AEPD (Spain) - ps-00148-2025
Spain's AEPD fines XFERA MÓVILES €200,000 for GDPR violation over SIM card issuance.
Spain's AEPD has fined telecom provider XFERA MÓVILES €200,000 for violating Article 6(1) of the GDPR. The company issued a duplicate SIM card to an unauthorized third party who presented a forged identity document, failing to adequately verify the individual's identity. The DPA ruled that the contractual relationship did not legitimize processing based on a fraudulent request.
AI summary of the linked source. Not reviewed by an editor. How this works
Run XFERA MÓVILES?
Get an email when a new story names XFERA MÓVILES, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonXFERA MÓVILES failed to implement adequate identity verification controls before issuing a duplicate SIM card, allowing a fraudster with a forged document to take over a customer's mobile identity. This SIM-swap attack is a well-known vector for account takeover, enabling downstream fraud such as bypassing SMS-based multi-factor authentication. The AEPD ruled that a contractual basis for data processing cannot be claimed when the request itself is fraudulent, meaning weak verification processes directly invalidate legal justification under GDPR Article 6(1). Telecoms and any organization handling sensitive customer requests must treat identity verification as a critical security control, not a formality. This case underscores that GDPR liability extends beyond data breaches to improper processing triggered by inadequate procedural safeguards.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.