A text message with the sender shown as Correos, the Spanish postal service, warns of a parcel held for 2.99 euros in customs fees, the recipient enters the card number, expiry date and security code on a page identical to the official one, and for ten days no charge appears on the account. That message is phishing, the sending of emails, text messages or calls that impersonate a company or a public body so that the victim hands over passwords, card details or identity documents, and in Spain it is the crime of fraud under articles 248 and 249 of the Criminal Code, punished with six months to three years in prison in its basic form, from the moment those details are used to make a payment or a transfer. While the fraudster merely holds the data, or uses it to enter an account without moving money, the conduct is punished under articles 197 and 197 bis, discovery of secrets and unlawful access to a system, with a different sentence and a different limitation period. What tips the classification is the first charge, however small, and it matters to the victim for two reasons, because it changes the sentence that can be sought and because only the second situation opens the claim against the bank for the money lost.
The message kept, the card blocked and the password changed, the first things if you have just fallen for it
If you entered details or clicked a link minutes or hours ago, there are things only you can do and that nobody can redo later. Do not delete the text or the email, do not empty the trash and do not uninstall the app from which you opened the link. Take a screenshot showing the sender, the time and the full address of the link, and if it is an email save it as a file or forward it to another account of yours, because the headers identify the server it came from. If you gave card details, block the card from the bank’s app or by calling the number on the back, never the number in the message or in the call you have just received. If you gave a password, change it from a different device from the one you used to open the link and switch on two-step verification on that account and on every account that shared the same password, the email account first, because every other password is reset through it. If in the following hours someone calls claiming to be from the bank, the police or a fund recovery company, do not follow instructions, do not install remote access software and do not make transfers “to a safe account”, because that call is part of the same fraud. Note the time you entered the details and the time of the first charge, and download the statement showing the transactions. With that you hold the proof of the act and of the loss, which is what sustains any complaint and any claim. Do not factory-reset the phone or wipe the computer even if a shop recommends it, because the trace of whatever was installed disappears with it.
Phishing, what it is and how it works from the message to the money leaving
The word comes from “fishing”, spelt with the “ph” used by the first telephone network hackers. It describes the technique accurately. Thousands of hooks identical to the messages of a real institution are cast, and the fraudster waits for a small share of recipients to bite. The deception has four stages, and each leaves a different piece of evidence.
The first is the sending. The fraudster buys or steals a list of phone numbers or email addresses, often from a data breach at another company, and sends the message under the name of the impersonated institution. In text messages the sender can be spoofed so that the text appears in the same thread as the genuine ones from your bank, which explains why careful people fall for it.
The second is the link. It leads to a page copying the official one, hosted on a look-alike domain or on someone else’s compromised server, sometimes live for only a few hours. The form asks for whatever the fraudster needs, username and password, card details, the code the bank sends to confirm transactions, or a photograph of the national identity card.
The third is the use of the data. It can be immediate, with the victim still on the page while the fraudster enters the credentials on the real website and asks for the confirmation code that has just arrived on the victim’s phone. It can be deferred, with the card used weeks later for purchases abroad. It may never touch the money at all, as in the case that opens this article.
The fourth is the money leaving. It almost never goes straight to the fraudster. It passes through third-party accounts, the mule accounts, from which it is split, converted into cryptocurrency or withdrawn in cash within hours. That route is what a well-drafted complaint tries to reconstruct, and the reason time matters.
Phishing in cybersecurity and in computing, what it does for the person sending it
In cybersecurity phishing is classed as social engineering, because the target is the person operating the device, which is why it works with up-to-date antivirus software and an encrypted connection. The fake page can carry a padlock and a valid certificate, the certificate only proves that the connection is encrypted and says nothing about who is behind it. In computing the term is credential theft, and the credential is what has value, because it opens doors the balance in the account does not.
For the sender it serves four purposes. Immediate money, transfers, Bizum payments, card purchases or cash withdrawals with the card added to a phone wallet. Accounts, email, Google or Microsoft, social media or marketplace accounts, which are resold in bulk, used to demand a ransom from the owner or used to defraud the owner’s contacts with the trust a familiar sender carries. Identity, the national identity card, address and date of birth, used to open accounts at payment institutions, take out phone lines or request microloans in the victim’s name, who finds out months later through a debt claim. And access to a device, when the link downloads a programme, which in companies often ends in encrypted files and a ransom demand. Each use fits a different offence in the Criminal Code, which is why the legal classification of a phishing attack starts by asking what was done with what was stolen.
