info@societejuridique.com
Madrid: Paseo de la Castellana 216 8 ª Planta
Alicante: Av. Ansaldo Nº31, local 16
24h emergencies: 669 30 21 13

Social media:

Spoofing · identity theft

Spoofing and identity theft: criminal defence and recovery

Criminal defence throughout Spain · offices in Madrid and Alicante

Impersonating an identity is not always usurpation of civil status. Article 401 of the Criminal Code is interpreted restrictively: most reported impersonations are in fact resolved through fraud, document forgery, data offences or offences against moral integrity.

In brief. Article 401 punishes usurping another’s civil status, but the courts require the assumption of the other person’s complete personality, exercising their rights and obligations. The occasional use of another’s name for a specific transaction is dealt with as forgery or fraud. Attribution of authorship is the weak point of almost all these cases: an IP address or a SIM card identifies a device, never automatically a person.

Why it is different

401
The Criminal Code article punishing usurpation of civil status with six months to three years of imprisonment.
249
The provision punishing fraud, including unauthorised transfers through computer manipulation.
197
The article protecting personal data against unauthorised access, use and disclosure.

Impersonating an identity is not always usurpation of civil status

Article 401 of the Criminal Code punishes whoever usurps another’s civil status, but the courts interpret it restrictively: it is not enough to use another’s name occasionally; the offender must assume the complete personality of the other person and exercise their rights and obligations as their own.

For that reason, most facts reported as impersonation are actually resolved through other routes: fraud and computer fraud, document forgery, offences against personal data, unlawful access to systems, or offences against moral integrity and honour where false profiles are created. The correct classification determines the penalty, the limitation period and the evidence that decides the case.

Types of offence

The offences that concur in an impersonation

Art. 401 CP

Usurpation of civil status

Requires permanently assuming the entire personality of another person, exercising their rights and obligations. Case law excludes the isolated use of another’s name for a specific transaction, which is redirected to forgery or fraud. Imprisonment of six months to three years.
Art. 249 CP

Fraud and computer fraud

Following the reform of the Criminal Code, fraud expressly includes computer manipulations and unauthorised transfers of assets. It is the offence applicable to most frauds committed with the victim’s identity. Imprisonment of six months to three years.
Art. 250 CP

Aggravated fraud

Increases the penalty where, among other circumstances, there is special seriousness by the value defrauded, abuse of personal relations or a victim who is especially vulnerable by age or situation. Imprisonment of one to six years and a fine.
Art. 197 CP

Discovery and disclosure of secrets

Punishes the seizure of e-mails, messages or documents and the unauthorised access to, use or modification of personal data held in files or media. Subsequent disclosure to third parties raises the penalty. Imprisonment of one to four years and a fine.
Art. 197 bis CP

Unlawful access to information systems

Punishes access to all or part of a computer system in breach of its security measures, and the interception of non-public data transmissions. It is the usual provision for access to other people’s accounts and profiles. Imprisonment of six months to two years.
Arts. 390–395 CP

Document forgery

Covers the forgery of public, official and commercial documents by private individuals and of private documents. Signing contracts, registrations or applications with another’s signature or data is usually classified through this route. Imprisonment of six months to three years and a fine.
Arts. 399 bis and 400 bis CP

Cards and identity documents

Article 399 bis punishes the forgery of credit or debit cards and their use to another’s detriment, and Article 400 bis treats as forgery the knowing use of a false identity document or of a genuine one belonging to another person. Imprisonment of four to eight years for the forgery.
Art. 172 ter CP

Harassment and improper use of another’s data

In addition to persistent harassment, it expressly criminalises the improper use of the victim’s personal data to acquire products, contract services or cause third parties to contact them. Imprisonment of three months to two years, or a fine.
Arts. 173.1, 205 and 208 CP

False profiles on social media

Creating a profile with another’s identity may amount to degrading treatment seriously impairing moral integrity, or to criminal libel or slander depending on the content disseminated, without prejudice to the civil action for interference with honour and image under Organic Law 1/1982. Imprisonment of six months to two years under Article 173.1.
Penalties at a glance

Penalty framework and aggravating factors

OffenceArticlePenalty frameworkKey aggravating factor
Usurpation of civil status (full assumption of identity)4016 months – 3 yearsPermanence in exercising the victim’s rights
Computer fraud (unauthorised transfers)2496 months – 3 yearsAmount defrauded above four hundred euros
Aggravated fraud2501 – 6 years + fineSpecial vulnerability of the victim
Discovery and disclosure of secrets1971 – 4 years + fineDisclosure or transfer of the data to third parties
Unlawful access to systems197 bis6 months – 2 yearsCommission within a criminal organisation
Document forgery390 – 3956 months – 3 yearsOfficial or commercial character of the document
Cards and identity documents399 bis · 400 bis4 – 8 years (forgery)Use of the card without the holder’s consent
Improper use of personal data172 ter3 months – 2 years or finePrior relationship with the victim or repetition

Penalty ranges are indicative and set out the ordinary framework; the sentence actually imposed depends on the degree of completion, aggravating and mitigating circumstances and the specific facts of each case.

