As a sort of paid-to-travel professional, from my experience Spain is your worst destination as far as pick pockets go, Barcelona and Madrid especially. Our airline keeps statistics on theft and robberies of it's staff and customers. Out of all our destinations, Madrid is at number 1, Barcelona at 2 and Malaga at 3. New York is at 4, Paris is at 5 and London only at 11. From our entire African network, only Kinshasa makes the top 10 at spot number 7.
Just use a plain messenger bag, and rotate it forward so you can keep your hands on it in crowded places. Subways and other public transport are the prime hotspots. Watch out for little kids, gangs employ minors because they can't be held when they're caught. Keep your back against a wall if possible, if you see someone suspicious, just stare them down. That usually gives them the message that you're not some bloody tourist.
If you see something strange or some popular street artist whom everyone is watching, be aware that this usually is the decoy that is used so pickpockets can strike. They just cut open your bag with a scalpel. You'll never feel it. In Budapest, thugs often start fights between two accomplices, just so that innocent bystanders are distracted. In a few seconds, people get robbed and they never knew what hit them.
If you stop to eat, drink, just wrap the strap of your camera and/or bag around a chair leg or other fixed object. Often a runner will grab your bag and be gone before you know what happened.
Keep valuables in the safe in your room at all times, I've had people come into my room several times already, even while I was in it. Keys are easy to copy, and a few minutes away is all they need. I don't carry a wallet. I just keep cash and 2 credit cards and one ID in my front pocket. The phone I usually stash away deep at the bottom of my bag.
Also, don't take too much stuff. I tend to travel with only one camera and maybe one extra lens. Less is usually more when travelling. If you don't need a bag, just leave it in the safe.
I use a ThinkTank Retrospective 5, with all the inserts removed. Just because it looks plain. You don't need that padding anyway.
And most importantly, have FUN. I'm away some 120 days a year and all these tips are common sense, but they never stop me from doing what I want, where I want. Apart from the prime tourist hangouts, you'll be just fine.
