Fraud and cyberfraud: the criminal law framework for corporate fraud

The classic image of the ‘stamp scam’ is now a thing of the past. The digital world has paved the way for organised economic crime, and today its primary target is businesses: they hold cash reserves, process payments on a daily basis, work with dozens of suppliers and rely on employees who, with a single email, can transfer hundreds of thousands of euros.

Spanish courts have already heard cases involving fraud amounting to nearly 5 million euros against an automotive subsidiary (SAP Madrid, Section 18, 28/2022, 27 January) and nearly 22 million euros against a pharmaceutical plant (STSJ Catalonia 4477/2023, 10 July). This is therefore not a minor risk, but a threat that directly affects business continuity.

Before delving into the practical aspects – how companies are targeted, how to protect oneself and what happens with the bank; all of which we will cover in the next post – we must first consider the theory. As we shall see, some of these theoretical issues may ultimately determine whether the company is regarded as a victim or whether it is blamed for failing to protect itself. This is, therefore, the first in a series of articles in which we shall lay the foundations to which we shall return in subsequent instalments.

1. The classic fraud under Article 248 of the Criminal Code

Article 248 of the Criminal Code provides that fraud is committed by “anyone who, with the intention of making a profit, uses deception sufficient to mislead another person, inducing them to carry out an act of disposal to their own detriment or that of another”, punishable by a prison sentence of between six months and three years. In determining the sentence, account is taken of the amount defrauded, the financial loss caused, the relationship between the victim and the fraudster, and the means employed.

Case law breaks down the offence into a sequence of elements that must occur in succession:

• Deception, understood in the broadest sense, given the unlimited variety of scenarios encountered in real life, which may consist of the offender’s “scheming, fallacy, falsehood, sophistry, ruse, bait, trick or enticement” (Supreme Court Judgment of 20 March 1985). The deception must be:
  • Antecedent[1] : it must exist prior to the act of disposal. Otherwise, it is not fraud, but a simple breach of contract.
  • Sufficient: it must be capable of causing the error, which requires an assessment of adequacy, relevance and suitability.
  • Causal: the loss must be capable of being explained precisely as the realisation of the unlawful risk created by the deception.
• A mistake on the part of the victim, resulting from that deception.
• An act of disposal of assets carried out by the deceived party, which causes the loss[2] .
• Intent to profit on the part of the perpetrator.

Furthermore, the perpetrator must act with intent, that is to say, with the knowledge and intention to deceive and to cause the loss.

The structure of fraud is that of a self-inflicted offence: it is the victim themselves, having been deceived, who carries out the act of disposing of their assets that causes them harm (Supreme Court Judgment 1036/2003, of 2 September). In fraud, the perpetrator does not directly target another person’s assets: they use deception to manipulate another person’s will and exploit it as a means of causing harm.

In the business sphere, this logic explains a particularly significant form of fraud: the criminalised legal transaction, in which the perpetrator feigns a genuine intention to enter into a contract when, in reality, they merely seek to take advantage of the other party’s performance. Supreme Court Ruling 265/2014 of 8 April illustrates this with the classic ‘Nazareno scam’: the fraudster gains the company’s trust through small orders which they pay for promptly, using a solvent front, only to subsequently place an order of much greater value which they never pay for.

Deception alone is sufficient: when the victim is a business

‘Sufficient deception’ is, in practice, the usual battleground, and here the fact that the victim is a business takes on particular significance. Case law is more demanding of businesses than of consumers: the status of a business owner ‘raises the standard required under the principle of personal liability’ (Supreme Court Judgment 449/2004, of 2 April). Deceptions that would suffice against a consumer may not suffice against a business, as is the case with a bank that grants a loan without carrying out the simple credit checks that were within its reach.

