Identity Theft and Phishing in Spain: How to Protect Yourself and Your Rights

Identity Theft in Spain: Criminal Law and Legal Protection

Identity theft – unauthorized use of another person's personal data – is covered by several criminal provisions in Spain: Art. 197 CP (privacy violation), Art. 248 CP (fraud) and Art. 401 CP (document offences).

Typical Phishing Scenarios

• Smishing: Fake SMS allegedly from banks, AEAT (tax authority) or Correos
• Vishing: Phone calls where perpetrators pose as bank staff
• Email phishing: Imitation of real websites (banks, PayPal, Amazon)
• SIM swapping: Taking over a phone number to control SMS authentication codes

Legal Consequences for Perpetrators

| Offence | Article | Penalty | |---|---|---| | Identity usurpation | Art. 401 CP | up to 3 years imprisonment | | Computer fraud | Art. 248.2 CP | 6 months to 3 years | | Privacy breach | Art. 197 CP | 1–4 years |

What Should Victims Do Immediately?

1. Notify bank and creditors: Freeze accounts, request credit monitoring
2. Contact INCIBE (National Cybersecurity Institute): Helpline 017
3. File a criminal complaint: At Policía Nacional (BCIT brigade)
4. Notify credit agencies: Equifax, Experian, ASNEF
5. Consult a lawyer: Especially when financial damage is involved

Damages in Criminal Proceedings

As private prosecutor (Acusación particular) I can simultaneously claim compensation within criminal proceedings.

Conclusion

Identity theft causes long-lasting damage. Act quickly and seek legal advice.