The Spanish Workers’ Statute only allows a disciplinary dismissal for a serious and culpable breach by the employee, and the labour courts have for decades drawn a line between the employee who deceives his employer and the employee who has himself been deceived. Phishing is the impersonation of a bank, a supplier or a manager of the company itself, by email, text or phone call, to make the victim hand over access credentials or authorise a payment that ends up with the fraudster. Under the Spanish Criminal Code it is the offence of fraud (estafa) in Articles 248 to 250, and the person who clicks the link or approves the transfer is the victim, including when the money leaves the employer’s account.
That is the rule. The practice is that some companies, on discovering the hole, look for someone to blame and find the employee who approved the transfer or opened the attachment. What follows is a dismissal letter for breach of contractual good faith, a proposal that the employee “take on” the amount, or both. In court that approach rarely succeeds, and only when something more than a mistake is present. I explain it in parts, starting with what you can do today.
What you can secure today without weakening your position
Do not sign any document in which you acknowledge a debt, accept liability or authorise deductions from your pay. An acknowledgement of debt signed in the heat of the moment is an instrument the company can enforce and which is very hard to set aside afterwards. Do not sign a voluntary resignation or a termination agreement that a lawyer has not reviewed, even if it is presented as the amicable way out. If you are handed a dismissal letter, sign it only as “received, not agreed” with the date, because signing for receipt does not mean accepting its contents.
Keep the email, text or call log through which the fraud came in, with full headers, and delete nothing from the computer or the mailbox, even at the company’s request, unless the request is made in writing and there is a record of what was deleted and why. Take screenshots of the chain of communications that followed, including any internal approval of the payment, and of any instruction you received from a superior. Keep the company’s previous emails or security warnings, or note that there never were any, because the training you received will be decisive.
Ask in writing, without arguing, for a copy of the security policy and payment procedure applied to you and of the training the company claims to have given you. If the company has filed a criminal complaint, ask for the report number. If it has not, you can file one yourself as an affected person at any National Police station or Guardia Civil post, and it is worth doing without letting another day pass, because receiving banks only freeze funds if the order arrives quickly.
Do not call the number in the suspicious email or message and do not reopen the link to “check”. If you gave away passwords, change them from a clean device and switch on two-step verification on your work email and on any personal account that used the same password. Do not discuss the matter in colleagues’ messaging groups. Anything you write there can end up in court.
Phishing, what it is and what it means when it happens at work
The term comes from “fishing” and is used in Spanish without translation. It covers any deception technique in which the attacker poses as someone trustworthy to obtain credentials, data or a payment. The text-message variant is called “smishing”, the telephone variant “vishing” and the one using fake QR codes “quishing”. When the target is a specific, previously researched person, it is “spear phishing”, and when that person is a senior executive, “whaling”.
In a company the damage is usually greater than at home because the accounts move more money and because the attacker exploits the chain of command. So-called CEO fraud, or BEC, is an email that appears to come from the managing director or a regular supplier and orders an urgent transfer to a new account, with a plausible excuse and an instruction not to discuss it with anyone. The administration employee who executes it is following an order he believes to be genuine.
Legally this has three layers that get mixed together and should be kept apart. There is a criminal offence, whose perpetrator is the fraudster and whose financial victim is the company. There is an employment relationship in which the company may ask whether the employee breached his duties. And there is often a security breach involving personal data of customers or staff, which creates the company’s own obligations towards the Spanish Data Protection Agency. What happens in one layer does not automatically decide the others.
Phishing examples and penalties, from mass email to CEO fraud
The mass email impersonating a bank or a courier is still the most common and the easiest to spot, because it usually contains errors and mismatched domains. Spear phishing aimed at one person in the company uses his name, his boss’s name and real details taken from professional networks, which is why it works. AI-driven campaigns produce flawless text and cloned voices for the call that confirms the email, so “I already spoke to him on the phone” is no longer a safeguard. None of these variants changes the criminal classification, which depends on the amount and the circumstances and not on the medium used.
