- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
XFERA MÓVILES, S.A. – €200,000 Fine (Spain, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
XFERA MÓVILES, S.A. was fined €200,000 for failing to verify the identity of customers requesting SIM cards. This allowed fraudsters to impersonate real customers and sign contracts in their names. The case highlights the importance of proper identity verification to protect users from fraud.
What happened
XFERA MÓVILES, S.A. issued SIM cards to fraudsters who pretended to be actual customers.
Who was affected
Two customers of XFERA MÓVILES whose identities were stolen by fraudsters.
What the authority found
The Spanish DPA found that XFERA did not adequately verify the identity of individuals requesting SIM cards, violating GDPR's requirement for data protection.
Why this matters
This case emphasizes the need for companies to implement strong identity verification processes. It serves as a warning that failing to protect user data can lead to significant financial penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 10 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Spanish DPA has fined XFERA MÓVILES, S.A. EUR 200,000. Two Xfera customers had filed complaints with the DPA. In the course of its investigation, the DPA found that fraudsters had pretended to be the data subjects when contacting Xfera and had demanded a copy of their SIM cards. As a result, they were able to conclude contracts at the expense of the data subjects and carry out various transfers. According to the DPA, Xfera had not properly verified the identity of the fraudsters before issuing the SIM cards and ensured that the inquirers were really the SIM card holders.
Related Enforcement Actions (2)
Other enforcement actions involving XFERA MÓVILES, S.A. in ES
Fine
€200K
Details
Fine Date
1 February 2022
Authority
Agencia Española de Protección de Datos
Fine Amount
€200,000
About this data
Cite as: Cookie Fines. XFERA MÓVILES, S.A. - Spain (2022). Retrieved from cookiefines.eu
Last updated: