Energy Account Security in Spain: How Electricity Contracts Can Be Switched Without Customers Realising

Why Electricity Accounts are Valuable Targets

In the modern energy market, your electricity account is more than just a monthly bill. Energy suppliers store significant amounts of sensitive personal and financial data including your DNI (identification number), IBAN (bank account details), and your CUPS (the unique identifier for your property's electricity connection).

Because this data is stored in centralised systems, it has become a target for both aggressive sales tactics and digital security risks. Understanding how these systems work is the first step in protecting your account and ensuring your electricity contract remains under your control.

How Electricity Contract Changes Typically Happen

In Spain, switching electricity providers is designed to be a simple and streamlined process. While this is good for competition, it can also be exploited. Most contract changes happen in one of two ways:

1. Legitimate Switching: A customer provides explicit consent to a new supplier to handle the move. 2. Misunderstandings or Aggressive Sales: A customer may be contacted by a salesperson who presents themselves as being from 'the electricity company' or a regulatory body. In some cases, customers provide data (like their CUPS number) without realising they are agreeing to a contract change.

The Role of Customer Verification

To finalise a contract change, suppliers are required to verify the customer's identity. This is increasingly done via SMS verification links or recorded voice calls. Once a customer clicks a link or says 'yes' during a recorded call, the switch is legally triggered.

It is critical for consumers to realise that any data shared—especially your CUPS number found on your bill—is the 'key' that allows a new company to initiate a switch. Protecting this number is as important as protecting your banking passwords.

Recent Concerns About Data Security

Large-scale data breaches are a growing concern in the energy sector. When a supplier's database is compromised, sensitive details like contact information and billing data can be exposed. This data is often used by third parties to target customers with high-pressure sales calls.

A notable example occurred recently with the Endesa Data Breach and Cyberattack, where millions of records were potentially exposed. Such incidents highlight that the risk isn't just about scammers—it's also about how the major utilities manage the massive amounts of data they hold.

Tips for Protecting Your Energy Account

To ensure your electricity contract isn't switched without your full understanding, follow these security best practices:

Never share your CUPS number or bank details with cold-callers.
Be wary of callers who claim there is a 'problem with your meter' or an 'emergency update' needed.
If a salesperson calls, ask for their full name and the specific company they represent (not just 'the energy company').
If you receive an SMS verification link you weren't expecting, do not click it.
Review your bank statements regularly to ensure your electricity is being billed by your chosen provider.

Transparency in the Spanish Energy Market

As an independent market analyst, Uswitch Energy is committed to transparency. We do not represent any single supplier; our role is to help consumers navigate the market and find the best verified tariffs based on real data.

We believe that a secure energy market is one where consumers have full control over their data and their contracts. If you are unsure about your current contract or have concerns about your billing, our team can help you perform a secure audit of your situation.

Free Electricity Bill Analysis

Are you unsure if you are on the best tariff, or has your contract changed without your full understanding? We can help.

Get a Secure Bill Analysis

Frequently Asked Questions

Can someone switch my electricity provider without my permission?

Legally, no. A switch requires customer consent. However, 'permission' is sometimes obtained through misleading sales tactics or by customers providing sensitive data without realising they are initiating a switch.

What is a CUPS number and why is it sensitive?

The CUPS (Código Universal del Punto de Suministro) is the unique ID for your home's electricity connection. Providing this number along with your ID is often all a company needs to start a transfer process.

How can I tell if my contract has been switched?

The most common way is noticing a different company name on your bank statement or your electricity bill. You can also contact your distribution company (the company that owns the wires) to verify who your current supplier is.

What should I do if I suspect an unauthorised switch?

Immediately contact the new company to cancel the contract (you usually have a 14-day cooling-off period). You should also report the incident to the Spanish energy regulator (CNMC) or a consumer protection office (OMIC).

Relaterade guider

See all guides