A screenshot of the fake profile, saved on your phone, does not on its own prove to a judge that the profile existed, who created it or from where, and when the other side challenges it the Spanish Supreme Court requires its authenticity to be established by other means, usually a forensic IT report. That screenshot is what most impersonation victims bring to our office, together with a link that no longer opens because the platform removed the profile, a forwarded email with no headers and the conversation in which a friend warns that “someone is pretending to be you”. None of it is useless, but none of it, alone, supports a criminal complaint. What does support one is the numerical identifier of the profile or post, which the platform keeps even after deleting the content; the full address and the exact date and time it was seen; the complete email headers, which show which servers it passed through; a notarial deed recording what was on screen at a given moment, or a certificate from a qualified trust service provider; the access logs that the bank or the telephone operator keeps; and, above all, a complaint filed early, because the connection data that identifies the perpetrator is retained by platforms for a limited time and is only handed over on a court order. The difference between a case that succeeds and one that is shelved for lack of an identified perpetrator almost always comes down to what was secured in the first week.
What identity theft is and when it is a crime
Impersonating someone means acting towards third parties as if you were that person, using their name, their image, their identity document or their credentials. In everyday language it is called identity theft, but the Spanish Criminal Code has no offence by that name. What it has is usurpation of civil status under article 401, punishable with six months to three years in prison, and Supreme Court case law that interprets it strictly. For that offence to exist, the perpetrator must pass himself off as the victim completely and with some permanence, assuming their personality in order to exercise rights or assume obligations that belong to the victim alone. Taking out a loan with someone else’s ID, opening a bank account in their name or appearing as them before a public authority fall within article 401. Creating a profile with their name and photo to insult someone or to ask their contacts for money, on its own, often does not, and the prosecution is then built on other offences.
That is why there is not always a crime and why the legal classification matters so much. A joke fake profile among acquaintances that deceives nobody and causes no harm may amount to a data protection infringement and an interference with the right to one’s own image, both of which can be claimed, but not to criminal proceedings. The same profile, if it gets a friend of yours to transfer three hundred euros believing you asked for it, is fraud. And if the perpetrator first broke into your email to take photos and data, there is also an offence against privacy. Our firm acts for the prosecution in these matters and the first thing we do is fit the facts into the correct offence, because the sentence, the limitation period and the investigative measures the court can authorise all depend on it.
The offences usually behind an impersonation
Impersonation rarely comes alone. It is usually the means of committing another offence, and that other offence is what carries the sentence.
Fraud under articles 248 and 249 of the Criminal Code punishes deceiving a third party to obtain a transfer of assets, and article 249 covers its computer-based form, committed by manipulating systems or using someone else’s cards, credentials or data. The sentence is six months to three years in prison and, where the amount defrauded does not exceed 400 euros, a fine of one to three months as a minor offence. If the amount exceeds 50,000 euros or the fraud affects a large number of people, article 250 raises it to one to six years in prison and a fine of six to twelve months. The confusion seen in so many articles between 248 and 249 explains itself. Article 248 defines classic fraud and article 249 sets the penalty and, since the 2022 reform, includes the computer-based variant.
Discovery and disclosure of secrets under article 197 punishes with one to four years in prison and a fine of twelve to twenty-four months anyone who takes or intercepts another person’s messages, emails or documents to uncover their private life. Article 197 bis punishes mere unlawful access to a computer system, the email account, the profile or the phone, with six months to two years in prison, even if nothing is subsequently disseminated.
Document forgery appears when the impersonator uses a fake ID card, article 392.2, with six months to one year in prison and a fine of three to six months, and article 400 bis treats in the same way the use of a genuine identity document by someone who is not its holder, which is exactly what happens when someone presents a stolen photo of your ID to sign a contract.
