Bank in Spain warns customers not to dial this phone code

A simple phone code could allow scammers to redirect your incoming calls without installing any malicious software on your device. Openbank, a Spanish online bank, has issued an alert to customers about a new telephone scam using the code *21, which criminals use to intercept critical calls, such as those needed to verify a bank transaction.

The warning, issued on October 19, refers to a scam known as call forwarding fraud. Criminals are trying to get in touch with their targets, sometimes pretending to be from their bank, and try to trick them into entering a series of numbers and symbols into their mobile phones.

The alarming thing about the scheme is that it takes advantage of a legitimate feature on normal mobile networks. The victim does not have to download any suspicious app, click on a malicious link, or hand over their phone. The trick involves a user unknowingly enabling a service that forwards all incoming calls to a number controlled by someone else.

According to Spanish technology news website Xataka Móvil, Openbank has been sending out security alerts to its customers warning them not to follow instructions with *21 and another phone number.

The warning isn’t only for Openbank clients. Call forwarding is a standard feature of telephones used by mobile operators in Spain and elsewhere.

How the *21 phone scam works in Spain

The scam often begins with a random phone call or email. The caller or sender may say there is suspicious activity on your bank account or that you need to take additional security measures.

The caller then asks the customer to enter a call forwarding sequence involving *21 and a telephone number controlled by the scammer. The explanation might sound reassuring. The caller may say that the process is necessary to safeguard the customer’s account, guarantee future communication, or stop fraudulent transactions.

In reality, these instructions could activate enable unconditional call forwarding, a feature that can be used to redirect incoming calls to another number.

The exact sequence depends on the mobile operator. Simply dialling *21 does not automatically give criminals access to your calls. The risk arises when a complete call forwarding command is activated, redirecting incoming calls to a number controlled by the scammer. Your telephone number itself is not transferred.

Once call forwarding is activated, incoming calls can be redirected to the scammer’s number instead of reaching you.

The situation can be very dangerous when the criminals have already acquired your banking details through phishing emails, fake text messages, and other means of deception.

In some cases, the callers may be able to intercept automated telephone calls used by financial institutions to verify transactions or to validate sensitive operations.

Banco Santander has documented a related fraud involving the cancellation of loans.

According to Santander, the scam can begin with a fraudulent text message impersonating the bank. Criminals attempt to obtain sensitive banking information before persuading the victim to activate call forwarding, allowing them to intercept verification calls.

When the criminals have all the information and access they need, they might try to secure a pre-approved loan for their victim.

The scam continues when the victim receives another call, claiming the victim has been given a loan by mistake. The scammers then ask the customer to transfer the money to a new account to void the transaction.

In fact, the money is being transferred to the criminals.

Call forwarding alone does not reveal banking passwords, allow criminals to read text messages or give them access to a banking app. The danger arises when diverted calls are combined with stolen credentials or other fraudulent activity, potentially allowing criminals to bypass certain telephone-based security checks.

The technique is not a new one, but the latest warning from Openbank illustrates the misuse of a commonly used mobile phone feature.

How to check whether your calls are being redirected

Those who are concerned they have followed suspicious directions can check to see if unconditional call forwarding has been activated on their mobile phone.

On many mobile networks, dialling *#21# and pressing the call button allows users to check whether unconditional call forwarding is active.

If an unexpected forwarding arrangement is detected, the code ##21# can be used to deactivate unconditional call forwarding on many networks.

Another code, ##002#, can remove multiple call forwarding settings on many networks.

But not all operators or phone services have the same commands. Removing all forwarding settings can also affect legitimate settings such as voicemail.

Customers should therefore consult their mobile operator if they are unsure of what a certain setting is.

Call forwarding settings can also be checked through the phone’s calling settings or, where available, the mobile operator’s customer account. The options and information displayed depend on the device, network and type of service.

iPhone users may find the option in Phone settings. On Android phones, it’s usually under Call settings.

A displayed forwarding number is not necessarily an indication of fraud. Some networks use call forwarding to manage voicemail or calls that are not answered.

The most important sign that something is wrong is when another person asks you to forward your call to a new number unexpectedly.

If someone says they are from the bank and they need you to enter a phone code for security reasons, end the call and contact the bank yourself using the bank’s official website, app or phone number.

What to do if you have already followed the instructions

If you have entered a suspicious call forwarding code, contact your mobile operator to check whether any unauthorised forwarding settings are active. The operator can help identify and remove unauthorised settings.

You should also contact your bank immediately, particularly if the suspicious call involved your account details, passwords or payment information.

Explain what happened and ask the bank to look for unusual activity in your account, pending transactions or security changes.

If you have shared your banking details, update your bank login information on the official bank app or website. Follow the bank’s security instructions.

It is also worth reviewing recent transactions and activating banking notifications, where available, so that unexpected activity can be identified quickly.

Customers who notice suspicious transactions should immediately report these to their bank and consider filing a police report.

Spain’s National Cybersecurity Institute, INCIBE, provides a free cybersecurity helpline on 017 to help people who think they have been targeted by cybercrime.

Openbank’s own advice on identifying scam phone calls (https://www.openbank.es/open-to-learn/vishing-llamas-fraudulentas) cautions customers about vishing scams. Vishing is a deceptive technique in which criminals impersonate legitimate businesses to gain access to sensitive information.

The bank advises customers not to give out their passwords, PINs or verification codes during suspicious calls and to always contact their financial institution in case of any doubt.

The recent warning is a reminder that scammers do not always need sophisticated hacking tools to put people’s money at risk. Sometimes, just getting someone to use a common telephone feature can open the door to more fraud.

For Spanish users, the easiest way to protect yourself is to remember that a legitimate bank security check will not involve you having to redirect your incoming calls to an unfamiliar telephone number.