whom, depends on the case, and it is part of our work.
The report receipt is not an identity document
The receipt proves that you reported, not who you are. No rule gives it identification value. A bank may accept it together with another photographic document while you obtain the replacement, but it is not obliged to. For domestic flights, Spanish citizens can identify themselves with a passport or a driving licence, and airlines do not accept a police report on its own. For voting, the General Electoral Act admits the DNI, the passport or the driving licence, so the report is no use at a polling station either. Since the replacement is issued on the spot, the sensible course is to book the appointment the same day and not rely on the receipt any longer than strictly necessary.
If the DNI turns up later
If you find it before applying for the replacement, notify the police station of the recovery so the entry is lifted. If you already have the replacement, the old document is cancelled. Its electronic certificates are revoked and its support number is on record as lost or stolen. Carrying it in your wallet and using it by mistake can end with the document being retained at a checkpoint, an awkward explanation at a border or, in the worst case, a suspicion that the cancelled document is in circulation deliberately. The right thing is to hand it in at the issuing office or destroy it.
Loss abroad, minors and dependent persons
The DNI is only issued in Spain. If you lose it abroad, report it to the local police of the country you are in, keeping a copy that will serve you later, and go to the Spanish consulate, which issues a provisional passport or a safe-conduct for your return depending on the situation and destination. You will apply for the DNI replacement once back in Spain.
Children under fourteen are not required to hold a DNI, but if they have one and it is lost, the report and the replacement application are made by the father, mother or guardian, and the child must attend the issuing office accompanied by whoever holds legal representation, with the family record book or the document proving it. For a person with a disability who has a support measure in place, whoever provides that support, whether a court-appointed curator or a de facto guardian, accompanies them and proves their status.
What you can do today without waiting for anyone
Report it today, not tomorrow. Call to revoke the electronic certificates. Book the appointment for the replacement. Keep the report receipt on paper and as a photograph on your phone, because you will need it for years. Tell your bank the document has been lost, so it flags the incident and refuses in-person transactions with that number. Do not sign any acknowledgement of debt or any payment arrangement with whoever is making demands, however small the amount, because an acknowledgement turns a debt that was not yours into one that is. Do not throw away any demand letter, even if the debt is not yours, because each one is evidence that the impersonator acted and where. And if you discover movements on accounts or cards you do not recognise, act as you would in any bank fraud refund claim, where the first days decide how much is recovered.
When you need the firm
Handling it alone carries one concrete risk. People who respond to a debt collector by phone or in writing without advice frequently end up admitting facts, accepting deferrals or providing details later used against them, and a credit blacklist entry in your name can block a mortgage or a rental while you dispute a debt that belongs to someone else. In a case like this, the firm files the criminal complaint against the impersonator where there is a basis for it, opposes the entity’s claim with the evidence you did not know you had, demands removal from the credit files and, where appropriate, claims compensation for the harm. You can call +34 677 841 007 or write to us from the contact page. When you call, have to hand the report receipt, all demand letters or emails received with their dates, the name of the entity or entities making the claim and any bank statement showing transactions you do not recognise.
Frequently asked questions
Can I report the loss of my DNI online or only thefts?
The National Police Virtual Reporting Office accepts both the loss and the theft of the DNI. An online report is not final until you ratify it in person at the police station you have chosen, and there is a short deadline for doing so. If you are in a hurry for the replacement, going straight to the police station remains the fastest option, because the declaration is formalised on the spot.
If a loan has been taken out with my lost DNI, does the report exempt me from paying it?
You do not have to pay a loan you never took out, with or without a report, because without your consent there is no contract. What the report does is give you an official date from which it is proven that the document was not in your possession, and that makes the dispute with the lender much shorter. Without a report, you will have to prove by other means that you were not the one who signed.
I found my DNI after reporting it, can I keep using it?
If you have not yet obtained the replacement, tell the police station you have recovered it so the entry is lifted. If you already have the replacement, the old document is cancelled, its electronic certificates are revoked and its number is on record as lost or stolen. Using it can end with the document being retained at a checkpoint or a border. The right thing is to hand it in at the issuing office or destroy it.
Do I need a lawyer if I am being chased for a debt taken out with my DNI?
It depends on what is at stake. If the demand is for a small amount, the entity drops the debt on receiving your denial with the report and you have not been placed on any credit blacklist, you can deal with it yourself. If the amount is significant, the entity insists, your name appears in a credit file, you receive a court claim or there are several contracts in your name, then yes, because every reply you give without judgement can become an acknowledgement and because removal from the files and compensation are not obtained with a letter.