Defending Online Fraud Victims: Private Prosecution

When a person falls victim to online fraud —a transfer induced by deception, an investment in a fake platform, a phishing attack that drains the account— the first reaction is often resignation. Yet the victim is not a passive subject of the criminal process: the law grants an active role through the private prosecution (acusación particular), which allows the victim to drive the investigation, propose evidence and claim, within the same proceedings, the reparation of the harm suffered. This service brings together on a single front the three avenues open to the victim: the criminal one (complaint or formal accusation and appearance), the civil one (civil liability arising from the offense) and, where appropriate, the banking one (claim for unauthorized payment operations).

The Victim's Standing in Criminal Proceedings

Criminal action is public (Art. 101 LECrim) and exercised by the Public Prosecutor, but that does not relegate the victim to a secondary role. Article 109 LECrim requires that the offended or injured party be instructed, when giving a statement, of the right to become a party to the proceedings and not to waive the restitution of the thing, the reparation of the harm and the compensation for the loss. Article 110 LECrim adds that injured parties may appear as a party and exercise the civil actions that lie, without the proceedings being set back. Experience shows that the investigation advances more solidly when an active private prosecution proposes concrete measures than when the victim merely awaits the action taken ex officio.

Private Prosecution: Appearance and Deadlines

Under Article 109 bis LECrim, victims who have not waived their right may exercise the criminal action at any time before the charging stage; this does not allow already-completed acts to be re-done. If the appearance occurs after the deadline to file the prosecution brief, the criminal action may still be exercised until the start of the oral trial by adhering to the brief of the Public Prosecutor or of other prosecuting parties. Where there is a plurality of victims —the usual scenario in fraudulent investment platforms with hundreds of affected people— all may appear, although the court may order that they be grouped into one or several representations to preserve the good order of the process. The offended victim and the heirs are also exempt from posting the bond otherwise required to file a formal accusation (Art. 281 LECrim).

Effective Complaint and Evidence Preservation

The value of a complaint depends on the evidence supporting it. In online fraud, that evidence is volatile: accounts are emptied within hours, domains disappear and platform records are kept for limited periods. The first task is therefore to preserve, with the greatest possible integrity, the entire digital trail:

• Financial movements: transfer receipts, destination account or IBAN numbers, operation references and, where applicable, transaction hashes and wallet addresses.
• Recruitment and deception: ads, profiles, web pages, investment dashboards, emails and messaging (screenshots with date and URL and, where possible, full export of the conversations).
• Identity of those involved: names, phone numbers, aliases, and the bank and payment accounts used as a bridge (so-called "money mules").
• Chronology: an ordered sequence of dates and facts allowing the court to understand the course of the fraud.

With that material, the complaint can be turned into a formal accusation (querella), which allows investigative measures to be proposed from the outset: data-preservation requests, identification of account holders, requests to payment institutions and exchanges, and tracing expert evidence. The querella is the natural tool of the private prosecution because it fixes the object of the investigation rather than leaving it to the chance of action taken ex officio.

Bank Claim for Unauthorized Operations

Much online fraud materializes in unauthorized payment operations: charges, transfers or payments that the victim did not consent to, or consented to vitiated by deception. Payment-services regulation —in its general configuration— sets out a specific regime, distinct from and parallel to the criminal route, whose main lines are worth knowing:

• Duty to notify without delay: the user must inform the institution of the unauthorized operation as soon as they become aware of it. Speed matters both for the refund and for the subsequent negotiating position.
• General refund rule: faced with an unauthorized operation, the payment-services regime provides, as a general rule, that the institution refund the amount, save where certain exceptions apply (notably, the user's own fraudulent conduct or gross negligence in safeguarding their credentials).
• The diligence debate: institutions usually argue the customer's gross negligence —for instance, having disclosed credentials in a phishing attack—; each case requires analyzing the specific circumstances of the deception, its sophistication and the institution's own security conduct.
• Coordination with the criminal route: the bank claim and the criminal complaint reinforce each other. Establishing the fraud in the criminal forum supports the claim against the institution, and the banking documentation feeds the investigation.

It should be stressed that this section describes the framework in general terms; the specific fit, deadlines and exceptions depend on the regulation applicable to each product and on the individualized analysis of each case.

Fund Tracing, Cooperation and Civil Liability

Once the money has left, the goal is to follow its trail and, if possible, freeze it before it disperses. In classic bank transfers, the money usually passes through national or foreign "mule" accounts; in crypto frauds, the tracing is on-chain up to the point of conversion to fiat currency. Freezing funds outside Spain is channeled through the European Investigation Order, letters rogatory and the cooperation of Europol and Eurojust. Over the identified assets, the court may be asked for precautionary asset measures to secure future civil liability.

That civil liability is the economic content of the victim's claim within the criminal process: it comprises the restitution of the defrauded amount, the reparation of the harm and the compensation for the losses (Art. 100 LECrim). Where only the criminal action is exercised, the civil action is deemed exercised too, unless expressly waived or reserved (Art. 112 LECrim). Private prosecution allows that loss to be quantified and established with the victim's own expert evidence and to take part in the decisions affecting the amount finally recoverable.

Phishing, Investments and Crypto: Particularities

The three most frequent forms of online fraud have their own nuances. In phishing (impersonating the institution to obtain credentials and order payments), the focus is the unauthorized payment operation and the claim against the institution, without prejudice to the criminal complaint; see our dedicated page on phishing and bank fraud. In fake investment platforms, the deception is built on the appearance of regulation and fictitious returns shown on a manipulated dashboard. In crypto-asset frauds, on-chain tracing and identifying the destination exchange are decisive; our crypto-asset criminal defense practice covers tracing, fund freezing and international cooperation in detail.

In every case the pattern of action is the same: preserve the evidence, report early, claim against the institution where appropriate, and join the proceedings as private prosecution to steer the investigation toward the money. We do not promise to recover what was lost —no honest professional can guarantee it— but we do work to ensure that each step is taken at the time and in the manner that maximize the victim's options.