Case law and legal doctrineCriminal lawTen ATM withdrawals with the cared-for person’s card: the conviction is measured operation by operation

The facts and the procedural history

• Account holder aged ninety-seven with severe cognitive impairment since 2018
• Care relationship between the defendant and the account holder
• Ten cash withdrawals from automated teller machines between May and July 2022
• Established total amount: 3,220 euros
• Use of the bank card and the personal identification number without authorisation
• Sentence of one year and eleven months of imprisonment and compensation to the heirs
• Two withdrawals of 10,000 and 4,000 euros and the in-branch transactions excluded from the verdict
• Appeal lies to the High Court of Justice of Castile and León

The legal points

• A card belonging to another person, used at a cash machine, operates as a false key
• The classification rests on Articles 237 and 238 of the Criminal Code
• Basic sentencing range for robbery with force: one to three years of imprisonment
• Each act of disposal requires its own sufficient evidence
• The sentence imposed falls within the basic offence, below the aggravated range
• Compensation is paid to the heirs of the deceased account holder

Why using another person’s card at a cash machine is classified as robbery

Article 237 of the Spanish Criminal Code defines robbery by the use of force upon things in order to reach or leave the place where they are kept, and Article 238 lists the situations that amount to such force, among them the use of false keys. Article 239, in its closing paragraph, provides that cards, whether magnetic or perforated, remote opening devices and any other technological instrument of similar effectiveness are to be regarded as keys. Hence the use of another person’s card at a cash machine is consistently treated as robbery with force rather than as theft.

The Full Court doctrine on keys obtained by a person in a position of trust

Judgment 266/2024 of 18 March, handed down by the Full Criminal Chamber of the Spanish Supreme Court, decided a closely comparable situation: a domestic employee took the key to a safe and used it for almost a year to remove cash. The Supreme Court held that taking keys which are not at the perpetrator’s disposal, in order to open a strongbox surreptitiously, amounts to obtaining them by means constituting a criminal offence for the purposes of Article 239.2. What matters is not that the key was lost, but that its owner never handed it over voluntarily for that use. The reasoning extends naturally to the card and secret number that a dependent person entrusts to a carer for purposes other than those actually carried out.

The significance of the personal identification number

The secret code deserves separate attention. A cash machine is not deceived in the sense required by fraud, because it is not a person capable of falling into error; it is a device that verifies a credential. The conduct is therefore not resolved through deception but through unauthorised access to a cash repository by means of an opening instrument that the holder never intended for that purpose. It should be noted that Article 249, following the reform introduced by Organic Act 14/2022, expressly covers the fraudulent use of payment instruments; the boundary between the two heads of liability remains contested and is settled by looking at the specific manner of the disposal.

The evidential lesson: convictions are not presumed in blocks

The most valuable feature of the decision is its method. Faced with a prosecution covering a wider set of disposals, the court convicted only for those operations in respect of which the evidence allowed it to affirm, beyond reasonable doubt, both the absence of authorisation and the defendant’s involvement. The withdrawals of 10,000 and 4,000 euros and the in-branch transactions fell outside the verdict. The presumption of innocence is not satisfied by a global assessment of how plausible the prosecution narrative sounds: it operates in respect of each act of disposal, and the prosecution must prove them one by one.

Sentencing and the vulnerability of the victim

The sentence imposed, one year and eleven months of imprisonment, falls within the basic range of Article 240(1), which provides for one to three years, and below the two-to-five-year range reserved for the situations listed in Article 235. The account holder’s age, her cognitive decline and the care relationship plainly weigh on sentencing, yet the outcome shows that the court did not resort to the aggravated offence. For the defence that detail matters as much as the conviction itself, because a sentence below two years opens the door to suspension of enforcement where the remaining statutory requirements are met.