Computer Fraud under Article 249.1 a) of the Criminal Code: Structure of the Offence, Autonomy and Liability of the “Money Mule”

Summary. Computer fraud (estafa informática) is defined as a form of property fraud that dispenses with sufficient deception, error and an act of disposal by a person. Following LO 14/2022 (Organic Law 14/2022), Article 249.1 a) CP (Código Penal, the Spanish Criminal Code) describes it in terms taken from Directive (EU) 2019/713. This study sets out the objective and subjective elements of the offence, analyses the rules on perpetration and participation that apply to the person who provides the destination account for the funds (the “money mule”, or mulero) and distinguishes that conduct from money laundering and from concealment of offenders (encubrimiento).

I. Legislative development and place in the Criminal Code

Until the 2022 reform, computer fraud was governed by Article 248.2 a) CP, which deemed guilty of fraud those who, “for profit, and using some computer manipulation or similar artifice, obtain the non-consented transfer of any asset to the detriment of a third party”.

LO 14/2022 of 22 December, in force since 12 January 2023, moved the offence to Article 249.1 a) and reworded it as follows:

“Those who, for profit, by unduly hindering or interfering with the functioning of an information system, or by unduly introducing, altering, deleting, transmitting or suppressing computer data, or by using any other computer manipulation or similar artifice, obtain a non-consented transfer of any asset to the detriment of another.”

The conduct carries the same penalty as the basic offence: imprisonment of six months to three years. The legislature retains the phrase “are also deemed guilty of fraud”. The Sala Segunda (the Criminal Chamber of the Tribunal Supremo, Spain's Supreme Court) infers from this wording that treating the conduct as fraud is a legislative choice, not the result of any structural identity between the two. Article 249 CP also governs other forms of the offence:

• Art. 249.1 b): fraudulent use of cards or other non-cash payment instruments.
• Art. 249.2: acts that were previously, to a large extent, unpunished preparatory acts, such as manufacturing or supplying means specifically designed for these frauds, or stealing, misappropriating or unlawfully acquiring payment instruments.
• Art. 249.3: possessing unlawfully obtained instruments or making them available to others.

The change is not merely one of numbering. LO 14/2022 abolished the minor offence (delito leve) of computer fraud and of fraudulent use of payment instruments, so that the amount defrauded, even if it does not exceed €400, does not downgrade the offence to a minor offence (STS 2032/2026, following Consulta 1/2024 of the FGE — the Fiscalía General del Estado, Spain's Attorney General's Office). The basis for this is Directive (EU) 2019/713, Article 9 of which requires custodial penalties with a maximum term of not less than two years for the conduct covered by Articles 3, 4 a) and b) and 5 a) and b), and of not less than three years for fraud related to information systems under Article 6, which is the model for Article 249.1 a) CP.

II. Protected legal interest

The protected legal interest is property (patrimonio), and the offence is structured as a result offence. The Directive and the case law of the Tribunal Supremo add a supra-individual dimension: confidence in the use of means of payment and the proper functioning of the financial system and of the digital market. That dimension chiefly explains the endangerment offences in paragraphs 2 and 3 of Article 249, but it also shapes the teleological interpretation of paragraph 1.

III. Objective elements of the offence

1. Perpetrator and victim

This is a general offence (delito común): anyone can commit it. The victim (sujeto pasivo) is the owner of the property harmed (“to the detriment of another”), who need not be the same person as the one who actually suffers the manipulation of the system. Where the perpetrator and the injured party are one and the same, the offence is not committed.

2. Prohibited conduct

Article 249.1 a) sets out three alternative forms of conduct:

1. Unduly hindering or interfering with the functioning of an information system.
2. Unduly introducing, altering, deleting, transmitting or suppressing computer data.
3. Using any other computer manipulation or similar artifice, a residual catch-all clause.

The case law (SSTS 369/2007, 622/2013, 509/2018 and 838/2023, cited by the Audiencias Provinciales, Spain's provincial courts) has interpreted this clause broadly. Any fraudulent manoeuvre of a computer nature falls within “computer manipulation”. The “similar artifice”, for its part, does not require the manoeuvre to be computer-based: it may consist of a mechanical manipulation of electronic devices, because the similarity refers to the manipulation of the system, not to its computer nature. In short, any unlawful action on the system is sufficient, so that the machine operates in response to it: by altering its physical components, its programming or the data entered into it.

The reference to the undue nature of the interference or alteration operates as an element of unlawfulness built into the definition of the offence: authorised intervention, consented to by the person with power of disposal, falls outside the offence.

