Before you report it, check if it was aggressive marketing or a genuine scam

It’s vital to learn the difference between an annoying sales tactic and outright fraud, as the channels for complaining and reporting are different for each.

When is it an unwanted sales call?

Since Royal Decree 88/2026 came into force on 11 February 2026, the rules have been clear: unsolicited sales calls to individuals are banned. If you receive a call offering you a new tariff without having given your specific prior consent, the company is breaking the law. However, if the caller identifies themselves correctly, doesn't lie about your current contract, and is simply trying to sell you a product, this is a case of 'telephone spam'. It should be reported to consumer protection bodies, but it doesn't constitute a criminal offence. To understand your rights better, check out our guide: New rules on commercial calls and visits in 2026

When are there signs of fraud or impersonation?

The situation changes when deception is involved – a technique known as 'vishing'. Scammers often use hooks like supposed unpaid debts, technical errors with your meter, or a 'mandatory contract data update'. If the caller claims to be from your energy company but avoids identifying themselves clearly or uses a threatening tone, it’s a clear sign of a scam. These types of attacks are designed to steal your money. You can find out more about these techniques in our guide: Scam calls: how to detect them and take action

What if your supplier or contract was changed without your permission?

If you discover your electricity contract has been switched to another supplier without you signing anything or giving recorded consent, you are a victim of identity theft. Scammers sometimes use personal data gathered during previous calls to set up fraudulent contracts. This is a crime that must be formally reported to the authorities, as it violates both your consumer rights and data protection laws.

Step 1. Hang up and don't share any more information

The first security measure is to immediately cut off any flow of information to the attacker.

Information you should never give out over the phone

Endesa Energía will never contact you by phone, SMS or email to ask for your Customer Area passwords, your bank card security code or the personal verification codes you receive via SMS. You shouldn't hand over your CUPS (Universal Supply Point Code) either, unless you initiated the call for a specific request, as this information is all that's needed to change your contract's ownership or switch suppliers.

What to do if you have already shared your ID, CUPS or bank details

If you handed over your DNI (ID number) or bank account number in the confusion, don't panic, but do act quickly. Scammers use this data to make their future communications look legitimate or to try and set up fraudulent direct debits. You need to stay alert to any follow-up messages and take steps to block financial damage, which we will cover later. In these cases, it’s very useful to understand Phishing: what it is, how to spot it, and what to do if you receive a fake bill, so you are prepared in the future:

Why you shouldn't keep talking 'just to check'

Cybercriminals are highly persuasive. Every second you stay on the line gives them a chance to gather little nuggets of information to make their story sound more convincing. Don't try to reason with them or 'catch them out'; the safest thing to do is hang up and verify the information yourself through official channels.

Step 2. Save all the evidence

For your police report to be effective and for the authorities to investigate, you need to document what happened as accurately as possible.

Caller's number, date and time

Write down the exact phone number that appeared on your screen, along with the precise date and time of the call. Although scammers sometimes use 'spoofing' techniques to display fake official numbers, this information is still vital to help the authorities track them down.

Screenshots, recordings, and follow-up texts or emails

If the scam involved text messages ('smishing') or emails, don't delete them. Take screenshots that clearly show the sender and the message content. If you can record the call (provided you inform them, or for the purpose of reporting a crime), do so – threats to cut off your supply are direct evidence of coercion.

Bills, contracts or proof of supply ownership

Keep your latest genuine bill handy. You can use it to prove to the police or your bank that the details the scammer claimed to have don't match your official contract, or to prove that you are the actual account holder for the affected property.

Step 3. Verify if they were really calling from your supplier

Before taking legal action, you need to make sure the call wasn't a legitimate communication from your energy company.

Use official channels

Contact Endesa on our free Customer Service number (800 760 909) or the sales number (919 101 143). You can also log into your Customer Area on the website or app to check if there are any genuine notifications about unpaid bills or issues with your supply.

Check if the number is authorised

One of the most powerful tools at your disposal is Endesa's official verification service Check who called you. If you enter the number that called you, the website will tell you if it belongs to an authorised Endesa Energía channel or if it's something to worry about.

