Criminal Lawyers in Cyber Fraud & Phishing Defense

Computer fraud under Art. 249 CP is the criminal type specifically designed by the legislator to sanction defraudations committed through technological manipulation or digital social engineering. It punishes whoever, with intent to profit and using some computer manipulation or similar artifice, obtains a non-consensual transfer of any patrimonial asset to another's detriment. The protected legal interest is the patrimony, but the specificity of the means of commission (phishing, smishing, vishing, spoofing techniques, banking malware, BEC) has required developing specific case-law on the suitability of deceit in digital environments. Supreme Court case-law has consolidated that computer manipulation includes both technical alteration of systems and ICT-mediated social engineering techniques, since the victim is deceived through digital channels exploiting standardised cognitive vulnerabilities. This page focuses on cyber-scam modalities and the victim's response; for the analysis of the criminal type (Art. 249.1.a) and the defendant's defense strategy, see computer fraud.

The methods of commission in cyber-fraud have diversified extraordinarily in recent years. Phishing and its variants (SMS smishing, voice vishing) consist of mass or targeted sending of communications impersonating trusted entities (banks, tax agency, payment platforms) to induce the victim to deliver credentials or authorise movements. Spear phishing is the targeted, personalised version, fundamental in CEO fraud or BEC (Business Email Compromise), where attackers impersonate the chief executive or a regular supplier through cloned emails to order urgent transfers to fraudulent accounts. SIM swapping consists of fraudulent SIM card duplication to intercept SMS two-factor authentication and empty bank accounts. Fraudulent use of Bizum through payment requests disguised as payments, marketplace fraud (Wallapop, Vinted, second-hand) and child-in-distress scams via WhatsApp complete the picture of the most frequent modalities.

The penalties are those of fraud: 6 months to 3 years' prison in the basic offence, 1 to 6 years' prison and 6 to 12 months' fine when the aggravator of Art. 250 CP concurs (amount over €50,000, abuse of business credibility, multiple victims in mass crime), and 4 to 8 years' prison in the hyper-aggravated type of Art. 250.2 when the amount exceeds €250,000. The necessary cooperation of whoever acts as money mule —receiving and forwarding defrauded funds— is punished with the same penalties and usually concurs with money laundering under Art. 301 CP (6 months to 6 years' prison). Legal entities holding payment services may respond for negligence in their diligence duties under Payment Services Act 4/2020, opening the civil claim against the bank for defrauded amounts when robust security measures are not proven or required anti-fraud alerts are omitted.

The technical defense in computer fraud rests on four consolidated axes. First, for the defence of the money mule or accused cooperator: proof of prior deception and absence of intent; intellectual authors usually recruit mules through fake job offers ("financial agent", "payment processor"), allowing the conduct to be downgraded from direct intent to negligence or, where appropriate, articulating atypicity by error on the illicit origin of funds. Second, for the defence of the executive in BEC cases: employee due diligence and technical sophistication of the deceit; proof of internal protocols followed and reasonable verification measures exonerates from unfair-administration liability. Third, for the victim against the bank: civil claim under Payment Services Act 4/2020, which reverses the burden of proof and imposes on the bank to demonstrate gross user negligence; case-law has consolidated that mere delivery of credentials under sophisticated deceit does not constitute gross negligence. Fourth, the identification of the material author through computer forensic expertise, IP address tracing, email header analysis and exchange flow tracking.

In current forensic practice, computer fraud is the patrimonial offence with the highest statistical increase in Spain, according to annual reports of the Public Prosecutor and INCIBE. Organic Law 1/2025 on Justice Service Efficiency, Act 4/2020 on Payment Services transposing PSD2, NIS2 on cybersecurity and consolidated Supreme Court and Provincial Court case-law have strengthened both prosecution mechanisms and victim guarantees. At Alonso Sala, with 15+ years' experience in economic offences and a multidisciplinary team of criminal lawyers and forensic cybersecurity experts, we undertake the three main lines of action: technical defence of money mules and employees accused in BEC cases, articulation of private prosecution to identify the fraudster, seize funds and request international judicial cooperation, and civil claim against the bank for negligence in its diligence duties under current regulations.