Lawyers for Online Fraud Victims

When a person falls victim to online fraud —a transfer induced by deception, an investment in a fake platform, a phishing attack that drains the account— the first reaction is often resignation. Yet the victim is not a passive subject of the criminal process: the law grants an active role through the private prosecution (acusación particular), which allows the victim to drive the investigation, propose evidence and claim, within the same proceedings, the reparation of the harm suffered. This service brings together on a single front the three avenues open to the victim: the criminal one (complaint or formal accusation and appearance), the civil one (civil liability arising from the offense) and, where appropriate, the banking one (claim for unauthorized payment operations).

The Victim's Standing in Criminal Proceedings

Criminal action is public (Art. 101 LECrim) and exercised by the Public Prosecutor, but that does not relegate the victim to a secondary role. Article 109 LECrim requires that the offended or injured party be instructed, when giving a statement, of the right to become a party to the proceedings and not to waive the restitution of the thing, the reparation of the harm and the compensation for the loss. Article 110 LECrim adds that injured parties may appear as a party and exercise the civil actions that lie, without the proceedings being set back. Experience shows that the investigation advances more solidly when an active private prosecution proposes concrete measures than when the victim merely awaits the action taken ex officio.

Private Prosecution: Appearance and Deadlines

Under Article 109 bis LECrim, victims who have not waived their right may exercise the criminal action at any time before the charging stage; this does not allow already-completed acts to be re-done. If the appearance occurs after the deadline to file the prosecution brief, the criminal action may still be exercised until the start of the oral trial by adhering to the brief of the Public Prosecutor or of other prosecuting parties. Where there is a plurality of victims —the usual scenario in fraudulent investment platforms with hundreds of affected people— all may appear, although the court may order that they be grouped into one or several representations to preserve the good order of the process. The offended victim and the heirs are also exempt from posting the bond otherwise required to file a formal accusation (Art. 281 LECrim).

Effective Complaint and Evidence Preservation

The value of a complaint depends on the evidence supporting it. In online fraud, that evidence is volatile: accounts are emptied within hours, domains disappear and platform records are kept for limited periods. The first task is therefore to preserve, with the greatest possible integrity, the entire digital trail:

• Financial movements: transfer receipts, destination account or IBAN numbers, operation references and, where applicable, transaction hashes and wallet addresses.
• Recruitment and deception: ads, profiles, web pages, investment dashboards, emails and messaging (screenshots with date and URL and, where possible, full export of the conversations).
• Identity of those involved: names, phone numbers, aliases, and the bank and payment accounts used as a bridge (so-called "money mules").
• Chronology: an ordered sequence of dates and facts allowing the court to understand the course of the fraud.

With that material, the complaint can be turned into a formal accusation (querella), which allows investigative measures to be proposed from the outset: data-preservation requests, identification of account holders, requests to payment institutions and exchanges, and tracing expert evidence. The querella is the natural tool of the private prosecution because it fixes the object of the investigation rather than leaving it to the chance of action taken ex officio.

Bank Claim for Unauthorized Operations

Much online fraud materializes in unauthorized payment operations: charges, transfers or payments that the victim did not consent to, or consented to vitiated by deception. Payment-services regulation —in its general configuration— sets out a specific regime, distinct from and parallel to the criminal route, whose main lines are worth knowing:

• Duty to notify without delay: the user must inform the institution of the unauthorized operation as soon as they become aware of it. Speed matters both for the refund and for the subsequent negotiating position.
• General refund rule: faced with an unauthorized operation, the payment-services regime provides, as a general rule, that the institution refund the amount, save where certain exceptions apply (notably, the user's own fraudulent conduct or gross negligence in safeguarding their credentials).
• The diligence debate: institutions usually argue the customer's gross negligence —for instance, having disclosed credentials in a phishing attack—; each case requires analyzing the specific circumstances of the deception, its sophistication and the institution's own security conduct.
• Coordination with the criminal route: the bank claim and the criminal complaint reinforce each other. Establishing the fraud in the criminal forum supports the claim against the institution, and the banking documentation feeds the investigation.

It should be stressed that this section describes the framework in general terms; the specific fit, deadlines and exceptions depend on the regulation applicable to each product and on the individualized analysis of each case.

Fund Tracing, Cooperation and Civil Liability

Once the money has left, the goal is to follow its trail and, if possible, freeze it before it disperses. In classic bank transfers, the money usually passes through national or foreign "mule" accounts; in crypto frauds, the tracing is on-chain up to the point of conversion to fiat currency. Freezing funds outside Spain is channeled through the European Investigation Order, letters rogatory and the cooperation of Europol and Eurojust. Over the identified assets, the court may be asked for precautionary asset measures to secure future civil liability.

That civil liability is the economic content of the victim's claim within the criminal process: it comprises the restitution of the defrauded amount, the reparation of the harm and the compensation for the losses (Art. 100 LECrim). Where only the criminal action is exercised, the civil action is deemed exercised too, unless expressly waived or reserved (Art. 112 LECrim). Private prosecution allows that loss to be quantified and established with the victim's own expert evidence and to take part in the decisions affecting the amount finally recoverable.