| Case | Article of the Spanish Criminal Code | Penalty |
|---|---|---|
| Fraud of up to 400 euros, minor offence | 249 | Fine of one to three months |
| Fraud of more than 400 euros | 248 and 249 | Six months to three years’ imprisonment |
| Fraud of more than 50,000 euros or affecting a large number of people | 250.1 | One to six years’ imprisonment and a fine of six to twelve months |
| Fraud of more than 250,000 euros | 250.2 | Four to eight years’ imprisonment and a fine of twelve to twenty-four months |
Article 248 defines fraud as deception sufficient to cause error in another and move him to an act of disposal to his own or a third party’s detriment, and Article 249 expressly includes fraud committed by computer manipulation or unauthorised use of identification data. CEO fraud fits the offence comfortably because the deception falls on the employee and the loss on the company, what the law calls “detriment to a third party”. If the attacker first got into the corporate email to study the transactions and insert himself into a real conversation, there is also the offence of unlawful access to computer systems in Article 197 bis, with six months to two years’ imprisonment, which I deal with in the article on unlawful access to accounts and systems.
What matters to the employee in this table is simple. The penalties are for the person who deceives. The deceived employee is in none of those rows, and a company that hints otherwise to apply pressure in the employment negotiation is relying on an argument it does not have.
Bank phishing and phishing that impersonates Social Security or the Tax Agency
In bank phishing the attacker poses as the bank where the company holds its account and obtains the online banking credentials or the signature of transactions. In phishing that impersonates the Social Security, the Tax Agency or the postal service, the bait is a pending refund, a fine or a held parcel, and the goal is the same, to obtain credentials or a payment. Neither the Social Security nor the Tax Agency sends payment links by text or asks for card details by email, and both bodies say so in their security notices.
For the victim company there is a practical consequence. When money leaves the account through a transaction the account holder did not actually authorise, payment services regulations place a refund obligation on the bank, with limited exceptions on which the bank almost always tries to centre the discussion. How that claim is framed and how that stance is answered is the lawyer’s work, and we cover it in the post on when the bank must refund money after phishing. What matters here is that the company has a route to recovery against its bank, and that route exists regardless of what it decides to do about the employee.
That changes the conversation about the money. If the company can recover all or part of the loss from its bank, or from the bank that received the transfer, the damage it seeks to pass on to the employee is smaller or non-existent. And if it fails to claim out of neglect, that damage cannot be charged to the person who clicked the link either.
The employee is the victim in criminal law and that weighs in employment law
In criminal proceedings the employee who executed the payment is a witness, and if he gave away personal credentials or suffered his own loss, an injured party. He only becomes a suspect if there is evidence of collusion with the perpetrator, and that evidence has to be real, such as a payment received, prior contact with the destination account or conduct the deception does not explain. Clumsiness does not open a criminal investigation against anyone.
There is one exception worth knowing. If the fraud consisted of the employee receiving money in his own account and forwarding it on the instruction of someone he believed legitimate, the criminal risk is different, because the pass-through accounts used in scams are investigated for money laundering. Article 301 of the Criminal Code also punishes laundering committed through gross negligence, and someone who acted as an intermediary with his personal account can end up on the list of suspects even if he received nothing. That case requires a criminal defence lawyer from day one, before any statement at the police station.
In employment law, being the victim has a direct effect on the dismissal. Article 54.2.d) of the Workers’ Statute allows dismissal for breach of contractual good faith and abuse of trust. Such a breach requires disloyal conduct, deception of the company by the employee or exploitation of his position. Someone who has been deceived by a third party has not deceived his employer. The labour courts take that reasoning into the evidence and ask what the employee did that he should not have done, or what he failed to do while being obliged to do it.
Disciplinary dismissal for falling for phishing, what Article 54 of the Workers’ Statute requires
Disciplinary dismissal is the maximum sanction and the law reserves it for serious and culpable breaches. The Supreme Court has for decades applied what is known as the gradualist doctrine, which requires the sanction to fit the seriousness of the facts and the employee’s circumstances, his length of service, his record and the size of the loss. An isolated mistake by someone who has never been sanctioned, in a task the company never trained him for, rarely reaches that threshold.
Culpability is the other element. Falling for a well-constructed deception is not an intentional act, and the courts do not treat it, on its own, as gross negligence either. What is examined is whether the employee bypassed an internal rule he knew about, for instance a dual-signature procedure for payments to new accounts, whether he ignored an express and recent warning, or whether he acted outside his duties to order a transfer that was not his to make. Where something of that kind is present, the dismissal has a chance. Where the employee did what he always did, with the tools and controls the company gave him, the usual outcome is a finding of unfair dismissal.