Where the fake profile is created to degrade, for instance by publishing your telephone number on dating sites with sexual offers, the Supreme Court has applied the offence against moral integrity under article 173.1, with six months to two years in prison, and depending on what was published, defamation or slander may also apply.
| Offence | Article of the Criminal Code | Sentence | Limitation period |
|---|---|---|---|
| Usurpation of civil status | 401 | 6 months to 3 years in prison | 5 years |
| Fraud, including computer fraud | 248 and 249 | 6 months to 3 years in prison; fine of 1 to 3 months if under 400 euros | 5 years (1 year if a minor offence) |
| Aggravated fraud | 250 | 1 to 6 years in prison and a fine of 6 to 12 months | 10 years |
| Discovery and disclosure of secrets | 197.1 | 1 to 4 years in prison and a fine of 12 to 24 months | 5 years |
| Unlawful access to a computer system | 197 bis | 6 months to 2 years in prison | 5 years |
| Use of a fake or someone else’s identity document | 392.2 and 400 bis | 6 months to 1 year in prison and a fine of 3 to 6 months | 5 years |
The limitation periods are those of article 131 of the Criminal Code, which sets five years for offences with a maximum sentence of under five years in prison, ten years for those above that, and one year for minor offences, defamation and slander.
Three scenarios and what changes in each
A loan, a card or a phone line has been taken out in your name
You find out through a letter from a debt collection agency, a notification from a credit reference file or because the bank turns down your mortgage. Someone obtained an image of your ID, often combined with a video or photo of you taken from social media, and passed a lender’s remote identity check. Here usurpation of civil status, fraud against the lender, which is the deceived party, and forgery under article 400 bis all concur. You are an injured party even though the money did not leave your account, because a debt, a credit history and a blacklist entry that are not yours have been created. The contract the impersonator signed does not bind you. Your consent is missing, and without consent there is no contract under article 1261 of the Civil Code. The burden of proving that it was you who signed lies with the lender, and what it usually has is a photo of a document and a recording of someone who is not you.
A fake profile on social media or WhatsApp with your name and photo
There are two variants with different consequences. In the first, the profile is used to ask your contacts for money on some invented emergency, and the victim of the fraud is whoever pays, while you are the victim of the use of your image and name. In the second, the profile is used to harm you, publishing things you never said, contacting the people around you or exposing you in sexual contexts, and there the offences are moral integrity, defamation and, if persistent, stalking under article 172 ter. When it is your WhatsApp itself that has been hijacked, the usual method is a duplicated SIM card or a verification code obtained from you by message, which adds unlawful access under article 197 bis. Removal of the profile by the platform is quick, and that is precisely why you should save the identifiers first, because once it is gone you are left with a screenshot and nothing that allows the court to request the perpetrator’s data.
You are accused of a fraud you did not commit
This is the scenario that frightens people most and the one handled worst without help. You receive a summons from the police or the court as a suspect because an account opened with your data sold non-existent goods, or because a fraudulent transfer ended up in an account in your name. You have the right not to make a statement and to be assisted by a lawyer, and your first statement conditions everything that follows. Your defence consists of proving the impersonation, and for that purpose the earlier complaint if you filed one, access logs, the location of your phone on the day of the facts and any trace of the leak of your document all count. A separate case is that of the person who received money in their account and forwarded it for a commission, the so-called money mule. Even without knowing where it came from, article 301.3 punishes money laundering by gross negligence with six months to two years in prison and a fine, and prosecutors apply it frequently.
If you are in the third scenario, or in either of the first two with a significant sum at stake, our firm takes over the direction of the matter from the outset and acts for the prosecution or the defence, as the case requires, within our cybercrime practice.
The four routes of response and why they are opened together
The criminal route seeks to identify and punish the perpetrator, and carries with it civil liability arising from the offence, articles 109 and following of the Criminal Code, so that the convicted person compensates you. It is the only route that allows the court to demand connection data from platforms and operators, which is why it is opened first. Its limit is that if the perpetrator is not identified or is outside Spain, the case may be shelved and the compensation may remain on paper.
The civil route does not depend on anyone being identified. Organic Law 1/1982 on the protection of honour, privacy and one’s own image treats the use of a person’s name or image without their consent as an unlawful interference, article 7, and presumes that such interference causes harm, article 9, which opens the way to damages for non-material harm against whoever committed or maintained it. This route also serves to have a judge declare void the contract that someone signed in your name.