Phishing, smishing, vishing, pharming and spear phishing, what changes with the channel
The channel gives the variant its name, but the crime is the same. What changes is the evidence it leaves and, in practice, the later argument with the bank.
Phishing in the strict sense is mass email. Smishing is the same message by SMS, today the most common form in Spain because the sender is easy to spoof. Vishing is the phone call, and it almost always comes as a second phase, after a text warning of suspicious access, with someone claiming to be from the bank’s security department who knows your name and the last digits of your card and guides you to “cancel” transactions that you are in fact authorising. The number shown on screen may be the bank’s official one, spoofed. Quishing is the link hidden in a QR code, stuck on a parking meter or printed on a letter from a supposed public body.
Pharming works without a message. The home router or the domain name resolution is tampered with, so the victim types the bank’s address correctly and lands on a copy. Legally it is the computer manipulation described in article 249.2(a), and the alteration of the device can add the offence of computer damage under articles 264 and following.
Spear phishing is the targeted attack. A single email, written for one specific person with real details of their job, their boss or a supplier, obtained from professional networks or from an earlier email account already compromised. When the target is an executive it is called whaling, and when the email poses as the managing director ordering the accounts department to make an urgent transfer, CEO fraud. Here the sums are of another order and the aggravating circumstances of article 250 come into play.
For the victim the relevant difference lies in who moves the money. If the fraudster logs in with the stolen credentials and orders the transfer, the transaction was not authorised by the account holder. If during a vishing call the victim makes the transfer with their own hands convinced they are protecting their money, the bank will maintain that the transaction was authorised, and the legal answer to that argument is different and more laborious.
Phishing, what it is and real examples of emails and texts circulating in Spain
The messages below have circulated with minimal variations for years and are recognisable by their structure.
Parcel delivery. “Correos. Your parcel could not be delivered due to unpaid customs fees (2.99 €). Confirm payment to schedule a new delivery”. The link leads to a domain such as correos-entrega24.com and the page asks for the full card. The small amount lowers the guard and the real target is the card data.
Tax Agency. “Following the review of your tax return, a pending refund of 243.56 euros has been detected. Log in to confirm the account for payment”. The Spanish Tax Agency refunds into the account stated on the return and does not request bank details by email or text.
Traffic authority. “DGT. You have an outstanding fine. To avoid the surcharge, pay the amount within 48 hours”. The DGT notifies penalties by post or through its electronic road notification system, never with a payment link by SMS.
Subscriptions. “We could not process your subscription payment. Update your payment method to keep access to your account”, with the Netflix, Amazon Prime or Spotify logo.
Email, Microsoft and Google accounts. “We detected an unusual sign-in from Brazil. If this was not you, secure your account now”. The fake page asks for username, password and, immediately afterwards, the two-step verification code, which the fraudster uses at that very moment on the real site. With the email account taken, every other password can be reset.
Social media. “Your account has received a copyright infringement report and will be deactivated within 24 hours unless you file an appeal”, aimed at Instagram accounts with a business behind them, or a private message from an already impersonated contact asking for a vote in a competition.
Bank. “Unauthorised access to your account has been detected. Verify your identity to avoid blocking”, in the SMS thread of your own bank, followed minutes later by a call from a supposed account manager. The pattern is described in detail in the article on bank impersonation scams.
Private sales. The Wallapop or Vinted buyer who sends a link to “receive payment securely”, where the page asks for your card details in order to pay you, when no platform needs your card to pay you.
Technical support. The window that locks the browser with an infection warning and a freephone number, where someone asks you to install remote control software and uses it to enter your online banking.