This is where the duty of diligence in Article 5 of the Statute comes in, which requires the employee to perform his obligations in good faith, together with the power of control in Article 20.3, which allows the company to monitor compliance. Both run in two directions. A company that invokes the employee’s lack of diligence has to explain what specific diligence it required and how it communicated it. A company that boasts of controls has to prove they existed and worked. A payment procedure that lets a single person transfer a large sum to a new account with an email as the only instruction is a failure of organisation, and organisation is the employer’s responsibility.
Training closes the circle. Article 19 of Law 31/1995 on Occupational Risk Prevention requires the employer to give the employee sufficient and adequate training on the risks of his post, and although its subject is health and safety, the idea that the company must prepare the worker for the risks of his job carries over into cybersecurity in judicial practice through good faith and the burden of proof. A company that never trained its staff to spot fraudulent emails and had no payment verification protocol will struggle to convince a judge that the failure was the employee’s alone.
At the firm we review the dismissal letter and the incident file before the employee signs or answers anything, work done from labour law and criminal defence at the same time, because the two pieces intersect.
The letter, the deadlines and unemployment benefit after a dismissal for phishing
Article 55 of the Workers’ Statute requires a disciplinary dismissal to be communicated in writing, stating the facts on which it is based and the effective date. A letter referring to “the serious losses caused to the company by your negligence” without specifying what the employee did, when and which rule he broke is insufficient, and the formal defect leads to a finding of unfair dismissal without going into the merits. If the employee is a workers’ representative or a union member, the law adds requirements whose omission has the same effect.
The Statute also sets the limitation period for misconduct in Article 60.2. Very serious misconduct is time-barred sixty days after the company learnt of it and, in any event, six months after it was committed. A company that discovered the fraud in February and dismisses in June on that basis is too late. The employee, for his part, has twenty working days from the dismissal to file the conciliation request, a strict deadline that does not stop for negotiations or for waiting while the company “thinks it over”.
If the dismissal is ruled unfair, the company chooses between reinstatement with back pay and compensation of thirty-three days’ salary per year of service, capped at twenty-four months’ pay, under Article 56 of the Statute, with contracts predating February 2012 keeping a tranche at forty-five days. If the company acknowledges the dismissal was unfair at conciliation it avoids the trial and the back pay, which is why many phishing dismissals end there.
On the most-searched question, a disciplinary dismissal does give entitlement to unemployment benefit. Article 267 of the General Social Security Law treats termination of the contract by dismissal as a legal situation of unemployment without distinguishing between fair and unfair, and the dismissal letter is enough to apply for the benefit within the following fifteen working days. The employee does not have to wait for conciliation or judgment to claim.
Repaying the money, the employee’s liability and the company’s limits
The second usual threat is a claim for the lost amount. Article 1101 of the Civil Code requires compensation for damage caused by wilful misconduct, negligence or delay in performing an obligation, and the company invokes it to argue that the employee owes what the fraudster took. In the employment relationship that article is not applied in the raw. The employee works within the employer’s sphere of organisation and direction, and it is the employer who bears the business risk, so the courts require a serious and culpable breach before passing a loss on to him, by the same yardstick as for dismissal. A mistake in the ordinary course of work, induced by a deception designed to produce it, does not meet that standard.
If the company wants to claim it has to sue in the labour court and prove gross negligence, the link between that negligence and the loss, and the real amount of the loss, net of what it has recovered or could have recovered from its bank. The action is time-barred after one year under Article 59.1 of the Statute. What it cannot do is deduct the amount from wages on its own authority. Salary is protected against unilateral set-off, it is unattachable up to the national minimum wage under Article 27.2 of the Statute, and a deduction without consent or a court order entitles the employee to claim the sums with default interest at ten per cent.
That is why I insist on not signing. The only way the company can recover without litigation is for the employee to consent in writing, and that consent is exactly what the acknowledgement of debt and the “instalment plan” sometimes offered alongside a promise not to dismiss are after. Once that is signed, the discussion about whether gross negligence existed disappears.
