Cybercrime and online fraud lawyer in Madrid

Short answer. Computer fraud under Article 249 of the Criminal Code punishes with imprisonment of six months to three years the non-consensual transfer of assets by computer manipulation and the fraudulent use of cards and payment instruments; fraud under Article 248, in the wording in force since April 2026, carries the same penalty, and Article 250 raises it to imprisonment of one to six years when the loss exceeds 50,000 euros or affects a large number of people. Unlawful access to and disclosure of reserved data are punished with imprisonment of one to four years (Article 197) and serious computer damage with imprisonment of six months to three years (Article 264). In Madrid we defend persons under investigation and represent victims and companies, with our own forensic IT expert.

Madrid concentrates the central technological investigation units of the National Police and the Guardia Civil, the head offices of the financial institutions through which the money from frauds moves and a very significant share of the companies that are victims of cyberattacks. Its courts handle every day proceedings for phishing, CEO fraud, crypto-asset investment scams, unauthorised access to systems and data leaks, and in them the evidence is almost exclusively digital, which requires a technical defence from the very first moment.

Computer fraud: Article 249

Article 249.1 deems guilty of fraud, with imprisonment of six months to three years, those who, for gain, by improperly obstructing or interfering with the operation of an information system or by entering, altering, deleting, transmitting or suppressing computer data, or by means of any other computer manipulation or similar device, obtain a non-consensual transfer of any asset to the detriment of another; and those who, by fraudulently using credit or debit cards, traveller’s cheques or any other physical or intangible payment instrument other than cash, or the data contained in them, carry out transactions to the detriment of the holder or a third party. Paragraph 2 punishes with the same penalty the manufacture, obtaining, possession or supply of programs or devices designed to commit these frauds, and the theft or unlawful acquisition of cards and payment instruments for fraudulent use.

Ordinary fraud under Article 248, which requires deception sufficient to produce an error and induce an act of disposal, is punished since the reform of Organic Law 1/2026 with imprisonment of six months to three years; when the amount does not exceed 400 euros, a fine of one to three months, except in cases of three prior convictions for offences of the same nature. Article 250 raises the penalty to imprisonment of one to six years and a fine of six to twelve months when the value of the fraud exceeds 50,000 euros or affects a large number of people, when it concerns housing or basic necessities, when it is committed with abuse of personal relationships or business credibility, or in cases of procedural fraud. The investment scams investigated in Madrid, with hundreds of victims and amounts in the millions, are classified under this route and frequently end up before the Audiencia Nacional because of their impact on a large number of people in several provinces.

Access to, seizure and disclosure of data: Article 197

Article 197.1 punishes with imprisonment of one to four years and a fine of twelve to twenty-four months anyone who, in order to discover the secrets or violate the privacy of another, without their consent, seizes their e-mail messages or documents, intercepts their telecommunications or uses listening, recording or reproduction devices. Paragraph 2 imposes the same penalties on anyone who without authorisation seizes, uses or modifies, to the detriment of a third party, reserved personal data recorded in files or computer media, and on anyone who accesses them by any means. Paragraph 3 raises the penalty to imprisonment of two to five years if the data or images are disseminated, disclosed or transferred to third parties, and punishes with imprisonment of one to three years anyone who, knowing their unlawful origin and without having taken part in the discovery, disseminates them. It is the offence of accessing a spouse’s or partner’s e-mail, of leaking customer databases, of the employee who takes the information when changing company and of the dissemination of intimate images.

Computer damage: Article 264

Article 264.1 punishes with imprisonment of six months to three years anyone who, without authorisation and in a serious manner, deletes, damages, deteriorates, alters, suppresses or renders inaccessible another’s data, programs or electronic documents, when the result is serious. Paragraph 2 raises the penalty to imprisonment of two to five years and a fine of one to ten times the loss when the act is committed within a criminal organisation, causes damage of particular seriousness or affects a large number of systems, seriously harms essential public services or affects critical infrastructure. Ransomware, sabotage by a dismissed employee and the deletion of the accounts before an inspection are classified under this route.

Digital evidence: where the case is decided

In cybercrime, guilt is proven with IP addresses, access logs, metadata, device extractions and forensic analysis, and the defence is built by disputing each of those elements: whether the IP identifies a person or only a connection, whether the extraction was made with guarantees of integrity and chain of custody, whether the interception of communications or the search of the device was ordered with the reasoning required by Articles 588 bis a and following of the Criminal Procedure Act, whether the hash of the evidence matches that of the original. We work with our own IT expert from the first step, because digital evidence obtained without guarantees is null and drags down everything derived from it.

If you are the victim: recovering the money

For the Madrid victim of phishing, CEO fraud or an investment scam, an immediate complaint and joining as a private prosecutor are the only way to recover funds: the request through the court to freeze the destination accounts, the claim against the bank for unauthorised transactions under the payment services rules, and tracing the money through mule accounts. Every hour counts, because transfers are fragmented and leave the country within days. We represent individuals and companies, including those that have suffered a data breach and must also notify it to the data protection authority.

Legal basis

Article 249 of the Criminal Code: computer fraud and fraudulent use of payment instruments, imprisonment of six months to three years; manufacture and supply of means to commit it. Article 248: fraud, imprisonment of six months to three years, wording of Organic Law 1/2026 in force since 10 April 2026. Article 250: aggravated offence, imprisonment of one to six years and a fine. Article 197: discovery and disclosure of secrets, imprisonment of one to four years; dissemination, imprisonment of two to five years. Article 264: computer damage, imprisonment of six months to three years; aggravated, two to five years and a fine of one to ten times the loss. Source: consolidated texts published by the Official State Gazette, version in force on 24 September 2026.

Frequently asked questions

What is the penalty for online fraud?

Computer fraud under Article 249 and ordinary fraud under Article 248 are punished with imprisonment of six months to three years. If the loss exceeds 50,000 euros, affects a large number of people or is committed with abuse of business credibility, imprisonment of one to six years and a fine (Article 250). If it does not exceed 400 euros, a fine of one to three months.

Is it an offence to access another person’s e-mail or phone?

Yes. Seizing e-mail messages or documents, intercepting communications or accessing without authorisation reserved data recorded in computer media is punished with imprisonment of one to four years and a fine (Article 197.1 and 2). If the data are disseminated, imprisonment of two to five years.

Can I recover the money from a fraudulent transfer?

It depends on speed. An immediate complaint and a judicial request to freeze the destination accounts, together with the claim against the bank for unauthorised transactions, are the routes. Transfers are fragmented and leave the country within days, so every hour counts.

Is an IP address enough to convict?

Not on its own. The IP address identifies a connection, not a person, and case law requires additional evidence linking the accused to the specific act. The integrity of the digital evidence and its chain of custody are equally preconditions of its validity.

When does computer fraud go to the Audiencia Nacional?

When it causes or may cause a serious impact on the security of commercial dealings, on the national economy or financial harm to a large number of people in the territory of more than one provincial court (Article 65 of the Organic Law on the Judiciary), as in large investment scams with victims throughout Spain.

Related guides

• Cybercrime defence lawyer in Spain
• Article 249 of the Criminal Code
• Article 197 of the Criminal Code
• Criminal defence lawyer in Madrid
• Contact the firm

This article is informative in nature and does not constitute legal advice. For a specific case, consult a lawyer.