Our differentiator

What decides these proceedings is forensic analysis

Attribution of authorship is the weak point of almost all these cases. An IP address, a shared device, an e-mail account or a duplicated SIM card identifies an access or a device, never automatically a person. We work on the chain of custody of the digital evidence, the connection records requested from providers and the forensic examination of devices. In cases of fraudulent SIM duplication and of messages or calls spoofing the bank’s number, the diligence of the operator and the bank becomes the axis of the case. On that foundation we apply LIWARD, Legal Intelligence Warfare for Defense, our own methodology, which integrates legal intelligence, case-law analytics, financial and accounting analysis and e-forensics into a single procedural strategy.

01

Legal intelligence

02

Financial and accounting analysis

03

Digital evidence · e-forensic

04

Procedural strategy

How we intervene

A strategy sustained through every phase

Phase 01

Preservation of records and complaint

Phase 02

Forensic analysis and attribution

Phase 03

Strategy and evidence

Phase 04

Trial and appeals

Who we represent

Each profile demands a distinct defence

C

Companies

Companies whose trade name, domain or directors’ identity is used to divert payments or contract supplies in their name: criminal response, cease-and-desist demands and reputational containment.

A

Directors and managers

Directors in whose name accounts have been opened, contracts signed or financing requested: delimitation of personal liability from that of the company.

I

Persons under investigation

People investigated for operating with third parties’ data or documents, frequently as the last link in a scheme: contesting intent, error and their true involvement in the facts.

V

Victims · private prosecution

Victims of loans, telephone lines, utilities or false profiles opened with their identity: appearance as private prosecution and full recovery of the loss.

FAQ

What to know before the first consultation

Is creating a false profile with another person’s name an offence?
It does not always fit the usurpation of civil status of Article 401, which requires assuming the victim’s complete personality. Depending on the use given to the profile, it may amount to an offence against moral integrity under Article 173.1, criminal libel or slander under Articles 205 and 208, or a civil wrong for interference with honour and image under Organic Law 1/1982, in addition to removal of the content by the platform and a complaint to the Spanish Data Protection Agency.
A loan or a telephone line has been taken out in my name. What can I do?
The facts should be reported as fraud and document forgery; the entity and the operator should be notified in writing of the absence of consent, with a demand for a copy of the contract and registration documents, and objection to inclusion in credit-information files. In parallel, the right of erasure can be exercised and the harm claimed in full.
The bank says I authorised the operation after a call spoofing its number. Must it refund me?
For unauthorised payment transactions the payment-services rules oblige the entity to refund the amount unless it proves fraud or gross negligence by the user, and the entity bears the burden of proving the transaction was authenticated and correctly recorded. The spoofing of the bank’s own number and the sophistication of the deception are decisive elements to exclude gross negligence: claim in writing, exhaust the customer service route and then go to the supervisor or the courts.
What should I do if I am investigated for identity impersonation?
Do not give a statement without a lawyer, and do not hand over devices, codes or credentials before knowing the full content of the proceedings. The defence is built on the attribution of authorship, the correct classification of the facts, which is frequently disputed, and the true role played, especially where the client is the last link in a wider scheme.
Do you handle cases outside Alicante?
Yes. We operate from Madrid and Alicante and act throughout Spain, including urgent assistance to detainees and proceedings with an international dimension.
What is the LIWARD methodology?
It is our own methodology, Legal Intelligence Warfare for Defense, which integrates legal intelligence, financial and accounting analysis and digital forensic evidence into a single procedural strategy. It allows us to anticipate the weaknesses of the opposing case and to build on technical evidence, not on legal argument alone.

Speak to a criminal lawyer

In a fast-track case, the days you have are the case.

Criminal defence in English before the courts of Alicante and the rest of Spain, for residents and for visitors who have flown home.

Logotipos-abogacia-scje
Paseo De La Castellana 216 8º 28046 Madrid
Alicante – Playa de San Juan Av. Ansaldo 31, local 16, 03540 Alicante
Londres: 20 Wenlock Road, N1 7GU, Reino Unido
París: 72 Faubourg St Honoré, 75008, Francia
info@societejuridique.com

Société de Conseil Juridique et Expert es un despacho de abogados con sedes en Madrid, Alicante, Londres y París, especializado en defensa y acusación penal, delitos económicos y corporativos y derecho tecnológico. Trabajamos con orientación estratégica en procedimientos penales complejos, propiedad intelectual y análisis forense avanzado, y prestamos consultoría jurídica, compliance y escudos de protección a particulares y empresas. Atendemos desde Alicante y Madrid, con consulta online en toda España y asistencia al detenido 24 horas. Resuelva sus dudas en las preguntas frecuentes o solicite una primera consulta.

Copyright © 2026 Société de Conseil Juridique et Expert S.L.

EspanolEnglishFrancaisРусскийItalianoDeutsch
WhatsApp · Urgencias 24h