Phishing, what it is and how to avoid it, the phrases that give the message away
The signs repeat because the deception always needs the same parts. A short deadline, 24 or 48 hours, so that you consult nobody. A serious consequence if you do not act, a block, a fine or loss of service. A small payment or a refund, which turn card details into a formality. A request that no bank or public body makes through that channel, the full password, a transaction code or a photograph of both sides of your identity card. A link whose domain, the part immediately before the first slash, differs from the official one, however prominently the familiar name appears elsewhere in the address. A generic greeting and a sender that, read slowly, has one letter changed. Spelling mistakes, for years the most reliable clue, have disappeared with machine translation.
Avoiding it takes a few habits. Access the bank and public bodies through the app or by typing the address, never from the link. Two-step verification with an app or a hardware key rather than SMS where the service allows it. Alerts for every card transaction and low limits raised when needed. A virtual card for online shopping. And hanging up and calling the number on the back of the card when the caller claims to be from the bank, however much they know about you. Those habits also have a legal reading, because the user’s diligence is what the bank examines when a claim is later made against it.
What crime phishing is in Spain, articles 248, 249 and 250 and their penalties
The Criminal Code does not use the word phishing. It punishes the result, and the typical result is fraud. Article 248 defines classic fraud, deception sufficient to induce another to carry out an act of disposal to their own detriment, and it applies when the victim moves the money personally, persuaded by the call or the message. Article 249 sets the sentence, six months to three years in prison, and describes in its paragraph 2 the two computer modalities. Letter (a) punishes whoever, by computer manipulation or similar artifice, obtains an unauthorised transfer of an asset, and it fits when the fraudster logs in with the stolen credentials and orders the transfer. Letter (b) punishes whoever fraudulently uses a card or the data recorded on it to carry out transactions to the detriment of the holder, and it is the parcel text message that ends in purchases. Until the reform by Organic Law 14/2022 these two forms of conduct sat in article 248.2, letters (a) and (c), and many texts still cite them that way. The same article 249 punishes whoever manufactures or supplies the programmes designed to commit these frauds, which reaches the person who builds the fake page even if they never touch the money.
| Conduct | Article of the Criminal Code | Penalty |
|---|---|---|
| Transfer or charge made with the stolen credentials or card | 249.2(a) and (b) | Six months to three years in prison |
| Total loss not exceeding 400 euros | 249.1 | Fine of one to three months |
| Over 50,000 euros or a large number of victims | 250.1 | One to six years in prison and a fine of six to twelve months |
| Over 250,000 euros | 250.2 | Four to eight years in prison and a fine of twelve to twenty-four months |
| Logging into the email or social media account with the stolen password | 197 bis.1 | Six months to two years in prison |
| Taking emails or protected personal data | 197.1 and 197.2 | One to four years in prison and a fine of twelve to twenty-four months |
The aggravating circumstances in article 250 raise the sentence in serious cases. The most common in phishing is paragraph 1.5, when the amount defrauded exceeds 50,000 euros or a large number of people are affected, which is frequent in SMS campaigns reaching thousands of victims. When there are several charges against the same person or the same campaign reaches many, article 74 allows the conduct to be treated as a continuing offence and the total loss to be added up, so that a series of 50-euro charges stops being a minor offence. Many victims write off a small amount without knowing that it is part of a far larger sum that a court does pursue.
Identity theft, what crime it is when the phishing does not touch the money
There is no offence in the Spanish Criminal Code called identity theft. Posing as your bank to deceive you is the means of the fraud and is punished within it. Posing as you afterwards, with your data, fits several articles depending on what is done.
Logging into your email, your Google, your Microsoft or your Instagram with the password obtained through the form is unlawful access to an information system under article 197 bis, punished with six months to two years in prison, and a password obtained by deception is still a security measure that has been breached. If the account belongs to a business, the article on hacked business Instagram accounts and ransom demands covers that scenario. Reading your emails, downloading your photographs or taking your personal data inside the account is discovery and disclosure of secrets under article 197, paragraphs 1 and 2, punished with one to four years in prison and a fine, and the sentence rises if what was obtained is disseminated or concerns health, ideology or sexual life. Deleting your files or rendering the account unusable adds computer damage under article 264. Selling the credentials to third parties falls under article 197 ter.