3. Absence of deception, error and an act of disposal

This is the distinguishing feature of the offence. Unlike Article 248 CP, it does not require sufficient deception, error on the part of another or an act of disposal by the person deceived. The action is directed not against a person capable of being induced into error, but against the system. Machines do not make errors in the sense of the classic offence: the program that governs them simply runs, and what matters is that it runs in response to unlawful action. The specific means (the manipulation or the artifice) replaces deception as the mechanism of the fraud.

This autonomy determines the boundary with the basic offence:

• If it is the victim who, induced into error by a deception capable of misleading them, orders the transfer, there is an act of disposal and the conduct falls under Article 248 (with any aggravating circumstances or concurrence of offences that may apply, for example with document forgery).
• If the asset leaves the victim's property without the victim ordering it, through a manipulation of the system, the conduct falls within Article 249.1 a).

4. Result: a non-consented transfer

The offence requires the perpetrator to obtain a transfer with three features:

• It must not be consented to by the person entitled to consent.
• Its object must be an asset capable of being transferred. The breadth of the wording (“any asset”) and Article 6 of the Directive, which refers to money, monetary value and virtual currencies, make it possible, in our view, to include crypto-assets.
• It must cause loss to a person other than the perpetrator.

Since this is a result offence, its completion requires the transfer to take place. If the perpetrator carries out the manipulation but it does not culminate in a transfer for reasons beyond their control, the conduct will be punishable as an attempt (Article 16.1 CP). This view follows from the structure of the offence; we have not checked it against specific case law.

5. Causation and objective imputation

There must be a causal and normative connection between the manipulation or artifice and the transfer. The transfer must be a consequence of the manipulation, and the risk created by the manipulation must materialise in the result. Subsequent acts of distributing or forwarding the funds come, in principle, after completion and are relevant to the exhaustion of the offence (agotamiento), to civil liability and to the legal classification of those who take part in them (see Section V).

IV. Subjective elements of the offence

1. Intent (dolo)

Fraud, in any of its forms, is an intentional offence. This follows from Article 10 CP and from Article 12 CP, under which negligent acts or omissions are punished only where the law expressly so provides, which is not the case in Article 249. The case law stresses that the express requirement of a profit motive rules out liability for negligence.

Intent comprises knowledge of the objective elements of the offence and the will to bring them about. In this offence, it means that the perpetrator knows that they are acting unduly on a system or on data, that the transfer is not consented to and will cause loss to another, and that they want that transfer to occur. Intent must precede or accompany the conduct: dolus subsequens (intent formed after the act) is not covered by the offence.

A mistake as to an element of the offence (Article 14.1 CP) excludes intent; if the mistake is unavoidable, it excludes criminal liability, and if it is avoidable, the conduct would only be punishable if there were a negligent form of the offence, which there is not here. Consequently, in the forms covered by Article 249, a mistake as to an element of the offence (error de tipo), whether avoidable or unavoidable, means that the conduct does not constitute the offence under Article 249. A mistake as to the unlawfulness of the act (Article 14.3) is a different matter: it only reduces the penalty if it is avoidable.

2. Profit motive (ánimo de lucro)

This is a subjective element of wrongfulness (elemento subjetivo del injusto) expressly required by the offence. It is understood as the aim of obtaining, for the perpetrator or for a third party, a financial advantage corresponding to, though not necessarily equivalent to, the loss caused. The profit need not actually materialise.

3. Summary of the elements

V. Perpetration and participation: the “money mule”

1. Definition

A “money mule” (mulero) is a person who, in return for payment or for some other motive, makes their bank account or another means available to others to receive, hold or forward funds derived from a fraud, either so that they reach the actual perpetrator or to make them harder to trace. The term is not in itself a basis for a charge (título de imputación): what matters is at what point and with what knowledge the person intervenes, because their legal classification depends on it.

2. Necessary cooperation (Art. 28 b CP)

Those who “cooperate in its commission by an act without which it would not have been carried out” are regarded as perpetrators. The necessary cooperator (cooperador necesario) does not perform the act described in the offence, but contributes to the commission of another person's criminal act. The case law applies that provision to anyone who, before completion, provides the destination account into which the money taken without consent is paid, provided that their contribution is essential “according to the perpetrator's plan” and that they acted with intent (STS 51/2026).

The consequence is significant: Article 28 b) treats such a person as a perpetrator for sentencing purposes, so they do not benefit from the one-degree reduction that Article 63 CP provides for accomplices (Article 29 CP: those who cooperate through prior or simultaneous acts without being indispensable). The criterion for distinguishing between the two is the essential nature of the contribution, assessed in the specific case and ex ante.

