Moving to the Canary Islands usually means opening a Spanish bank account, registering on the padrón, getting an NIE, signing up with a local phone provider and, for many, joining the Spanish health or pension system. At the same time, most expats keep a bank account, a pension and a phone number back home.
The result is a personal footprint spread across two countries, two sets of databases and two sets of scammers who would like to use them.
Every form filled in at a town hall, gestoría, bank or utility company leaves a record. That is normal and mostly harmless, until one of those organisations is breached. Expats are exposed twice: once through the services they still use at home and again through the Spanish ones they joined after the move. Many also share copies of passports and residency documents with estate agents, rental platforms and removal firms, often by email.
Breaches affecting Spanish institutions do happen. In August, the Spanish edition of Cybernews reported that hackers claimed to have stolen records that could expose millions of Spanish pensioners, with the data being offered for sale online. For the many retired residents in Tenerife, Gran Canaria, Lanzarote and Fuerteventura who receive Spanish benefits, that kind of claim is worth following closely, even before the details are confirmed.
Stolen data is rarely used for something dramatic straight away. More often it feeds into scams that feel personal. A message that uses your full name, mentions your pension or your town and arrives on your Spanish mobile number is far more convincing than a generic email. Copies of identity documents can be used to open accounts or take out credit in someone else's name, which may only come to light months later.
Language adds another layer of risk. A resident who is still learning Spanish may be less likely to spot an odd turn of phrase in an official-looking message, and more likely to follow instructions to avoid trouble with the authorities.
Expats who manage paperwork through a gestor or relocation agency should also ask how those firms store client documents. Reputable agencies will be happy to explain how long they keep copies of passports and contracts, and whether they can delete them once a process is complete.
Start with email, because it is the key to everything else. Make sure your main email account has a strong, unique password and two-step verification switched on. Then do the same for online banking in both countries, your Spanish digital certificate or Cl@ve access if you use one, and any accounts linked to pensions or tax.
Next, look at what has been shared over the years. Delete old scanned copies of your passport and NIE from inboxes and cloud folders you no longer need. Check bank statements in both countries every month for small, unfamiliar payments, which are often used to test whether a card works. If you have a UK credit file, a credit monitoring service can alert you to new applications in your name, and the UK National Cyber Security Centre publishes plain-English guidance on securing accounts and devices.
After a breach, the most common follow-up is a message claiming to come from the organisation that was hit, offering help, compensation or a refund. Treat any of these with suspicion, whether they arrive by SMS, WhatsApp, email or phone. Spanish banks and public bodies do not ask for full card numbers, PINs or one-time codes by message, and neither do their UK equivalents.
Be especially careful with messages about Social Security, Hacienda or the DGT, which scammers know will worry foreign residents. If in doubt, log in through the official website or app you already use, or visit the office in person. A short trip to the local branch is a small price compared with losing savings.
If you receive a notice that your data was involved in a breach, read it carefully and follow only the steps it describes through official channels. Change the passwords for the affected service and anywhere else you reused them. If documents were exposed, keep an eye on your bank and credit records, and consider reporting it to the police if you see signs of misuse.
In Spain, organisations must protect personal data under the GDPR, and residents can complain to the Spanish data protection authority, the AEPD, if they believe their information has been mishandled. For immediate questions, the free 017 helpline run by INCIBE offers advice on online security incidents. Life on the islands should be about sunshine and a slower pace, and a few routine checks go a long way towards keeping it that way.