With a photograph of your identity card the fraudster opens payment accounts, takes out a phone line or requests a microloan. Article 400 bis treats the use of a genuine identity document by someone who is not its holder as equivalent to the use of a forged document, so the card need not be altered for an offence to exist. Usurpation of civil status under article 401, six months to three years in prison, is reserved for whoever fully assumes another person’s identity in order to exercise their rights, and the courts do not apply it to a one-off use of the name. When a profile is created with your name and photographs to harass you or to deceive your contacts, the complaint follows the route for online harassment and fake profiles.
When phishing ends in a charge or a transfer, the bank and the payment services regulations
The criminal route pursues the perpetrator, who is almost never identified at the outset. The route that returns the money is a different one. Payment services regulations oblige the institution to refund transactions the customer did not authorise, and a transfer ordered by a third party with stolen credentials is, in principle, an unauthorised transaction. The bank will answer that you handed over the credentials and that this releases it, and the matter is decided in that argument. Having fallen for a text message does not close the door by itself, but how that claim is built, in what order it is filed relative to the criminal complaint and with which documents is the lawyer’s work, and whether you recover the money depends on it. I develop this in the article on when the bank must refund the money after phishing. At the firm we act for the victim on both tracks at once, the criminal complaint and the claim against the institution, and the way we do it is explained on the bank fraud page.
Phishing in the company, CEO fraud, the employee who falls for it and the GDPR data breach
In a company phishing changes in scale and in legal problem. The email arriving in the accounts department under the managing director’s signature requesting an urgent transfer to a new supplier, or the invoice from a genuine supplier with the IBAN altered after months of reading their correspondence, are prosecuted as fraud with the aggravating circumstances of article 250 because of the amount, and they also open a civil dispute over who bears the loss. The supplier maintains that it has not been paid, the customer that it paid the invoice it was sent, and the answer depends on whose email account was compromised and what checks each party made before paying.
The employee who clicked the link or made the transfer is in a more protected position than feared. Disciplinary dismissal under article 54 of the Workers’ Statute requires a serious and culpable breach, and following a plausible email in a company that did not train its staff and had no double-verification protocol for payments rarely amounts to one. A company wishing to pass the loss on to the employee would have to prove negligence going far beyond having been deceived.
If the stolen credentials gave access to data on customers, employees or patients, the company has a security breach and the obligations of the General Data Protection Regulation. Article 33 requires it to be notified to the Spanish Data Protection Agency within seventy-two hours of becoming aware of it, unless it is unlikely to result in a risk, and article 34 requires it to be communicated to the data subjects when the risk to them is high. Failure to notify is sanctioned independently of the phishing. The impersonated company, the one whose brand appears in thousands of text messages, can demand that the hosting provider take down the fake page, under the liability regime set by Law 34/2002 on information society services, and can file a complaint even though it has not lost a euro, because the harm to its customers and its name is its own.
Reporting phishing in A Coruña, the competent court, the perpetrator abroad and the limitation period
The complaint is filed at any National Police station, Guardia Civil post or duty court, and in cases involving several transactions or large amounts, by way of a criminal complaint (querella) drafted by a lawyer, which allows the investigative measures that a police report does not request to be sought from the very first filing. Territorial jurisdiction follows the ubiquity principle applied by the Supreme Court, the offence is deemed committed in any place where an element of it took place, and the place where the victim received the message and holds the account from which the money left is one of them. A resident of A Coruña reports in A Coruña even if the server sits on another continent, and need not accept being referred to another province.
The perpetrator being outside Spain closes nothing by itself. The Budapest Convention on Cybercrime, ratified by Spain, is the framework through which Spanish courts ask other countries to identify account holders and servers, and the groups running mass smishing almost always have mule accounts and collaborators in Spain, which is where the investigation advances. What does expire is the evidence. Telecom operators keep communications traffic data for twelve months under Law 25/2007, only a judge can request it, and after that period the text message can no longer be traced to its origin. That is the real urgency, above any other.
The limitation period is set by article 131 of the Criminal Code according to the maximum sentence. Basic fraud is time-barred after five years, aggravated fraud under article 250 after ten and the minor offence under 400 euros after one year. In a continuing offence the period runs from the last charge.