However, not every oversight leaves the fraudster unpunished. The decisive factor is whether the deception was such as to circumvent the precautions one would expect from a diligent business, and the Supreme Court considers that deception that is ‘not sufficient’ is exceptional (Supreme Court Ruling of 21 September 2023): if it succeeded in causing the victim to part with their assets, it will normally be because the deception was effective. To put it another way, there will be no sufficient deception if it is so crude that anyone could detect it (such as Victor Lustig selling the Eiffel Tower).

The practical implication is clear. A well-orchestrated CEO fraud, involving plausible impersonations and authentic-looking documentation, is unlikely to constitute ‘insufficient’ deception. However, a company that neglects even the most basic controls leaves itself open to challenge by the defence, and that is yet another reason to ensure internal protocols are strictly followed.

Deceived and aggrieved: they need not be the same person

A key point to understand corporate fraud: the person deceived and the person harmed need not be the same. Fraud also occurs when the perpetrator induces an employee, a manager, etc., to act to the detriment of their principal. And the deception does not even have to be direct: the fraudster can use other people to convey the deceptive message. This is precisely the structure of CEO fraud: the treasury employee is deceived, but it is the company that suffers the loss.

Fraud by omission

It is not necessary to lie explicitly. There is extensive case law on fraud cases in which the perpetrator deceives the victim by omitting information relevant to the transaction that they were obliged to disclose. A classic example is a wholesaler who sells a consignment of meat to a retailer whilst knowing that it is spoiled. However, the omission only constitutes fraud if it induces the victim to part with their property; failing to remedy damage caused without intent does not fall within the scope of this criminal offence.

2. Computer fraud under Article 249 of the Criminal Code

What happens when there is no one to deceive? Computer fraud arises from that question. The offence “is intended to protect assets against actions that do not fit the typical pattern” of fraud, “as they are not directed against a person who could be misled”: electronic devices behave in accordance with their programming (Supreme Court Judgment 860/2008, of 17 December).

Following the reform introduced by Organic Law 14/2022 of 22 December, the offence — previously set out in Article 248.2 of the Criminal Code — is now set out in Article 249 of the Criminal Code, which imposes the same penalty of six months to three years’ imprisonment[3] :

• 249.1.a): those who, with the intention of making a profit, “by unduly obstructing or interfering with the operation of an information system, or by unduly entering, altering, deleting, transmitting or suppressing computer data, or by making use of any other form of computer manipulation or similar device, bring about an unauthorised transfer of any asset to the detriment of another”.
• 249.1.b): those who fraudulently use cards or “any other tangible or intangible payment instrument other than cash, or the data contained therein”.
• 249.2 and 3: those who manufacture, possess or supply to third parties programmes, devices or data designed to commit such frauds, or who acquire or traffic in payment instruments obtained unlawfully.

The difference from traditional fraud is substantial:

• “Deception is no longer a fundamental element, nor is its presence essential”, but is instead replaced by prohibited schemes (Supreme Court Judgment 137/2020, of 8 May).
• Nor is there any mistake or relationship between individuals: the act “is carried out directly on the computer programme, which operates, without error, according to the information supplied to it” (SAP Zaragoza, 6th Section, 234/2024, of 4 June).
• What is relevant is that the machine “acts in response to an unlawful act”, and it makes no difference whether the perpetrator modifies the programme or “uses it without due authorisation or in a manner contrary to duty” (Supreme Court Judgment 860/2008, of 17 December).

For example, accessing the company’s online banking system using stolen login details constitutes computer manipulation that falls within the scope of this offence.

3. The key question: who orders the transfer?

In light of the above, the practical distinction between the two offences boils down to one question: who orders the transfer?

• If it is a deceived employee who carries it out, believing they are obeying their boss or paying a supplier, we are dealing with the scenario set out in Article 248 of the Criminal Code: there is a person misled into acting to the detriment of the company.
• If it is the offender who, using illegally obtained credentials, operates directly via online banking, the conduct falls under Article 249 of the Criminal Code: no one is deceived at the time of the transaction (even if they were deceived into providing the passwords), but rather a system has been manipulated.