Phishing, Investments and Crypto: Particularities

The three most frequent forms of online fraud have their own nuances. In phishing (impersonating the institution to obtain credentials and order payments), the focus is the unauthorized payment operation and the claim against the institution, without prejudice to the criminal complaint; see our dedicated page on phishing and bank fraud. In fake investment platforms, the deception is built on the appearance of regulation and fictitious returns shown on a manipulated dashboard. In crypto-asset frauds, on-chain tracing and identifying the destination exchange are decisive; our crypto-asset criminal defense practice covers tracing, fund freezing and international cooperation in detail.

In every case the pattern of action is the same: preserve the evidence, report early, claim against the institution where appropriate, and join the proceedings as private prosecution to steer the investigation toward the money. We do not promise to recover what was lost —no honest professional can guarantee it— but we do work to ensure that each step is taken at the time and in the manner that maximize the victim's options.

Limitation Periods for the Offence of Fraud

The first clock the private prosecution must watch is the limitation period for the offence itself, governed by Article 131 of the Criminal Code. The reform introduced by Organic Law 5/2010 abolished the old three-year bracket, so that figure should be removed from any calculation. To fix the period you start from the maximum penalty attached to the specific form of fraud, and from there derive the window within which the victim may drive the proceedings forward before the criminal action lapses.

Ordinary fraud under Article 248, punishable by six months to three years in prison, is a less serious offence and is time-barred after five years. Aggravated fraud under Article 250.1, carrying one to six years, exceeds the five-year maximum-penalty threshold and is time-barred after ten years. The hyper-aggravated form under Article 250.2, carrying four to eight years, is likewise time-barred after ten years. Petty fraud under Article 248.3, reserved for amounts not exceeding four hundred euros and punished only with a fine, is a minor offence and lapses after one year.

The period runs from the moment the financial loss is completed and is interrupted when the proceedings are formally directed, with reasons, against the person indicated as responsible. Early action by the victim is therefore no mere formality: a well-founded complaint, followed by steps that individualise the suspect, sets the interrupting moment and shields the claim against the passage of time. In complex schemes or cases of late discovery, correctly classifying the aggravated form from the outset can make the difference between having five or ten years of margin.

Confiscation and Recovery of the Fraudster's Assets

Recovering what was defrauded does not depend on the conviction alone: it depends on locating and securing assets before they are dispersed. Confiscation, regulated in Articles 127 and following of the Criminal Code, allows the convicted person to be deprived of the effects and proceeds of the offence, and of property of equivalent value where the original assets have been hidden or transformed. The private prosecution has a direct interest in activating these tools, because confiscated property and protective measures over assets form the material base on which the victim's civil compensation will later be enforced.

The current framework includes mechanisms that are especially useful against structured fraud: extended confiscation, reaching assets disproportionate to the offender's lawful income in crimes committed within a continued activity; confiscation of third-party assets where the holder knew or ought to have known of their unlawful origin; and confiscation without conviction in defined situations, such as the flight or death of the suspect. Alongside this, the early request for attachments and protective entries over real estate, accounts or vehicles prevents the emptying of assets while the case proceeds.

An effective strategy combines asset investigation with a request for protective measures in the first filing of appearance, rather than waiting for judgment. Identifying ownership, interposed companies and suspicious movements allows the court to secure specific property. The sooner assets are frozen, the greater the likelihood that the compensation awarded in the judgment will not remain a declaration without real economic content.

Quantifying the Loss and Civil Liability Arising from the Offence

Every fraud generates, alongside the penalty, an obligation to make reparation, regulated in Articles 109 and following of the Criminal Code. Civil liability arising from the offence covers restitution of the asset, repair of the damage and indemnity for material and moral harm. For the victim, quantifying this head of claim well is as important as proving the fraudulent mechanism, because the judgment can only recognise what has been claimed and documented throughout the proceedings.

Quantification begins with the amount actually moved out of the victim's estate, but it does not stop there. It is appropriate to claim interest, which may accrue from the date of the loss, together with expenses arising directly from the deception and, where they exist, duly proven consequential losses. The burden of documenting transfers, contracts, communications and accounting records falls on the claimant, so the evidential preparation aimed at the civil liability stage should begin from the very first moment.

It is also important to define against whom the claim is directed. Alongside the perpetrator, those who profited from the offence may be liable to the extent of their benefit, and, where applicable, parties with subsidiary civil liability when the offence is committed within a company or service. The amount claimed also shapes the criminal classification, since certain aggravations under Article 250 depend on the value of the fraud or the seriousness of the loss, binding the civil calculation and the prosecution strategy inseparably together.

International Judicial Cooperation for Cross-Border Funds

When defrauded money crosses borders, recovery requires resorting to instruments of international judicial cooperation. The central tool within the European area is the European Investigation Order, which allows the authorities of another Member State to be asked to carry out measures such as identifying account holders, freezing funds or obtaining banking records, with reinforced deadlines and effects. Outside the European Union, the traditional channel is the letter rogatory, processed under the applicable mutual legal assistance treaties.

Speed is decisive. Funds from digital fraud are usually fragmented across chains of transfers and platforms within hours, so the request for securing measures must be made in parallel with the national investigation, not as a later step. European rules provide specific mechanisms for cross-border freezing and confiscation that allow a securing order issued by the Spanish court to take effect over accounts or assets located in another Member State.

From the private prosecution's side, the useful contribution is to prepare the traceability precisely: identifying entities, account numbers, transaction references and platforms involved, so that the requested authority receives a concrete and enforceable petition. A generic request is delayed; a documented request, with a defined object and a clear link to the facts under investigation, multiplies the chances of freezing the money before it is finally dispersed.