Article 249 Spanish Criminal Code: Computer Fraud and Fraudulent Use of Payment Instruments

Article 249 of the Spanish Criminal Code does not contain the basic offence of fraud, which is in article 248, but the modalities treated as equivalent to it: computer fraud obtained by interfering with an information system or altering data, the fraudulent use of cards, travellers’ cheques and other non-cash payment instruments or of the data contained in them, the manufacture and supply of the technical means designed for those frauds, and the possession or transfer of payment instruments unlawfully obtained. It is the provision applied to phishing, to carding and to the manipulation of payment systems.

Wording of Article 249 of the Spanish Criminal Code

Elements of the offence

1. For computer fraud, a computer manipulation or similar device, understood as interference with the operation of a system or the improper alteration of data, and an unconsented transfer of an asset as its result. No deception of any person is required, which is what distinguishes this modality from article 248.
2. For the payment instrument modality, the fraudulent use of a card, cheque or other non-cash instrument, tangible or intangible, or of the data contained in it, and transactions carried out to the detriment of the holder or of a third party.
3. For paragraph 2, preparatory conduct elevated into an autonomous offence: the manufacture or supply of devices, data or programs specifically designed for these frauds, and the unlawful obtaining of payment instruments for fraudulent use.
4. Intent to gain, and for paragraph 3 knowledge of the unlawful origin of the instrument.

Defence strategy

Absence of computer manipulation. Paragraph 1(a) requires interference with the system or alteration of data. Where credentials were obtained by deceiving the victim, who supplied them voluntarily, the system operated exactly as designed and the offence is the ordinary fraud of article 248, not computer fraud. The distinction is not academic: it governs the classification, the description of the facts the prosecution must prove and, frequently, the venue.

Attribution of the conduct in a digital environment. The case rests on network addresses, access logs and account holdings. The defence examines whether the connection was shared, whether the account had been compromised, whether the logs were obtained with the judicial authorisation required by article 588 ter a of the Criminal Procedure Act, and whether the chain of custody of the forensic image is documented. Exclusion of that material ordinarily removes the only link between the accused and the conduct.

The position of the recipient of funds. In phishing networks the accused is frequently the holder of the account that received the transfer and forwarded it. The defence establishes ignorance of the origin through the employment offer received, the remuneration agreed and the absence of any proportionate benefit, which places the conduct, if anywhere, in money laundering by gross negligence under article 301.3 rather than in fraud.

Amount, continuity and restitution. The aggregate of the transactions determines the application of articles 250 and 74. The defence removes unproven transactions, duplications between institutions and sums already refunded by the issuer under the payment services rules, since the criminal loss does not coincide with the amount claimed. Restitution before trial founds the mitigating circumstance of reparation and, with a plea, places the penalty in the lower half.

• Article 248: fraud, the basic offence
• Article 250: aggravated fraud
• Phishing and bank fraud: defence service
• Spanish-language entry

This entry is provided for information only and does not constitute legal advice. The application of any provision depends on the circumstances of the individual case and requires examination of the case file by a qualified lawyer.