Specialist Identity Theft Attorneys

Identity theft (Art. 401 CP) sanctions whoever usurps another's civil status, conduct that goes beyond simple occasional use of a fake name. The protected legal interest is plural: personal identity as an essential attribute of legal personality (Art. 10 SC), security of legal transactions and, frequently, patrimonial or reputational interests of the victim. Supreme Court doctrine has consolidated the two essential typical elements: persistence or continuity in impersonation (an isolated use does not suffice) and totality (assumption of the set of rights and obligations of the impersonated person, not just specific data). The crime can concur with document forgery (Arts. 390-399 CP), fraud (Art. 248 CP), discovery of secrets (Art. 197 CP) and, in the digital sphere, with cybercrime.

The commission modalities have evolved with digitalization. Classic civil status usurpation covers impersonating another person in contractual, registry or administrative relations (ID renewal, commercial registry, employment contracts). Fake social media profiles (Instagram, X/Twitter, Facebook, TikTok, LinkedIn) created with victim's real data to harass, damage reputation, scam or exert manipulation constitute the most widespread modality today. Fraudulent contracting with another's ID (quick loans, personal loans, phone lines, service subscriptions) causes severe patrimonial damage. SIM swapping (fraudulent duplication of SIM card to access online banking) and account takeover on digital platforms are sophisticated modalities. Use of another's ID (entering nightclubs, avoiding fines, accessing restricted services) can be usurpation or the type of Art. 400 bis CP (use of another's authentic document).

The statutory penalties are severe. Civil status usurpation (Art. 401 CP) carries six months to three years' imprisonment. When it concurs with document forgery (use of altered ID or fabrication of document) penalties can reach 3 to 6 years (Arts. 390-392 CP). In fraudulent contracting with patrimonial damage, it concurs with fraud (Art. 248 CP) with penalties of 6 months to 6 years depending on the amount. If the impersonation is performed to obtain reserved personal data, the crime of discovery and disclosure of secrets (Art. 197 CP) concurs with 1 to 4 years' prison. The legal entity benefiting from the usurpation can respond autonomously (Art. 31 bis CP). To this is added civil liability for patrimonial, moral and reputational damages, as well as precautionary measures for closing fake accounts or profiles.

The technical defense is built on four consolidated axes. First, challenging persistence and totality: sporadic use of a fake name, occasional use of another's data without assumption of personality or specific impersonations without continuity are not typical under Supreme Court doctrine. Second, holder's consent: when there is express or tacit authorization from the impersonated person (use of ID with permission, management by third parties with implicit powers), the conduct may be atypical or significantly reduce the penalty. Third, challenging digital authorship: in online fake profiles, attribution to a specific person requires qualified computer expert evidence (IP, device, chain of custody); alternative hypotheses must be discarded (hacked account, shared device, impersonation of the impersonator). Fourth, timely withdrawal: voluntary closure of the fake profile or cessation of impersonation before complaint may operate as damage reparation (Art. 21.5 CP).

In current forensic practice, identity theft has become one of the fastest-growing criminal modalities. Digitalization, massive data breaches (GDPR, LOPDGDD), the development of AI-generated deepfakes (EU AI Regulation 2024/1689), Organic Law 1/2025 on Justice Service Efficiency, Act 2/2023 on Whistleblower Protection and consolidated case-law from the Supreme Court on digital evidence configure a demanding framework. Digital platforms are obliged to cooperate (DSA Regulation, Directive 2017/541) and to remove fraudulent content. At Alonso Sala, with more than 15 years of experience, we intervene both in defense of accused persons (proving lack of persistence, consent or challenging digital authorship) and in private prosecution for victims: we manage urgent closure of fake profiles, annulment of fraudulent contracting, exclusion from defaulter registries (ASNEF, RAI, CIRBE), recovery of amounts and the criminal complaint with qualified computer expert evidence.