Starting 15 September 2026, any business sending SMS, MMS or RCS messages to Spanish numbers with a brand name as the sender must have that alias officially registered. Otherwise, mobile operators will block the messages. The CNMC confirmed the measure, which aims to reduce brand impersonation scams.
The rule covers more than banks and insurers. Retailers, delivery companies, transport services and public agencies are included if they use a brand name instead of a phone number in the sender field. It applies to any message sent to a Spanish number, regardless of where the company is based.
The basic change is the requirement to register every alias, the alphanumeric name that appears as the sender. Fraudsters have used this feature to send fake notifications or codes that appear to come from trusted brands. By requiring registration and linking each alias to an authorised business and provider, authorities hope to make impersonation much harder.
The CNMC says more than 75,000 registration requests were submitted in the first two months after the system opened. Businesses that miss the deadline will have their branded messages blocked at the network level. Even registered companies will have their messages stopped if they use unauthorised providers.
European Union Agency for Cybersecurity (ENISA)
For consumers, nothing changes in terms of registration or payment. No action is needed. If a message asks you to register or click a link to comply with the new rules, treat it as suspicious. The only visible difference may be that some messages show a phone number or technical ID instead of a brand name if the sender is not properly registered.
The system will make brand impersonation via SMS aliases much harder, but it is not a complete solution. Criminals can still use regular numbers, malicious links or other channels to target people. The CNMC advises people never to share passwords, codes or banking details in response to unexpected messages, and to use official apps or websites for sensitive transactions.
The legal basis for the change is set out in Order TDF/558/2026 and Circular 2/2026, which explain the registration process and allow companies to regain their alias if they register after the deadline. If a familiar notification stops arriving, the business and its providers must fix the issue and restore authorised messaging.
With the deadline approaching, Spanish businesses need to register their aliases or risk losing a basic way to reach customers. For consumers, the change adds a layer of protection, but staying alert remains impressive.