Reporting with a lawyer is worthwhile when there are transfers or several transactions, when the bank has refused the refund or when, besides the money, accounts or documents have been taken with which the fraudsters can keep acting in your name. It is not worthwhile for a 2.99-euro charge the bank has already refunded, and in that case a police report is enough to leave a record and feed the investigation of the campaign.
The mule account, whoever receives the phishing money and article 301
At the other end of every transfer there is a Spanish account in someone’s name. Sometimes it is an account opened with the identity card of another phishing victim. Often it belongs to a real person who accepted a “job” consisting of receiving money and forwarding it for a commission, or who lent their account to an acquaintance. That person is the mule, and their criminal position is serious. The courts convict them of money laundering under article 301, in its negligent form under paragraph 3 when knowledge of the origin is not proven, with six months to two years in prison and a fine, and of intentional laundering or participation in the fraud when it is. Anyone who has received an unexpected deposit together with a request to forward it must not move that money, must inform the bank and must speak to a lawyer before giving a statement to the police, because what is said in that first statement fixes their position for the rest of the proceedings. The criminal defence in these cases is conducted from that first moment, and on the criminal law page we explain how.
Case dismissed without an identified perpetrator, what stays open and the call that will come afterwards
If within a few months the court does not identify the perpetrator, it will order a provisional dismissal under article 641 of the Criminal Procedure Act. It is not an acquittal and it does not close the case for good. It is reopened when the perpetrator appears, which happens frequently because the same people are behind hundreds of complaints and an arrest in another province links up with yours if your complaint properly identifies the number, the destination account and the date. The claim against the bank does not depend on that outcome and follows its own course.
What does arrive after the dismissal, sometimes with a copy of the complaint in hand, is the call from a supposed fund recovery company or a fake lawyer who claims to have located your money and asks for an advance payment. It is the second fraud, built on the list of victims of the first. No law firm and no authority locates money and calls the victim to ask for a payment up front.
The complaint with the message and the statement, the step to take now and who takes it
If you have reached this point with a charge or a transfer you do not recognise, the step to take now is the complaint with the full message, the statement showing the transaction and the time the card was blocked, filed before operators and banks stop retaining what makes the trail traceable, together with the claim against the institution filed in the order that does not prejudice the complaint. That filing is drafted by the lawyer, because what is requested in it is what the court will investigate. At the firm we act for victims of phishing and computer fraud in A Coruña and throughout Galicia, with the criminal complaint and the bank claim handled together. You can see what we do on the cybercrime page and put your case to us on +34 677 841 007 or through the contact form. We reply as promptly as we can.
Frequently asked questions
What is phishing and how is it pronounced?
Phishing is the sending of emails, text messages or calls that impersonate a company or public body in order to steal passwords, bank details or identity documents. It is pronounced exactly like “fishing”, from which it takes its name, with the “ph” inherited from the jargon of the first telephone hackers. In Spain the English term is used, although the law prosecutes it as fraud.
What is phishing and what does it mean?
It literally means “fishing” for data. The fraudster sends thousands of messages identical to those of a bank, the postal service, the tax authority or a social network, with a link to a copied page where the victim enters their credentials or card. With that data payments and transfers are made or the accounts are taken over. In Spain that conduct is fraud under articles 248 and 249 of the Criminal Code.
What does it mean to be phished?
Being phished means you have entered details on a fake page or given them over the phone believing you were dealing with a real institution, and that those details are now in a fraudster’s hands. It does not necessarily mean you have lost money. You need to block the card, change passwords from another device and keep the message, because it is the evidence for the complaint and for the claim against the bank.
What is phishing and how do you identify it?
It is identified by a short deadline, a serious consequence if you do not act, a request your bank or a public body never makes through that channel, the full password, a transaction code or a photograph of your identity card, and a link whose domain, the part just before the first slash, differs from the official one. Good spelling no longer rules anything out. When in doubt, log in through the app and not through the link.
Is phishing a crime in Spain and what is the penalty?
Yes. It is fraud under articles 248 and 249 of the Criminal Code, punished with six months to three years in prison when the stolen data is used to make a transfer or a charge, and with one to six years under article 250 if it exceeds 50,000 euros or affects many people. If the fraudster only logs into your accounts without moving money, it is unlawful access under article 197 bis, punished with six months to two years in prison.