Calls, SMS, and Telephone Fraud: How the Order Affects Your Company
Since June 7, 2025, companies in Spain that use phone calls or SMS messages as commercial or customer service channels are subject to a new, stricter regulatory framework.
Order TDF/149/2025, published in the Official State Gazette (BOE) in February, is now fully in force. It sets out a series of obligations aimed at strengthening security in electronic communications, combating telephone fraud, and improving the identification of calls and messages.
In this article, we review the most relevant changes introduced by the regulation and what companies need to know to comply with the new telecommunications framework.
End of “Commercial Mobile Numbers”
One of the most significant changes is the explicit prohibition on using mobile numbers to make unsolicited commercial calls or provide customer service. This measure, contained in Article 9 of the Order, seeks to protect consumers from caller ID (CLI) manipulation and identity spoofing practices.
Implication for companies: if your company has been using mobile numbers for these purposes, you must stop doing so and adapt the numbering you use.
Allowed Numbering for Commercial and Customer Service Calls
When such calls are permitted under current regulations, companies must use authorized numbering, such as 800, 900, or other approved short numbers.
These numbers ensure that:
- Consumers can easily identify the call as commercial or customer service.
- Callbacks are free of charge for the user.
Implication for companies: ensure that outbound calls in these contexts use authorized ranges by updating your numbering systems and call management operations.
Blocking of Calls with False or Manipulated Numbers
Another key element of the regulation is the blocking of calls that display an empty CLI or use numbers that have not been assigned or allocated.
This requirement applies to both domestic and international calls and is set out in Article 4.
Furthermore, Article 5 requires the blocking of international calls that falsely appear to originate from Spanish numbers, except in cases involving users in roaming.
Implication for companies: it is essential for businesses that outsource international call center services or use VoIP platforms to verify that their providers comply with these requirements to avoid call blocking.
Stricter Control Over SMS and Messaging
The regulation also introduces significant restrictions in the field of SMS, MMS, and RCS (Rich Communication Services):
- Operators must block messages that use false, empty, or unassigned numbers (Article 6).
- International messages that appear to come from Spanish numbers or aliases must be blocked (Article 7).
- A mandatory alias registry managed by the National Commission for Markets and Competition (CNMC) is established: only registered aliases sent through authorized providers may be used (Article 8).
Implication for companies: if your company runs SMS campaigns (marketing, notifications, authentication, etc.), you must:
- Register your aliases in the CNMC’s official registry.
- Ensure that your messages are sent through authorized providers.
Penalties
Failure to comply with the obligations set forth in this Order may constitute a serious infringement under the sanctioning regime of Law 11/2022, the General Telecommunications Law, and can result in fines of up to €2 million.
Conclusion: A Change That Requires Process Review
This new framework marks a shift in the regulation of telephone communications in Spain. Companies must act promptly to:
- Review the numbering they use for calls.
- Ensure compliance in their SMS and messaging campaigns.
- Monitor providers and subcontractors for compliance with electronic communications obligations.
This is not merely a technical adjustment it requires coordination among marketing, technology, and legal compliance departments, and affects the procurement and oversight of communication service providers.
At Baker Tilly, we offer specialized advisory services to help companies adapt to this new regulation, avoid legal risks, and strengthen customer trust. If you need further information or a compliance audit of your communication systems, contact our team.
Related content
