Types of online bank fraud in Spain and how the Criminal Code punishes them

Online bank fraud has become one of the most widespread forms of crime. The techniques change constantly, but almost all of them pursue the same thing: obtaining the victim's passwords or banking details, or persuading the victim to make the transfer themselves. Below we explain the most common methods and how Spanish criminal law treats them.

What counts as fraud under the Spanish Criminal Code?

The Spanish Criminal Code (CP) defines estafa as the conduct of a person who, for profit, uses sufficient deception to cause another to err, inducing them to make a disposition of property to their own detriment or that of a third party (article 248 CP).

Alongside this classic form of fraud, the Criminal Code also treats as fraud obtaining, for profit, an unconsented transfer of any asset by interfering with an information system, altering computer data or any other computer manipulation or similar device (article 249.1.a CP), as well as the fraudulent use of cards or other non-cash payment instruments, or of the data they contain, to carry out operations to the detriment of their holder or of a third party (article 249.1.b CP).

That distinction matters in bank fraud cases:

• If the deceived victim makes the transfer themselves, the facts usually fall under the fraud of article 248 CP.
• If the perpetrators obtain the passwords or data and operate directly on the victim's account or card, the facts usually fall under article 249.1 CP.

Phishing

This consists of mass emails imitating the appearance of a well-known bank. The message warns of a fictitious problem with the account — a block, a pending charge, a security update — and includes a link to a fake website designed for the victim to enter their credentials.

With the credentials obtained, the perpetrators access online banking and order transfers or payments, which is normally classified as an unconsented transfer under article 249.1.a CP.

Smishing

The same technique, but by text message (SMS). The message appears to come from the bank and warns, for example, of a suspicious charge or of the need to update the app or a digital signature tool, with a malicious link. Sometimes the fake SMS appears in the same thread as genuine messages from the bank, because the sender has been spoofed.

Its treatment under criminal law is the same as that of phishing.

Vishing

These are telephone calls in which the caller poses as an employee of the bank's security department, sometimes from a number that appears to be the official one. Using urgency as a pretext — a supposed fraudulent access to the account — the caller persuades the victim to read out passwords or the one-time codes received by SMS, or to move their money to a supposed "safe account".

The classification depends on how the money was disposed of: if the perpetrators operate using the codes obtained, the facts usually fall under article 249.1.a CP; if it is the deceived victim who orders the transfer, under the fraud of article 248 CP.

SIM swapping

The perpetrator deceives the telephone company, posing as the holder of the line, in order to obtain a duplicate of their SIM card. From that moment on they control the line and receive the SMS messages the bank sends to authorise operations, which allows them to make transfers from the victim's account, whose credentials they will usually have obtained beforehand by another technique.

Transfers made in this way are usually classified as fraud under article 249.1.a CP. Depending on how the duplicate was obtained, further offences may also apply.

Mirror sites and pharming

This consists of creating websites practically identical to those of a real bank. The perpetrators direct the victim to those pages through links, sponsored search advertisements or, in the case of pharming in the strict sense, by manipulating browser redirection, so that the fake site is reached even when the correct address is typed. As soon as the username and password are entered, the data is captured.

As with phishing, subsequent operations using those credentials usually fall under article 249.1.a CP.

Voice and video deepfakes

This is one of the most recent methods. Using artificial intelligence, the perpetrators imitate the voice or image of a relative or of a company executive to request an urgent transfer or authorise a payment, or to defeat identity verification processes.

Where the victim, believing they are speaking to that person, makes the transfer, the facts may constitute the fraud of article 248 CP. Where the forgery is used to defeat verification systems and operate directly, they may fall under article 249.1.a CP.

What penalties do these frauds carry?

• General penalty: six months to three years' imprisonment. In setting it, the court takes into account, among other factors, the amount defrauded, the economic harm caused and the means employed (articles 248 and 249.1 CP).
• Amounts up to 400 euros: in the fraud of article 248 CP, where the amount defrauded does not exceed that figure, the penalty is a fine of one to three months, unless the circumstances provided for by law apply.
• Aggravated fraud: one to six years' imprisonment and a fine of six to twelve months where, among other cases, the amount defrauded exceeds 50,000 euros or affects a large number of people (article 250.1.5 CP); and four to eight years' imprisonment where it exceeds 250,000 euros (article 250.2 CP).

Who can be criminally liable?

Not only the person who deceives the victim. The Criminal Code also punishes those who manufacture, obtain, possess or supply to third parties programs, devices, data or other means specifically designed or adapted to commit these frauds (article 249.2.a CP).

These frauds also tend to require third-party bank accounts to receive the money and forward it on. A person who lends their account for that purpose, often recruited through job offers or promises of easy money, may find themselves investigated for fraud or for money laundering, which is punishable even when committed through gross negligence (article 301.3 CP). If you are in that situation and are summoned to give evidence, it is advisable to take legal advice first. You can read more in our article on what it means to be summoned as a person under investigation.