4. Common consequences

Having distinguished between these two offences, there are issues that are of practical importance to any victimised company:

• Aggravating circumstances based on the amount involved. Both offences share the aggravating circumstance set out in Article 250.1.5º of the Criminal Code — imprisonment for one to six years and a fine of six to twelve months’ worth — when the amount defrauded exceeds 50,000 euros, a threshold that is easily exceeded in a business context. They also share the aggravated penalty under Article 250.2 of the Criminal Code if the amount defrauded exceeds 250,000 euros — imprisonment for four to eight years and a fine of twelve to twenty-four months.
• Aggravating circumstance due to abuse of business credibility. Furthermore, Article 250.1.6 of the Criminal Code imposes an aggravating circumstance on both offences where the perpetrator exploits their “business or professional credibility”. This covers frauds carried out under the guise of an audit firm, a law firm or a trusted supplier.
• The company may also find itself in the dock. Since the enactment of Organic Law 5/2010, Article 251 bis of the Criminal Code provides for the criminal liability of legal persons for these offences, with fines ranging from double to five times the amount defrauded. However, this applies only when the offence is committed for the company’s benefit and under the conditions set out in Article 31 bis of the Criminal Code. Thus, a company whose directors or employees commit fraud for its benefit may find itself on the receiving end of legal proceedings: hence the importance of compliance.
• The ‘mules’ are also held accountable. Organisations that commit these frauds rarely receive the money directly. To this end, they use so-called ‘money mules’: the holders of the destination accounts who, once the funds have been obtained, are responsible for transferring them to a country that guarantees impunity, or converting them into cash, cryptocurrencies or other means designed to conceal the money’s destination. Their criminal liability depends on what can be proven regarding their knowledge and their relationship with the perpetrators:
  • If it is established that they acted in concert with those who obtained the login details or devised the deception, or that they at least assumed their account would be used for fraud, they will be held liable as necessary accomplices or accessories to the fraud (Supreme Court Ruling 815/2024, of 26 September). The fact that the account was opened specifically to receive the money is a significant indication of such intent, as stated in the Madrid Provincial Court of Appeal, Section 4, Judgment 121/2024 of 30 April.
  • If such prior collaboration with the fraudsters cannot be proven — for example, because the account already existed before the events took place and there is nothing else linking it to the initial fraud — but if they subsequently concealed or moved funds whose illicit origin they knew or ought to have suspected, they may be held liable for the offence of money laundering, whether committed with intent or through negligence (Supreme Court Judgment 506/2015, of 27 July; Madrid High Court Judgment 186/2025, of 29 April).

The key point is that, as the principal perpetrators usually operate from other countries and are difficult to identify, the ‘mules’ are often the only ones to stand trial. For the victim company, tracking them down may be the most realistic way of securing a conviction and claiming civil liability.

5. Conclusion

Fraud under Article 248 of the Criminal Code and computer fraud under Article 249 of the Criminal Code involve different structures. However, the objective is the same: to unlawfully appropriate another person’s assets.

Having laid the groundwork, in our next publication we will move on to the practical aspects: how cybercriminals target businesses — CEO fraud, BEC, phishing, vishing and smishing — and what specific measures can be taken to protect against them.

At Ayuela Jiménez, we have lawyers specialising in Economic Criminal Law and Criminal Compliance who advise companies on both fraud prevention and how to respond to it. Should you have any queries or encounter an incident, having an expert team on hand makes all the difference.

[1] The requirement for prior deception has an important nuance in the case of long-term commercial relationships, such as a supply contract involving regular payments: even if there was no deception at the time of signing, if it arises at a later stage and induces the other party to continue making payments, fraud may have taken place.

[2] Where the loss does not exceed 400 euros, the offence is a minor offence punishable by a fine equivalent to one to three months’ earnings.

[3] Under Article 249 of the Criminal Code, there is no €400 threshold for the offence to be classified as a minor offence. Regardless of the amount involved, there is no such thing as a minor offence of computer fraud (Supreme Court Judgment 565/2026 of 25 September).