Criminal Lawyers in Phishing & Fraud

If you have just discovered charges or transfers you did not authorise, the first steps condition both the criminal investigation and the claim against your bank. This is the sequence we recommend, in this order:

1. Contact your bank immediately. Ask for your cards and online banking to be blocked, formally report the unauthorised payment transactions and ask the bank to attempt to recall the transfers. Spanish payment-services legislation (Royal Decree-Law 19/2018, implementing the PSD2 Directive) requires the user to report the unauthorised transaction without undue delay upon becoming aware of it: always leave a written record and keep proof of that communication.
2. Preserve all the evidence. Delete nothing: the SMS or email received (with full headers if possible), the address of the fake website, screenshots, transaction receipts, the phone numbers that called you and your bank statements. If your device may have been compromised — you installed an app or entered your credentials after clicking a link — do not factory-reset it before considering a forensic IT examination.
3. Report the facts to the National Police, the Civil Guard or the duty court, attaching all the above documentation. The criminal complaint opens proceedings against the perpetrators and against the holders of the destination accounts and, in practice, it also underpins the banking claim and, where applicable, any insurance claim.
4. Claim the refund from the bank in writing. Under payment-services legislation, the bank must refund the amount of the unauthorised transaction unless it proves that the user acted fraudulently or breached, with gross negligence, the duty to safeguard the credentials. If the claim is rejected, the customer-service route, a complaint before the banking supervisor and, ultimately, a civil lawsuit remain available.
5. Consider joining the proceedings as a private prosecutor. If the investigation identifies the receiving accounts and their holders, appearing in the case allows you to request asset freezes and other precautionary measures and to claim civil damages within the criminal proceedings themselves.

Let us be clear: none of these steps, on its own, ensures recovery of the money. The outcome depends on how fast you react, on the route the funds take (domestic or foreign accounts, conversion into crypto-assets) and on how the credentials were safeguarded. What is in your hands is preserving the evidence and activating the three routes — banking, criminal and civil — in time; that is what we work on from the first call.

Computer fraud under Art. 249.1.a) CP punishes those who, for profit, by means of any computer manipulation or similar artifice, achieve a non-consensual transfer of any patrimonial asset to another's detriment. The penalty depends, above all, on the amount defrauded and on the circumstances of Art. 250 CP:

Two points matter in mass campaigns. First: even if each individual charge is small, where the fraud affects a large number of people Art. 250.1.5 CP applies, and the continuing-offence rules also allow the amounts to be added together. Second: in CEO fraud it is common to argue abuse of business or professional credibility (Art. 250.1.6 CP). On top of this, money laundering under Art. 301 CP for the subsequent movement of the funds and, depending on the case, forgery or unlawful access to computer systems may apply concurrently.

The "bank money mule" is the person who receives the phishing proceeds in their own account and forwards them — to other accounts, abroad or converted into crypto-assets — usually after being recruited through a fake remote-job offer. Their legal classification is one of the classic debates in this field, and the difference in penalty depending on the charge is enormous:

• Cooperation in the fraud (Arts. 248 and 249.1.a CP). If it is proven that they knew of the fraudulent scheme and provided their account as an essential link to complete the transfer, they are liable as a necessary cooperator in the fraud: prison of 6 months to 3 years, or the higher penalties of Art. 250 CP if an aggravating circumstance applies.
• Receiving (receptación, Art. 298 CP). If, without having taken part in the fraud as perpetrator or accomplice, they helped the offenders for profit to benefit from its proceeds while aware of the prior property offence: prison of 6 months to 2 years, subject to the limit that the custodial sentence can never exceed that of the concealed offence (Art. 298.3 CP).
• Money laundering (Art. 301 CP). Acquiring, possessing, using or transferring assets knowing they derive from criminal activity is punished with prison of 6 months to 6 years and a fine of one to three times their value. Crucially in practice, laundering by gross negligence (Art. 301.3 CP) — prison of 6 months to 2 years plus a fine — is the route by which many mules are convicted when knowledge of the illicit origin cannot be proven, but the circumstances made suspicion unavoidable.

Consolidated Supreme Court case-law has moved between these three classifications depending on the degree of knowledge proven in each case. For the defence, this opens two main lines: the mistake of fact under Art. 14 CP, where the client was recruited through an apparently legitimate job offer and believed they were doing lawful work, and the boundary between gross and minor negligence in laundering, because minor negligence is not criminal and leads to acquittal.

In phishing proceedings, three different clocks need watching:

• Limitation period of the offence (Art. 131 CP). Basic computer fraud becomes time-barred after 5 years, since its maximum penalty is 3 years' imprisonment; aggravated fraud under Art. 250 CP, after 10 years; minor fraud, after one year. Intentional money laundering is time-barred after 10 years, and negligent laundering, like basic receiving, after 5. For connected or concurrent offences, the period of the most serious offence applies (Art. 131.4 CP).
• Investigation time limit (Art. 324 LECrim). The judicial investigation has a maximum length of 12 months from the opening of the case, extendable by reasoned court order for successive periods of 6 months or less. Measures ordered within the time limit remain valid even if their results arrive later; those ordered after expiry without an extension do not. In phishing cases involving foreign accounts or crypto-asset tracing, extensions are common, and both the defence and the private prosecution must monitor the timetable: the victim, to request the measures they need in time; the suspect, to detect out-of-time measures.
• Notification to the bank. The unauthorised payment transaction must be reported without undue delay once discovered; prolonged inaction weakens the refund claim against the bank.