The data protection route targets whoever processed your data without a lawful basis. The General Data Protection Regulation gives you the right to erasure, article 17, and Organic Law 3/2018 and the Spanish Data Protection Agency allow claims against the platform that does not remove the profile, against the lender that granted credit on an unverified document and against the credit blacklist that listed you without meeting the requirements. The Agency also runs a priority channel for sexual or violent content published without consent.
The banking route comes in when money has left your accounts. Payment services legislation obliges the bank to refund transactions you did not authorise, and how that claim is framed, with what arguments and in what order, is the lawyer’s job. I have covered it in the article on getting a bank refund after phishing and, where the fraud started with a call from someone posing as your bank, in the one on bank impersonation scams.
What to do in the first hours and what not to do
In the first twenty-four hours what matters is shutting off access and preserving the trail. Change your passwords from a device other than the compromised one and switch on two-step verification. If your phone has lost signal for no reason, call your operator, because that is the typical sign of a SIM swap. Block your cards if you suspect your account. Before reporting the profile within the platform, save the full address, the identifier, the date and time and, if you can, record your screen while browsing it, and only then request removal. Warn your contacts that it is not you writing. Do not reply to the impersonator or try to negotiate, do not delete conversations even if they embarrass you, do not pay anything to anyone claiming a debt you do not recognise and do not hand your phone to anyone other than a forensic expert or the police.
In the first week you file the complaint. You can do so with the National Police or the Civil Guard, both of which have dedicated cybercrime units, with the duty court, which is slower to process but reaches the judge directly when there is urgency, or online, which the National Police accepts for some offences with no known perpetrator and which requires you to ratify it in person afterwards. You file even if you do not know who did it, because identifying them is the investigation’s task and not yours. As to where, the competent court is that of the place where the offence produced its effects, and in computer fraud the Supreme Court looks to where the victim acted or suffered the loss, so you can file in A Coruña even if the perpetrator is in another province or another country.
In the first month the non-criminal routes are opened, erasure of data, the claim before the Agency, formal notice to the lender that granted the credit and, where relevant, to the Tax Agency or Social Security.
The debt in your name and the credit blacklist
While the investigation runs, you do not pay. The debt is not yours because the contract is void for lack of consent, and paying an instalment “so they stop calling” can later be read as an acknowledgement of the debt. What you should do is notify the lender in writing that you have been impersonated, with a copy of the complaint, and from that moment the debt is disputed.
That matters for the credit blacklist. Article 20 of Organic Law 3/2018 only allows the listing of debts that are certain, due and enforceable and whose existence has not been challenged, and requires the creditor to have warned of possible listing when demanding payment. A debt arising from a reported impersonation meets none of those conditions, and keeping it on the file is an interference with honour that the Supreme Court compensates as non-material harm under Organic Law 1/1982, with liability both for the creditor that reported it and for the file operator that kept it without checking. Debt collection agencies that call you have no more powers than the creditor, and persistence with threats or calls to your workplace can amount to the offence of coercion. Getting the entry removed and a declaration that you owe nothing has its own procedure, and our firm handles it alongside the criminal complaint.
The deadlines running against you
The criminal ones are those in the table, five years for the most common offences, counted from when the offence was committed, not from when you discovered it. The civil action under Organic Law 1/1982 lapses four years after it could first be brought. The claim before the Data Protection Agency has no fixed deadline, but platforms retain connection data for months, not years. And if court papers have already arrived for a debt that is not yours, the deadlines are short. In an order-for-payment procedure you have twenty working days to oppose from notification of the demand; in a small claims trial, ten days to file a defence. Letting those deadlines pass turns someone else’s debt into a final debt against you, and that is the most serious risk in the whole matter.
