The “Abanca” call that ended the moment I switched to Galician

Last week my phone rang. An ordinary number, a Spanish mobile like any other. On the other end, someone claiming to be calling from Abanca, my bank.

I let them talk, to see how far they'd go. The moment I started answering in Galician, they hung up.

Then I called that number back. A woman answered with no idea what I was talking about. Nobody in her house had called me: someone had used her number to call me, and probably plenty of other people.

This has a name: caller ID spoofing. Whoever calls can make any number they like appear on your screen: your bank's, a supplier's or anyone else's. That woman was as much a victim as I was.

Since June 2025, Spanish operators have had to block calls from abroad that show a Spanish number. It helps, but it doesn't stop everything: mine still got through.

With a voice, it gets worse

I got a stranger in a hurry to hang up. In businesses we see something more elaborate. First an email arrives from a long-standing supplier, with their invoice and a new account number. Then, sometimes, a call in a voice that sounds just like theirs to confirm it.

In 2024 INCIBE, Spain's national cybersecurity institute, reported the case of a company that received a call in their director's voice, identical to the real one, asking for an urgent purchase and transfer. They went ahead. The director had never called. Today a few seconds of audio from a video or a voice note are enough to imitate anyone's voice.

If a call or an email like this reaches you

1. Don't give out codes, passwords or card details over the phone. Your bank won't ask for them.
2. Hang up and call the official number yourself, the one on the card or the website, never the one they give you.
3. If a supplier asks you to pay into a new account, don't pay until you've confirmed it by calling their usual number yourself.
4. If you've already paid, call your bank straight away: sometimes the transfer can be stopped.
5. Keep the email exactly as it arrived and report it to the police (Policía Nacional or Guardia Civil).
6. Call us and we'll check whether the scam came from a hacked account, yours or the supplier's.

At work, two habits that close a lot of gaps

Have any change to a supplier's bank details approved by a second person, not the one who received the request. And ask for the account ownership certificate issued by their bank before accepting the change.

On the email side, two-factor authentication on every account and a properly configured domain, so nobody can send email pretending to be your company.