Identity Theft & Fraud Defense Attorneys in Spain
English-speaking specialist identity theft defense. Fake profiles, SIM swapping, fraudulent contracting. Art. 401 CP across Spain.
Under the Spanish Criminal Code (CP), identity theft (Art. 401) punishes usurping another person's civil status, requiring persistence over time and full assumption of the identity, not an isolated act, covering fake social media profiles, fraudulent contracting, SIM swapping and account takeover. The basic offense carries six months to three years' imprisonment, rising to 3-6 years when combined with document forgery, 6 months to 6 years when combined with fraud, and 1-4 years where reserved personal data is obtained under Art. 197 CP. Our defense challenges whether persistence and totality are truly met, contests digital authorship through expert IP and device evidence, and pursues timely withdrawal as reparation.
Identity Theft: Concept, Types, Penalties and Defense (Art. 401 CP)
Identity theft (Art. 401 CP) sanctions whoever usurps another's civil status, conduct that goes beyond simple occasional use of a fake name. The protected legal interest is plural: personal identity as an essential attribute of legal personality (Art. 10 SC), security of legal transactions and, frequently, patrimonial or reputational interests of the victim. Supreme Court doctrine has consolidated the two essential typical elements: persistence or continuity in impersonation (an isolated use does not suffice) and totality (assumption of the set of rights and obligations of the impersonated person, not just specific data). The crime can concur with document forgery (Arts. 390-399 CP), fraud (Art. 248 CP), discovery of secrets (Art. 197 CP) and, in the digital sphere, with cybercrime.
The commission modalities have evolved with digitalization. Classic civil status usurpation covers impersonating another person in contractual, registry or administrative relations (ID renewal, commercial registry, employment contracts). Fake social media profiles (Instagram, X/Twitter, Facebook, TikTok, LinkedIn) created with victim's real data to harass, damage reputation, scam or exert manipulation constitute the most widespread modality today. Fraudulent contracting with another's ID (quick loans, personal loans, phone lines, service subscriptions) causes severe patrimonial damage. SIM swapping (fraudulent duplication of SIM card to access online banking) and account takeover on digital platforms are sophisticated modalities. Use of another's ID (entering nightclubs, avoiding fines, accessing restricted services) can be usurpation or the type of Art. 400 bis CP (use of another's authentic document).
The statutory penalties are severe. Civil status usurpation (Art. 401 CP) carries six months to three years' imprisonment. When it concurs with document forgery (use of altered ID or fabrication of document) penalties can reach 3 to 6 years (Arts. 390-392 CP). In fraudulent contracting with patrimonial damage, it concurs with fraud (Art. 248 CP) with penalties of 6 months to 6 years depending on the amount. If the impersonation is performed to obtain reserved personal data, the crime of discovery and disclosure of secrets (Art. 197 CP) concurs with 1 to 4 years' prison. The legal entity benefiting from the usurpation can respond autonomously (Art. 31 bis CP). To this is added civil liability for patrimonial, moral and reputational damages, as well as precautionary measures for closing fake accounts or profiles.
The technical defense is built on four consolidated axes. First, challenging persistence and totality: sporadic use of a fake name, occasional use of another's data without assumption of personality or specific impersonations without continuity are not typical under Supreme Court doctrine. Second, holder's consent: when there is express or tacit authorization from the impersonated person (use of ID with permission, management by third parties with implicit powers), the conduct may be atypical or significantly reduce the penalty. Third, challenging digital authorship: in online fake profiles, attribution to a specific person requires qualified computer expert evidence (IP, device, chain of custody); alternative hypotheses must be discarded (hacked account, shared device, impersonation of the impersonator). Fourth, timely withdrawal: voluntary closure of the fake profile or cessation of impersonation before complaint may operate as damage reparation (Art. 21.5 CP).
In current forensic practice, identity theft has become one of the fastest-growing criminal modalities. Digitalization, massive data breaches (GDPR, LOPDGDD), the development of AI-generated deepfakes (EU AI Regulation 2024/1689), Organic Law 1/2025 on Justice Service Efficiency, Act 2/2023 on Whistleblower Protection and consolidated case-law from the Supreme Court on digital evidence configure a demanding framework. Digital platforms are obliged to cooperate (DSA Regulation, Directive 2017/541) and to remove fraudulent content. At Alonso Sala, with more than 15 years of experience, we intervene both in defense of accused persons (proving lack of persistence, consent or challenging digital authorship) and in private prosecution for victims: we manage urgent closure of fake profiles, annulment of fraudulent contracting, exclusion from defaulter registries (ASNEF, RAI, CIRBE), recovery of amounts and the criminal complaint with qualified computer expert evidence.
