Online banking security

Overview

Spanish banks invest heavily in security, but online banking fraud (particularly phishing scams impersonating banks) remains common. Knowing what your bank will and won't ask for helps you spot a scam quickly.

Requirements

• Applies to anyone using online or mobile banking in Spain

Step-by-step process

• Only access your bank's online services through the official app or by typing the bank's website address directly — never through a link in an unsolicited email or text
• Never share your full password, card PIN, or a one-time verification code with anyone, including someone claiming to be from your bank — legitimate banks never ask for these
• Enable all available security features: two-factor authentication, biometric login, and transaction notifications
• If you suspect a phishing attempt, don't click any links — contact your bank directly using the number on your card or their official website
• Report any suspicious activity or unauthorised transaction to your bank immediately

Required documents

• None — this is about ongoing account security practices

Common mistakes

• Clicking a link in an unexpected text or email claiming to be from your bank and entering login details — this is the most common banking scam pattern
• Sharing a one-time SMS verification code with someone over the phone, even if they sound convincingly like your bank — banks never need this from you

Practical tips

• Your bank will never call or message you asking for your full password or a verification code — treat any such request as a scam, regardless of how convincing it seems
• If in doubt about a communication, hang up or ignore it and contact your bank directly through a number or channel you already know is genuine

How Tuchati can help

If you're unsure whether a message or call claiming to be your bank is genuine, Tuchati can help you figure out how to verify it safely.