The Bank of Spain cannot block bank accounts. Only the entity where you have your account can restrict it, and only with justified cause, so a warning with a deadline of Friday is almost certainly a fraud.
According to Merca2 (merca2.es), the Bank of Spain does not have the capacity to block individuals' accounts, as it is not a commercial entity nor does it hold balances. It is the central bank and the supervisor of the financial system. Any SMS, email, or call attributing that power to it and asking you to click a link or enter credentials is smishing, a type of fraud that the agency itself documents on its Banking Client Portal.
The entity where the account is held is the one that can restrict it, and only under specific circumstances: a court order, the agreement of all account holders, a seizure by the Tax Agency or Social Security, or the obligations of Law 10/2010 against money laundering, whose executive service is SEPBLAC. Outside of these cases, the bank must notify before taking action. If it cancels cards or accounts on its own decision, the communication must arrive at least two months in advance, or immediately after when security or regulations prevent it.
If the bank requests documentation, the requirement usually includes a copy of the valid ID, NIE, or passport, the address, and contact details. In some cases, it also asks to justify the source of funds and economic activity, with payslips, tax returns, VAT, or the census declaration if you are self-employed. The specific deadline appears in the communication from each entity, not in a supervisor's calendar. Good practices require that the request be made with reasonable advance notice, specify what is being requested, be reiterated if there is no response, and warn of the restriction that could apply and its deadlines.
A real block halts transfers, card payments, withdrawals, and direct debits, and can affect salaries, pensions, or mortgage payments. According to the update of the Compendium of Banking Good Practices published in June 2025 alongside Sepblac, measures must be proportionate and gradual, cannot immobilise funds indefinitely or prevent loan payments, and having an expired ID is not sufficient on its own to restrict operations, unless it prevents verifying identity.
If the bank acts incorrectly, the first step is to complain to the customer service of the entity, which has 15 working days to respond for payment services and one month for others. After that, you can contact the Conduct Department of Entities at the Bank of Spain, at 900 545 454. Their reports are not binding and do not order the account to be unlocked or the money to be returned, although they serve as support in a legal claim. In 2025, the supervisor processed 30,970 claims, of which 9,179 (30%) corresponded to fraud in payment operations.
When faced with a warning with a link, it is prudent to enter the application or the official bank website by typing the address manually and calling the number on the card. If credentials have already been entered, the card should be blocked immediately and the 017 line, the INCIBE line for cybersecurity, should be notified.
You may also like
