Online identity theft: what offences it involves and how to react

Discovering that someone has created a fake profile with your name and photos, that they are using your identity to deceive others, or that they have accessed your accounts to act on your behalf is a disturbing experience. Online identity theft is one of the fastest-growing forms of digital crime and one of those that can cause the most personal, reputational and financial harm.

Online identity theft consists of the unauthorised use of another person’s identity in the digital environment. It can take very diverse forms: the creation of fake profiles on social media, unauthorised access to the victim’s real accounts, sending messages while posing as them, contracting products with their data or publishing content in their name.

A peculiarity of the Spanish criminal framework is that there is no specific offence called identity theft: the conduct may give rise to different criminal offences depending on the case. If the impersonation involves unauthorised access to the victim’s accounts, there may be an offence of discovery and disclosure of secrets under Article 197 of the Criminal Code; mere unauthorised access already constitutes a punishable act, even if nothing is published. Article 401 defines the usurpation of civil status, which case law has extended to certain online situations when the impersonation is serious and sustained.

If the impersonation is used to obtain an economic benefit by deceiving third parties, an offence of fraud is present. If false content is published that damages the victim’s reputation, insult or slander may apply. If it is part of a campaign of repeated harassment, the offence of stalking under Article 172 ter may apply. And if it involves the dissemination of intimate images without consent, Article 197.7.

Faced with impersonation, one must act quickly and methodically. The first thing is to document everything before the evidence disappears: screenshots of the fake profile, the messages and the content, noting the URLs and, if possible, drawing up a notarial record. Then it is advisable to report the profile to the platform, but always after having documented the evidence, because its removal could make it disappear.

Next, one must file a complaint with the police, preferably with units specialising in technological crime, providing all the documentation. If the impersonator has contacted people in the victim’s circle while posing as them, it is advisable to inform them as soon as possible to prevent them from continuing to be deceived. And if the real accounts have been accessed, all passwords must be changed immediately and two-factor authentication enabled.

Identifying the impersonator can be difficult, because they may operate with a degree of anonymity using made-up data and connections that mask their IP. But anonymity on the internet is more limited than it seems: platforms keep connection logs that the police can request with judicial authorisation, and forensic analysis can reveal the IP from which the profile was created. When the impersonator is someone in the victim’s circle, the investigation is usually faster. In any case, the formal complaint is the mechanism that triggers the investigation with the appropriate legal means.