Our Specialized Services
Civil Status Usurpation
The classic crime (Art. 401 CP): continuously impersonating another to exercise their rights.
Fake Profiles & Socials
Creating fake accounts to harass, scam, or damage reputation.
Fraudulent Contracting
Using stolen ID for quick loans or purchases. Defense against debt claims.
Specialist Defense in Identity Theft
Identity theft in the digital environment requires lawyers who master technical language. It is not enough to know the Criminal Code; it is necessary to know how to interpret connection logs and metadata.
- Specialization in IT and Technology Crimes.
- Urgent action capacity for profile closure.
- Technical defense before Investigating Courts, Criminal Courts and Provincial Courts.
- Collaboration with specialist forensic IT experts.
Identity and Public-Function Usurpation: Penalties and Defence
Usurpation of another’s civil status (Art. 401 CP), usurpation of public functions (Art. 402 CP) and the offences against privacy and of illegal access to information systems (Arts. 197 and 197 bis CP) share the same evidential battleground: attributing authorship in digital environments. We work with forensic IT experts to counter every report filed by the prosecution.
Penalty Table: Identity Usurpation and Computer Offences
| Offence | Article | Penalty |
|---|---|---|
| Usurpation of another’s civil status | Art. 401 | Imprisonment 6 months – 3 years |
| Usurpation of public functions: performing acts proper to an authority or official while claiming official capacity | Art. 402 | Imprisonment 1 – 3 years |
| Unlawful practice of a profession | Art. 403 | Fine 12 – 24 months (6 – 12 months where the required qualification is an official, licensing one); imprisonment 6 months – 2 years in the situations of Art. 403.2 |
| Discovery and disclosure of secrets | Art. 197.1 | Imprisonment 1 – 4 years and fine 12 – 24 months |
| Dissemination, revelation or transfer to third parties of the data or images discovered | Art. 197.3, para. 1 | Imprisonment 2 – 5 years |
| Illegal access to an information system in breach of its security measures (hacking) | Art. 197 bis 1 | Imprisonment 6 months – 2 years |
| Knowing use of a false identity document | Art. 392.2 | Imprisonment 6 months – 1 year and fine 3 – 6 months |
Defence Strategies in Identity Usurpation
Usurping civil status versus one-off use of data
Art. 401 CP requires supplanting another’s identity as a whole, assuming their legal position with a degree of permanence. Using someone else’s data in isolation does not make out the offence and usually falls to lesser figures.
Fake profiles: identifying the applicable offence
Creating a profile in another person’s name may amount to usurpation, an offence against privacy or one against honour, depending on what is done with it. The correct characterisation determines the penalty and the competent court.
Attributing authorship in digital environments
An IP address identifies a connection, not a person. With shared networks, commonly used devices or leaked credentials, individual attribution of authorship is open to dispute and further evidence must be required.
Illegal access versus dissemination of what was found
Entering a system and disclosing what was found are not the same thing. Illegal access under Art. 197 bis 1 CP carries imprisonment of six months to two years; disseminating the data or images discovered carries two to five years (Art. 197.3 CP). Pinning down which conduct is charged transforms the sentencing framework.
Absence of intent to impersonate
Satirical, parody or critical profiles may lack the intent to pass oneself off as another. Without that supplanting purpose, the conduct may fall outside criminal law altogether.
Exercise of public functions (Art. 402 CP)
Claiming official capacity and performing acts proper to an authority or official is a standalone offence, punished with one to three years’ imprisonment and distinct from usurpation of civil status. The two should be separated from the initial characterisation onwards.
Cybercrime and Digital Impersonation Defense
Cybercrimes are the fastest-growing criminal category. Defense requires technical mastery of digital evidence and case law on the validity of evidence obtained from private systems.
All pages in this practice area
Need urgent criminal defence?
Contact our specialist criminal defence lawyers. We evaluate your case confidentially.
Tools for your case
Do you need specialised legal assistance?
The judicial system is complex. We have the criminal-law specialisation and technical resources required to take on the defence.