Spanish bank forces app over SMS, trapping customers

Bank switches from SMS to app, leaving customers trapped

A financial institution has informed its clients that, two months after receiving the notice, the SMS code for signing online transactions will be replaced by a PUSH notification in its mobile application. The letter, written in a friendly tone, includes a clause that treats silence as consent: anyone who does not express rejection within the indicated period is considered to have agreed to the modification of the distance banking contract. The trap lies in the fine print: to reject it, one must enter the app and disable notifications from the settings menu. In other words, you must install precisely what you want to avoid.

The case has caused outrage among those who operate exclusively from their computer and do not have a smartphone. The affected customer states it plainly: she uses a keypad phone, disposed of her old smartphone, and has no intention of getting another. Her plan involves sending an email with legal certification before third parties expressing her explicit opposition. "There is no law forcing me to have a smartphone," she argues.

What exactly does the modified contract say?

Clause four, regarding how operations are carried out, is the one being tweaked. The text equates electronic signature with handwritten signature and adds that, for security reasons, additional authentication factors may be requested: OTP, biometric elements such as facial or voice recognition, app login, or e-banking. Strong Customer Authentication requires at least two factors.

The notice also warns of a little-discussed side effect: if the customer disables PUSH notifications, they will stop receiving all other alerts about account and card transactions. A complete information blackout in exchange for keeping SMS.

The trap of silence as acceptance

The legal mechanism is standard in Spanish banking: the modification is deemed accepted if the customer does not respond within two months. The burden of proof falls on the individual, who must navigate menus in an application they may not even have installed to express their refusal.

Some argue that rejection can be managed via the web client area, but in reality, the configuration redirects to the app. The affected customer verified this herself: "I went into my settings and it directs you to the App to modify whatever you need." The circle closes.

SMS as the last bastion of non-smartphone banking

The SMS code remains the only authentication method that does not require installing additional software. For those operating from a PC, it is the red line. The alternative proposed by some institutions — visiting a branch — clashes with demographic reality: there are villages of 200 inhabitants with no bank office, and the nearest one may be half an hour away by car.

The debate over biometric data adds another layer. Some argue that facial recognition offers better protection against remote attacks than a password. Against this weighs an uncomfortable argument: biometric data cannot be changed if leaked, and physical coercion takes on another dimension when access depends on your face or finger.

Alternatives under consideration: rural banks, postal services, and cash under the mattress

Among the discussed exits are rural savings banks (cajas rurales) with physical branches, the prepaid card from Correos (the Spanish postal service) — which allows direct debits and operations with an IBAN for about two euros a month — and a return to cash. There is also mention of using a second-hand smartphone with a prepaid SIM, kept off in a drawer and turned on only for transactions.

The underlying issue is always the same: forced digitalization of banking pushes customers toward a model where the mobile phone ceases to be an accessory and becomes a contractual requirement. Those who refuse will have to find solutions elsewhere, at Correos, or under the mattress.

The pressure works in one direction. With each contract update, the margin for operating without an app narrows further. And meanwhile, SMS holds on. For now.