Online Identity Theft Lawyers: Criminal Defense & Private Prosecution

The online identity theft is a rapidly expanding criminal category that is reconducted to several types of the Spanish Criminal Code depending on the specific conduct: civil-status usurpation (Art. 401 CP), computer fraud (Arts. 248-250 CP), unlawful access to systems (Art. 197 bis CP), discovery and revelation of secrets (Art. 197 CP), document forgery (Arts. 390-399 CP) and, where applicable, offences against honour (Arts. 205-216 CP). Consolidated Supreme Court case-law has precisified the contours of Art. 401 CP: it requires effective usurpation of another person's civil status with intent and capacity to produce harm or spurious benefit, not the mere occasional use of a name. As criminal lawyers specialising in cybercrime, we offer defence of the accused and private prosecution of the victim with specialised forensic computer expertise.

The typical modalities are diverse and constantly sophisticate. The creation of fake social media profiles using the real victim's name, photographs and data to impersonate them on Instagram, Facebook, LinkedIn, X or TikTok. Catfishing on dating apps (Tinder, Bumble, Grindr) through invented or stolen identities. Financial identity fraud: applications for quick loans, microcredits, bank accounts, credit lines or cards with the victim's stolen documentation. The contracting of services (telephone, energy, rentals, vehicles) in third parties' names. SIM swapping to take control of the phone number and bypass 2FA mechanisms. Corporate impersonation through domain typosquatting, cloned websites, spoofed emails and executive deepfakes. And doxing with impersonation: publication of the victim's personal data together with fake accounts to harass them.

The penalties depend on the applicable type. Civil-status usurpation under Art. 401 CP carries prison from 6 months to 3 years. If the impersonation is used to commit computer fraud (Arts. 248-250 CP), penalties rise to 1-6 years' prison and fine; when criminal organisation or group concurs, up to 8 years. Document forgery (Art. 392 CP in official/commercial document) carries prison from 6 months to 3 years and fine. The unlawful access to accounts (Art. 197 bis CP) sanctions with 6 months to 2 years. In real concurrence, penalties accumulate, frequently reaching figures above 6 years' effective prison. To custodial penalties are added civil liability for moral and patrimonial damages (including content removal, payment of fraudulently contracted services, reputational repair) and, in corporate cases, criminal liability of the instrumental legal entity (Art. 31 bis CP).

The technical defence and private-prosecution strategy articulate several lines. When representing the impersonation victim, we execute urgent precautionary measures: judicial order of content removal to the platform in 24-48h under Art. 13.2 LSSI and EU GDPR 2016/679; identification of the impersonator through orders to Meta, Google, X, ByteDance, Microsoft or ISPs; precautionary freezing of fraudulent bank accounts; blocking of credit lines opened in the client's name; and articulation of criminal complaint with private prosecution. When defending the investigated, we articulate the atypicality of the fictional profile not usurping real identity, the parody or satire under freedom of expression (Art. 20 SC), the mistake of fact on the ownership of credentials or documents used, and the expert challenge of forensic attribution of IP, device and material authorship.

In current forensic practice we observe exponential growth in online identity-theft proceedings, especially linked to financial frauds with documentary impersonation, SIM swapping to drain crypto wallets, corporate deepfakes in CEO-fraud operations, romantic catfishing with derivation to crypto investment scam, and impersonation of executives on professional social networks. EU Regulation eIDAS2 (2024/1183) on European digital identity, EU GDPR 2016/679, Organic Law 3/2018 on Data Protection, Regulation DSA EU 2022/2065 on Digital Services and Organic Law 1/2025 on Justice Service Efficiency have transformed the regulatory framework. At Alonso Sala, we tackle each file with certified forensic computer experts, coordinated management with platforms and authorities, and urgent procedural articulation.