What to do if they were impersonating your energy company

If you confirm the call was fake, let your company know. At Endesa, we always clearly identify ourselves as Endesa Energía. By reporting it, you help the company trigger alerts to protect other users and work with the authorities to track down the scammers.

Step 4. If there's a financial risk, limit the damage immediately

If the scam was successful and you handed over sensitive data, speed is your best ally to avoid losing money.

Call your bank if you handed over financial details

If you gave them your account or card number, contact your bank immediately. Ask them to put a preventive block on your cards and warn them about possible fraudulent charges so they can bounce back any direct debits you don't recognise.

Change your passwords if you reused credentials

If you handed over your Customer Area login details, change them straight away. If you use the same password for other services (like your banking or email), you need to change them all. Use complex passwords and turn on two-factor authentication wherever possible.

Check if your contract or personal details have been changed

Log into your online profile and make sure your billing address, account number and contracted capacity haven't been altered. Scammers sometimes tweak these details to divert bills or set up a long-term identity theft.

Step 5. File a complaint if you were switched without your consent

If the scam resulted in your supplier being switched without your permission, you need to start the reversal process.

Request a copy of the contract or recording

You have the right to demand that the company that fraudulently signed you up provides a copy of the contract or the recording of the call where you supposedly gave your consent. The new law requires companies to keep these recordings and hand them over within a maximum of 20 days.

Request the cancellation of the switch or contract

If the contract is less than 14 days old, you can use your right of withdrawal to cancel it without having to explain yourself or pay any penalty fees. If more time has passed, you must claim that the contract is null and void due to deception or a lack of consent. To understand these processes better, visit our section on How to switch suppliers / manage your contracts.

What to do if they ignore or reject your request

If the company doesn't respond to your complaint within 15 working days, you can escalate the issue to your regional consumer protection body or the Consumer Arbitration System.

Step 6. Report it to the Police or Guardia Civil

A scam is a criminal offence. Reporting it doesn't just protect you legally; it also helps the authorities dismantle these networks.

Where to report the scam

You can go in person to any National Police station, Guardia Civil post, or, depending on your region, the Ertzaintza, Mossos d'Esquadra or Policía Foral.

What documentation to take with you

It's vital to take your ID (DNI/NIE), your latest genuine bill, and all the evidence you gathered in Step 2: the phone number, screenshots of fraudulent texts, and details of the conversation.

When to report online vs. in person

You can start the process via the web portals of the UIT (National Police) or the Guardia Civil's Cyber Command. However, for the report to be fully legally binding, you will normally have to visit your chosen police station to confirm and sign it in person.

Step 7. Report the case to organisations that can help

There are specialist institutions that offer free advice and monitor cybercrime in Spain.

INCIBE 017

The National Cybersecurity Institute runs a free helpline on 017. Their cybersecurity experts will guide you step by step if you've been a victim of vishing or smishing.

AEPD (if your data has been misused)

If you suspect your personal data is circulating illegally or has been sold without your permission, you can file a complaint with the Spanish Data Protection Agency (AEPD).

Consumer protection bodies (for harassment or aggressive tactics)

If you want to report a breach of the 2026 ban on sales calls or unannounced home visits, the Municipal Consumer Information Offices (OMIC) are the right channel to penalise the offending companies.

FAQ

Here are some questions that might cross your mind if you think you've been scammed:

Can I report a scam even if I didn't sign up for anything?

Yes. An attempted scam using deception should still be reported to the authorities and INCIBE. This helps prevent other people from falling into the same trap.

What if I only gave them some of my details?

Even if you only gave them your DNI or your name, it pays to stay alert. Scammers use that information to win your trust in future calls by pretending to be your bank or energy company.

What should I do if they switched my supplier without permission?

Contact the new company immediately to cancel the agreement due to a lack of consent, and let your original supplier know so they can help you switch back.

Should I report the crime to the police or complain to the company first?

The financial risk is the most urgent issue: call your bank and your energy company first to secure your accounts. Once your money is safe, file the police report and submit your administrative complaints.

Where can I check if the number was official?

Use the 'Check who called you' tool on the Endesa website.It's the quickest and most reliable way to clear up any doubts after receiving a suspicious call.