What compensation you can claim and from whom
From the impersonator, if identified and convicted, you claim within the criminal proceedings all financial loss and non-material harm, with the practical problem that they are usually insolvent. From the lender that granted credit on an unverified document you can demand liability for negligence, article 1902 of the Civil Code, and the compensation for unlawful data processing recognised in article 82 of the General Data Protection Regulation, in addition to non-material harm for the blacklist entry. From the bank you demand the refund of whatever left your account without your authorisation, under payment services legislation. The platform that hosted the profile is liable only where, knowing of the unlawfulness, it failed to act diligently to remove it, under the intermediary liability regime of Law 34/2002 and the EU Digital Services Act, which is why the formal notice and its date are what trigger that liability. There is no tariff for non-material harm from impersonation and each court moderates the amount according to the reach, the duration and the effect on your life, so be wary of anyone who promises you a figure before seeing the file.
Other questions nobody answers
Renewing your ID card is only necessary if it has been stolen or lost, and in that case you must report the theft so that it is on record before anyone uses it. If what is circulating is a photograph of the document, renewing it does not change the number and solves nothing; what helps is the complaint and having a record of the leak for any future contract that surfaces. Your phone number is worth changing if there has been a SIM swap, and your bank account only if the credentials were compromised.
The Tax Agency and Social Security can pursue you if someone invoiced with your tax number, registered as self-employed with your details or hired workers in your name. Both authorities accept impersonation as grounds to cancel those obligations, but it has to be proved, and the earlier criminal complaint is the piece that makes it possible. Without it, the assessments run their course and end in enforcement.
If the impersonator is outside Spain, the complaint is still necessary. Judicial cooperation within the European Union works, and beyond it the Budapest Convention on Cybercrime allows data to be requested from many countries, although the timescales are long and there are jurisdictions from which nothing comes back. The advantage is that the civil, data protection and banking routes do not depend on the perpetrator being found, and in practice they are the ones that recover the money and clear your name.
What you risk by handling it alone
The concrete risk in this matter is not that you will be punished, it is that a debt that is not yours becomes final because you answered an order-for-payment claim late, that the court shelves the complaint because the evidence was a challengeable screenshot and the connection data no longer existed, or that an unprepared statement as a suspect leaves you trapped in proceedings in which you were the victim. Our firm acts for the prosecution and the defence in identity theft cases, prepares electronic evidence so that it withstands challenge and opens in parallel the civil, data protection and banking routes to recover the money and void what was contracted in your name.
If your identity has been stolen, call +34 677 841 007 or write to us through the contact page. Have to hand the date you detected the impersonation, the identifiers and addresses of the profiles or messages, the complete emails without forwarding, any letters or notices about debts and credit files, the complaint if you have already filed one and any court summons with its date of notification, because the deadline we work to depends on that date.
Frequently asked questions
Can I report it if I do not know who impersonated me or from where?
Yes, and that is the normal situation. The complaint is filed against an unknown perpetrator and it is the judicial investigation that requests connection data from platforms and operators to identify them. What you provide are the identifiers of the profile or messages, the dates and the debt documents, not the identity of the perpetrator.
Do I have to pay the loan taken out in my name while it is being investigated?
No. A contract signed by an impersonator is void for lack of your consent and the burden of proving that it was you who signed lies with the lender. Paying an instalment can later be interpreted as acknowledging the debt. The right course is to file a complaint and notify the lender in writing that you have been impersonated, after which the debt is disputed and cannot be kept on a credit blacklist.
How long do I have to report identity theft?
Most of the offences involved are time-barred five years after they were committed, ten for aggravated fraud and one for minor offences or defamation. The civil action for use of your name or image lapses after four years. In practice a different deadline governs, because platforms keep the data that identifies the perpetrator for months, and a late complaint usually ends up shelved for lack of a known perpetrator.
Do I need a lawyer for identity theft or can I handle it myself?
It depends on what is at stake. A fake profile that the platform removes within hours, with no money involved and no spread, you can resolve yourself with the complaint and an erasure request, and hiring a lawyer is not worth it. You need a lawyer when there is a debt or a contract in your name, when you have been listed on a credit blacklist, when you are summoned as a suspect for something the impersonator did, when money has left your accounts or when the spread has damaged your reputation or your job. In those cases the deadlines are short, electronic evidence gets challenged and there are several routes that must be opened in the right order.