There is also a question of proportion the reader should weigh before litigating. If the company limits itself to a written warning or a short suspension, challenging it may not be worth the time or the strain on the employment relationship, and the sensible course is to record your disagreement in writing in case the episode is used later. If there is a dismissal or a money claim the arithmetic is different, because what is at stake is the full compensation or several months’ salary, and there the lawyer pays for himself.
Phishing alert inside the company, what must be notified and to whom
The incident does not end with the money. If the attacker accessed the corporate email, a customer database or files containing personal data, the company is the data controller and Article 33 of Regulation (EU) 2016/679 requires it to notify the breach to the Spanish Data Protection Agency without undue delay and, where feasible, within seventy-two hours of becoming aware of it, unless the breach is unlikely to result in a risk to those affected. Article 34 adds communication to the data subjects themselves where the risk is high. Organic Law 3/2018 on Data Protection and Digital Rights completes the sanctioning regime, and fines for failing to notify fall on the company, never on the employee who opened the email.
This matters to the employee for two reasons. A company that breaches its own security and notification obligations has little authority to present the incident as the employee’s exclusive failure. And the breach documentation, the internal report and the notification to the Agency describe how the attack got in and which controls were missing, so the employee can ask for them to be produced in the employment proceedings.
If the company has a data protection officer, that is the person to whom you should address yourself so that the internal report of the incident is on record. If it has none and you are the one who detected the fraud, record in writing, with date and time, whom you alerted and what you told them. In these matters the chronology of who knew what and when decides as much as the merits.
Where to report, how long you have and what happens if the case goes nowhere
A criminal complaint can be filed at any National Police or Guardia Civil station, or at the duty court. In online fraud the Supreme Court applies the ubiquity principle and treats as competent, among others, the court of the place where the victim performed the act of disposal or held the account from which the money left, so nobody has to go looking for the fraudster in his province or his country. The company reports as the financially injured party, and the employee can do so if he gave away his own credentials or if the company does not report and he needs a complaint to refer to.
Fraud is time-barred under Article 131 of the Criminal Code. The basic offence, with a maximum penalty of three years, after five years. The aggravated offence in Article 250, with penalties above five years, after ten. The minor offence, after one year. The civil claim against the perpetrator, if he is ever identified, runs inside the criminal proceedings and needs no separate lawsuit.
The usual outcome is a provisional closure because the perpetrator operates from outside Spain and the receiving accounts belong to front men. That closure does not mean there was no crime and does not make the employee liable. The police investigation will have documented the route of the money and the existence of the deception, and that report is the evidence that the employee was the victim of a fraud, a document worth bringing into the employment proceedings from the outset. Nor does the claim against the bank depend on finding the fraudster, because it rests on the fact that the transaction was not authorised by the account holder.
Frequently asked questions
If I have fallen for phishing, can I claim against the bank?
Yes, the account holder can claim from the bank a refund of the transactions he did not authorise. When the account belongs to the company, the company claims as account holder, and the outcome of that claim reduces the loss it may try to pass on to the employee. How the claim is framed and how the bank’s refusal is answered is the lawyer’s work.
Is phishing a crime in Spain? What is the penalty?
Yes, it is the offence of fraud in Articles 248 to 250 of the Spanish Criminal Code. The penalty is six months to three years’ imprisonment where the amount exceeds 400 euros, one to six years above 50,000 and four to eight years above 250,000. Below 400 euros it is a minor offence punished with a fine. The deceived employee is the victim, not the perpetrator.
Money has been taken from my account through phishing, is the bank obliged to refund it?
As a general rule, yes. Payment services regulations oblige the bank to refund transactions the customer did not authorise, and the bank’s first refusal is not the last word. The fact that the fraudster has not been identified does not affect that obligation. When and on what basis the claim is made is the lawyer’s work.
What needs doing now and who should do it
If you already have the dismissal letter, the twenty working days run from the effective date and what needs doing is for a lawyer to examine it before you reply to the company, because the form of the letter and the limitation period for the misconduct are won or lost in those first days. If what you have is a demand for money or a document to sign, what needs doing is to leave it unsigned and have the lawyer read it. At the firm we conduct the defence in these matters from cybercrime and bank fraud and from labour law, with the letter, the fraudulent email and the police report on the table. We reply as promptly as we can on +34 677 841 007 or through the contact page.