New rules designed to make it harder for criminals to impersonate banks, companies and public authorities through text messages are now in force across Spain.

Since September 15, 2026, operators involved in the transmission of SMS, MMS and RCS messages must block communications that use an unregistered alphanumeric sender alias, or an alias that is not being transmitted through a messaging provider authorised for that sender identity.

The national measure also applies to Ibiza and Formentera because it covers messages sent to Spanish telephone numbers.

What Is a Sender Alias?

A sender alias is the name or brand that appears instead of a conventional telephone number when an organisation sends a message.

For example, a message from a bank, delivery company, retailer or public administration may appear with the organisation's name at the top of the conversation rather than a mobile number.

Under the new system, these alphanumeric identifiers must be registered in the CNMC's official Registro de Alias before they can be used.

The registry is designed to establish a verified connection between the name appearing in the message and the company or organisation entitled to use it.

The New Blocking Rules Began on September 15

The legal requirement to block non-compliant messages took effect on September 15, 2026.

The rules apply to SMS, MMS and RCS communications sent to Spanish telephone numbers when an alphanumeric alias is being used as the sender identification.

Messages can be blocked when the alias is not registered, when the message comes from a provider that is not registered or authorised for that alias, or when the required authorisation linking the provider and alias is missing.

The rules were established under the Spanish Government's wider measures against identity-impersonation fraud through calls and text messages.

Why Is Spain Introducing This System?

The principal objective is to make it more difficult for fraudsters to make a message appear to come from a legitimate company or public body.

This type of fraud is often associated with smishing, in which criminals send messages designed to persuade recipients to click a link, provide personal information or reveal banking credentials.

Using the name of a real bank, delivery company or other trusted organisation can make a fraudulent message appear more convincing.

The new registration system is intended to make the sender identity more traceable and reduce the ability to use unverified brand names.

What Will Ibiza Residents Notice?

For most people receiving messages, there is no new registration process they need to complete.

The main difference should be that legitimate organisations using a registered sender alias can continue to display their verified name, while messages using aliases that fail the new requirements are subject to blocking.

The rules are linked to the recipient's telephone number, not their physical location. In other words, an Ibiza resident with a Spanish mobile number is covered, but the regulations are not an Ibiza-only measure.

The framework also applies to messages sent to Spanish numbers when the recipient is travelling or otherwise using a Spanish number under the applicable rules.

Businesses Must Register Their Sender Names

Companies and public administrations that want to use an alphanumeric sender identity must ensure that the alias is registered and properly linked to the messaging provider authorised to send messages using it.

The CNMC says the organisation itself can register the alias, or an authorised provider or representative can act on its behalf under the registration rules.

The system also applies to foreign companies that need to send SMS, MMS or RCS messages using an alias to customers with Spanish telephone numbers.

An Unregistered Business Can Still Contact Customers

An important point for businesses is that failure to register an alias does not mean the company is prohibited from communicating with customers altogether.

The CNMC specifically states that a company that has not registered its sender alias can continue sending communications, but it cannot continue identifying itself with that unregistered company or brand name as the sender alias.

This distinction matters because the rule is aimed at controlling the sender identity displayed in these messages rather than banning the underlying communication.

The Rules Cover More Than SMS

Despite being commonly described as new SMS rules, the framework is broader.

It covers three types of mobile messaging when an alphanumeric alias is used: SMS, MMS and RCS.

RCS, or Rich Communication Services, is a newer messaging standard that can support features such as richer media and interactive business messaging.

The CNMC has specifically incorporated RCS into the alias-registration framework alongside traditional SMS and MMS.

There Was a Last-Minute Transition Measure

The introduction of the system involved a late change because a large number of alias applications were still being processed shortly before the September 15 deadline.

A CNMC circular published on September 12 established a temporary pre-registration mechanism for certain aliases whose applications had been submitted before 3pm on September 14 and were still awaiting administrative validation.

Those aliases can temporarily continue to be used where the conditions set out by the CNMC are met.

The measure is strictly transitional and is not a general exemption from registration. The provisional status ends when the relevant approval process is completed or when the applicable maximum period expires.

Can Consumers Check a Sender Alias?

The CNMC has established a public Registro de Alias and says it will provide a way for users to check which sender aliases are registered and identify their holders.

The purpose is to increase transparency and give recipients another way of assessing the identity displayed in a business message.

The registry should not, however, be treated as the only protection consumers need.

A message using a legitimate sender name can still contain misleading content, so users should continue to exercise caution with unexpected links, payment requests and requests for sensitive information.

The New Rules Do Not Make Every Text Automatically Safe

The measures are intended to make impersonation more difficult, not to guarantee that every message reaching a phone is genuine.

Fraud can use other techniques, including compromised accounts, malicious links and social engineering.

Consumers should therefore continue to check unexpected messages carefully and avoid providing passwords, banking credentials or other sensitive information through links received by text.

The sender name appearing on a phone should not be treated as the only test of whether a message is trustworthy.

What Businesses in Ibiza Should Know

Businesses in Ibiza that use their brand, company name or another alphanumeric identifier when sending messages to customers with Spanish mobile numbers should check that their aliases have been correctly registered.

They should also confirm that their messaging provider is properly registered and authorised to transmit messages using the relevant alias.

This can affect businesses in many sectors, including hospitality, retail, transport, healthcare, financial services and professional services, as well as public administrations.

Companies that rely heavily on branded automated messages may notice the impact most clearly if an alias has not been correctly registered.

Why This Matters During the Busy Ibiza Season

The timing is relevant for Ibiza because September remains a busy month for tourism, hospitality and other services that communicate with customers by mobile message.

Booking confirmations, delivery notifications, appointment reminders, transport information and commercial messages are all examples of communications that may use branded sender names.

The new rules therefore affect how organisations can identify themselves through mobile messaging, although the legislation itself is national rather than specific to Ibiza.

A National Anti-Fraud Measure With a Local Impact

Spain's new Registro de Alias is part of a broader effort to tackle fraudulent communications and identity impersonation.

For residents and visitors in Ibiza, the most visible change may simply be that some messages that previously appeared under a familiar company name no longer arrive in the same format if the sender has not complied with the new requirements.

For businesses, the change is more direct: branded sender aliases must be properly registered and connected to authorised messaging providers if they are to continue being used.

What to Remember

The new rules do not mean that residents must register their phones or take any action simply because they live in Ibiza.

They also do not mean that every unregistered business is prevented from contacting customers.

The key change is that companies and public administrations must comply with the CNMC's registration system if they want to use an alphanumeric alias as the sender identity in SMS, MMS or RCS messages to Spanish numbers.

For consumers, the rules add another layer of protection against impersonation, but basic digital-safety habits remain important.

The safest approach is still to pause before clicking, check unexpected payment or account requests independently and never assume that a familiar sender name alone proves that a message is genuine.