Sextortion in Spain: Criminal Defence and Digital Forensics (2026)

Sextortion is one of the fastest-growing forms of extortion, driven by the digitalisation of intimacy and the ease of payment with cryptocurrency. As criminal lawyers specialising in extortion and cyber offences, we analyse the legal classification, digital forensics techniques and the defence strategy.

Sextortion as a Criminal Offence

Sextortion is not an autonomous offence in the Spanish Criminal Code. Its legal treatment requires analysing the concurrence of offences:

• Article 243 CP (extortion): the central core. Punishes with prison of 1 to 5 years anyone who, with intent to profit, compels another through violence or intimidation to act to the detriment of their assets.
• Article 197.7 CP (disclosure of intimate images): punishes with 3 months to 1 year in prison the sharing of intimate images obtained with consent without authorisation.
• Article 169 CP (threats): applicable where the sextortion remains a threat without obtaining the asset gain. Penalty of 1 to 5 years.
• Article 248 CP (fraud): in webcam-scam cases, where the threat is fictitious and there is only deceit.

Where the victim is a minor, specific offences apply, which we cover in a separate article.

Typical Cases: Webcam, Ex-Partner, Cryptocurrency

1. Webcam scams. A mass form in which the victim receives a random email claiming the offender has recorded them through their webcam, demanding payment in bitcoin under the threat of sharing the supposed video. In the vast majority of cases no video exists: the offender only has a leaked password. Classification: attempted extortion or fraud.

2. Ex-partner. The offender keeps intimate images obtained during the relationship and uses them to pressure the victim. This is the scenario of greatest legal seriousness and usually accumulates offences of psychological violence (Art. 153 CP) or gender violence (Art. 173.2 CP).

3. Cryptocurrency and professional networks. Criminal organisations based in third countries use fake profiles on social media or dating apps to induce the victim to send intimate content, then extort payments in cryptocurrency. The transnational component raises the procedural complexity.

Digital Forensics: Traceability and Blockchain

1. IP traceability: analysis of the connection logs of the email accounts or platforms used. The use of a VPN or Tor complicates but does not prevent identification.
2. Blockchain analysis: bitcoin or token addresses are pseudonymous but not anonymous. Specialist firms allow funds to be traced to the exchanges where they are converted to fiat, where the real holder is identified through KYC obligations.
3. Chain of custody: all digital evidence must be preserved through forensic images (a documented SHA-256 hash), following the ISO/IEC 27037 standard.
4. Content analysis: technical verification of the files displayed by the extortionist (EXIF metadata, timestamps, digital manipulation).

Prosecution: How to Prove Authorship

The great challenge for the prosecution is proving the material authorship of the extortive message and of the final destination of the money. The evidence typically accumulated: identification of the holder of the account from which the threats were sent, temporal link with the IP connection, traceability of the payment on the blockchain to a KYC-verified account, analysis of seized devices, and the victim's duly recorded statements.

Defence: Common Mistakes and Nullity of Evidence

• Denial of authorship: proving the account used was not controlled by the accused (a hacked profile, impersonated identity, a shared IP).
• Nullity of evidence: challenging device extractions carried out without specific court authorisation (Art. 588 sexies LECrim) and disproportionate searches.
• Break in the chain of custody: close examination of compliance with ISO 27037.
• Absence of intent: applicable especially in webcam scams.
• Mitigating factor of repair of the harm: where legally feasible and procedurally advisable.

How to Act If You Are a Victim

1. Do not pay. Payment does not stop the extortion; it identifies the victim as a payer.
2. Preserve the evidence. Screenshots with date and time visible, full emails with headers.
3. Do not delete conversations. Keep the device in its current state.
4. Report it. To the police technology units.
5. Consult a criminal lawyer before any further step.
6. Request the removal of content in the event of effective dissemination, based on the GDPR.