Online Identity Theft Lawyers: Criminal Defense & Private Prosecution

The complaint is usually filed at a police station or with a specialist cybercrime unit and leads to preliminary proceedings before an investigating court. Before you are summoned, the investigation moves forward without your knowledge: the platform is asked to identify the account, the telecom operator is asked, under judicial authorisation, who held the IP address, and contracts or records are requested from the companies affected. By the time the summons as a suspect arrives, a documentary body of evidence already exists. From that moment art. 118 LECrim recognises your right to a defence and to know the facts alleged, and the appearance is governed by art. 775 LECrim. This is not a fast-track matter: the evidence is documentary and expert, and the investigation runs long. Arrest is exceptional; interim removal of profiles or blocking of accounts may, however, be ordered.

What matters is how the facts are classified, because very different offences shelter under the label of impersonation. Art. 401 CP punishes usurpation of another's civil status with six months to three years' imprisonment, which case-law reads as assuming a real person's identity wholesale in order to exercise their rights: a profile using an invented name, or even a clearly parodic one, does not fall within that offence without more. Where someone else's identity was used to obtain money, the ground is fraud under art. 248 CP, carrying six months to three years, or computer fraud under art. 249.1.a CP, carrying the same penalty, where an unconsented transfer is achieved through computer manipulation. Accessing another person's accounts in breach of their security measures falls under art. 197 bis.1 CP, carrying six months to two years, and appropriating or disclosing reserved data may fall under art. 197 CP, with higher penalties. The Criminal Court tries the case in all these ranges.

• Do not make a statement without a defence lawyer of your own choosing. Art. 520 LECrim gives you the right to remain silent, not to testify against yourself and not to plead guilty, and to consult your lawyer privately beforehand. Do not hand over passwords or unlock devices without prior advice.
• Do not contact the complainant or the witnesses, and do not write asking them to withdraw the complaint. Nor should you delete the profile or ask a third party to do so: besides destroying evidence, that step reads as an admission of authorship.
• Gather the documents specific to this offence: your internet contract and invoices, showing the IP address assigned on the relevant dates; the list of people using your wireless network and devices; the login and linked-device records the platforms themselves allow you to download; verification emails and access alerts; and, if a contract is attributed to you, the contract itself, the destination account number and any proof that you were elsewhere or using a different device at the time.
• Do not delete accounts, messages or browsing history. Deletion is read as evidence against you, is usually recoverable from the service provider's own servers, and removes precisely what could prove the profile was fictional or satirical, or that someone else operated the account.
• Separate the fake profile from the profitable use of an identity. These are two scenarios with different legal outcomes: a profile that does not assume a real person's identity wholesale and causes no harm rarely falls within art. 401 CP, whereas using someone's data to contract services or move money shifts the case to fraud. Reconstruct, with dates, what was published, what was contracted and from where.

The online identity theft is a rapidly expanding criminal category that is reconducted to several types of the Spanish Criminal Code depending on the specific conduct: civil-status usurpation (Art. 401 CP), computer fraud (Arts. 248-250 CP), unlawful access to systems (Art. 197 bis CP), discovery and revelation of secrets (Art. 197 CP), document forgery (Arts. 390-399 CP) and, where applicable, offences against honour (Arts. 205-216 CP). Consolidated Supreme Court case-law has precisified the contours of Art. 401 CP: it requires effective usurpation of another person's civil status with intent and capacity to produce harm or spurious benefit, not the mere occasional use of a name. As criminal lawyers specialising in cybercrime, we offer defence of the accused and private prosecution of the victim with specialised forensic computer expertise.

Typical Forms

The typical modalities are diverse and constantly sophisticate. The creation of fake social media profiles using the real victim's name, photographs and data to impersonate them on Instagram, Facebook, LinkedIn, X or TikTok. Catfishing on dating apps (Tinder, Bumble, Grindr) through invented or stolen identities. Financial identity fraud: applications for quick loans, microcredits, bank accounts, credit lines or cards with the victim's stolen documentation. The contracting of services (telephone, energy, rentals, vehicles) in third parties' names. SIM swapping to take control of the phone number and bypass 2FA mechanisms. Corporate impersonation through domain typosquatting, cloned websites, spoofed emails and executive deepfakes. And doxing with impersonation: publication of the victim's personal data together with fake accounts to harass them.

Penalties by Classification

The penalties depend on the applicable type. Civil-status usurpation under Art. 401 CP carries prison from 6 months to 3 years. If the impersonation is used to commit computer fraud (Arts. 248-250 CP), penalties rise to 1-6 years' prison and fine; when criminal organisation or group concurs, up to 8 years. Document forgery (Art. 392 CP in official/commercial document) carries prison from 6 months to 3 years and fine. The unlawful access to accounts (Art. 197 bis CP) sanctions with 6 months to 2 years. In real concurrence, penalties accumulate, frequently reaching figures above 6 years' effective prison. To custodial penalties are added civil liability for moral and patrimonial damages (including content removal, payment of fraudulently contracted services, reputational repair) and, in corporate cases, criminal liability of the instrumental legal entity (Art. 31 bis CP).

When Does Online Identity Theft Prescribe? (Art. 401 CP)

Civil-status usurpation under Art. 401 CP (6 months to 3 years' prison, cited above) is a less serious offence and prescribes after 5 years, under the general rule of Art. 131 CP. If the conduct concurs with computer fraud (Arts. 248-250 CP, 1 to 6 years' penalty as set out in the penalties section), the limitation period also rises to 10 years, once the maximum penalty exceeds 5 years.

Defence and Private Prosecution

The technical defence and private-prosecution strategy articulate several lines. When representing the impersonation victim, we execute urgent precautionary measures: a judicial order of content removal to the platform — which courts can issue within 24-48h in flagrant cases — under Art. 13.2 LSSI and EU GDPR 2016/679; identification of the impersonator through orders to Meta, Google, X, ByteDance, Microsoft or ISPs; precautionary freezing of fraudulent bank accounts; blocking of credit lines opened in the client's name; and articulation of criminal complaint with private prosecution. When defending the investigated, we articulate the atypicality of the fictional profile not usurping real identity, the parody or satire under freedom of expression (Art. 20 SC), the mistake of fact on the ownership of credentials or documents used, and the expert challenge of forensic attribution of IP, device and material authorship.

Current Forensic Practice

In current forensic practice we observe exponential growth in online identity-theft proceedings, especially linked to financial frauds with documentary impersonation, SIM swapping to drain crypto wallets, corporate deepfakes in CEO-fraud operations, romantic catfishing with derivation to crypto investment scam, and impersonation of executives on professional social networks. EU Regulation eIDAS2 (2024/1183) on European digital identity, EU GDPR 2016/679, Organic Law 3/2018 on Data Protection, Regulation DSA EU 2022/2065 on Digital Services and Organic Law 1/2025 on Justice Service Efficiency have transformed the regulatory framework. At Alonso Sala, we tackle each file with certified forensic computer experts, coordinated management with platforms and authorities, and urgent procedural articulation.