3. Alternative charge: money laundering

Where the recipient intervenes once the fraud has been completed, in relation to assets already obtained, the conduct may fall under Article 301.1 CP, which punishes anyone who “acquires, possesses, uses, converts or transfers assets, knowing that they originate in a criminal activity committed by them or by any third person, or performs any other act to conceal or disguise their unlawful origin”. The penalty is imprisonment of six months to six years and a fine of one to three times the value of the assets.

Article 301.3 CP provides for money laundering committed through gross negligence, punishable by imprisonment of six months to two years and a fine of one to three times that value. No such possibility exists for fraud. Hence the importance of the charge chosen: a person who acts without intent, but with gross negligence, can only be liable for negligent money laundering, never for fraud.

4. Concealment of offenders (Art. 451 CP)

Article 451.1.º punishes anyone who, with knowledge that an offence has been committed and without having taken part in it as principal or accomplice, helps the principals or accomplices to benefit from the proceeds of the offence without any personal profit motive. A personal profit motive, or involvement as a cooperator, excludes this offence and shifts the conduct towards the offences discussed above.

5. Distinguishing criteria

Where the same conduct may fall under two offences, the relationship between them should be resolved either as a concurrence of provisions (concurso de normas) under Article 8 CP, applying the principles of speciality, subsidiarity and consumption, or as a concurrence of offences (concurso de delitos) under Article 77, depending on whether or not the wrongfulness of one exhausts that of the other. This question is disputed in practice and should be raised in the written submissions on the legal classification of the facts.

VI. Proving the subjective element

Knowledge and will are internal facts which, absent a confession, can only be proved by circumstantial evidence (prueba indiciaria). The case law of the Tribunal Supremo and of the Tribunal Constitucional (Spain's Constitutional Court), reiterated in recent rulings, requires:

• That the reasoning rest on several basic facts that have been proven.
• That those facts reinforce one another.
• That the inference be reasonable and set out in the judgment.

This does not exclude other versions of the facts, but it does exclude reliance on a weak, inconsistent or excessively open inference. Review on cassation is limited to verifying that the incriminating evidence is adequate and sufficient and that the inference does not contradict the rules of logic or the maxims of experience.

In relation to a person who provides an account, the courts treat the following, among others, as indicators:

• The absence of any reason or activity explaining the incoming payments.
• The disproportion between the volume of transactions and the declared activity.
• Fictitious payment references or false descriptions of the transactions.
• The immediate disposal of the funds, their onward transfer or their splitting into smaller amounts.
• The receipt of payment in return.
• Explanations that are inconsistent or undocumented.
• The recent opening of the account or its use exclusively for that flow of funds.

None of these is decisive on its own. It is the convergence of several of them, together with the lack of a plausible alternative explanation backed by documentary evidence, that allows knowledge of the unlawfulness to be inferred. The case law has found intent on the part of a person who agrees to receive a significant sum which, in the circumstances, could reasonably be linked only to criminal activity, it being probable and foreseeable that it came from a fraud (STS 51/2026). The wording is reminiscent of dolus eventualis (dolo eventual), but the Chamber does not expressly classify it as such.

VII. Sentencing consequences

• Basic penalty: imprisonment of six months to three years (Article 249.1).
• Aggravation based on the amount: Article 250.1.5.º CP raises the penalty to imprisonment of one to six years and a fine of six to twelve months where the value of the fraud exceeds €50,000 or it affects a large number of people. If it exceeds €250,000, Article 250.2 provides for imprisonment of four to eight years and a fine of twelve to twenty-four months.
• Continuing offence (Article 74 CP): where there are several acts carried out in execution of a preconceived plan or taking advantage of the same opportunity, the penalty for the most serious offence is imposed in its upper half, and may be raised to the lower half of the penalty one degree higher. In property offences, the total loss caused is taken into account (Article 74.2).
• Mitigating circumstances: in particular, extraordinary and undue delay under Article 21.6.ª CP. Where it is found to be highly qualified (muy cualificada), Article 66.1.2.ª allows the penalty to be reduced by one or two degrees.
• Transitional law: Article 2.2 CP applies, giving retroactive effect to criminal laws that favour the defendant. The comparison must be made between the two versions of the law in their entirety, looking at the specific penalty that would result in each case. Where the penalty does not change, some Audiencias Provinciales apply the law in force at the time of the events (for example, SAP Málaga 1198/2025).
• Civil liability: co-perpetrators and necessary cooperators are jointly and severally liable with one another for the shares determined (Article 116.2 CP).

VIII. Procedural aspects

In cassation, challenges to the legal subsumption of the facts are brought under Article 849.1.º LECrim (the Ley de Enjuiciamiento Criminal, Spain's Criminal Procedure Act), on the ground of infringement of law (infracción de ley), which requires the facts found proven to be respected. Arguments concerning the assessment of the evidence are channelled, where appropriate, through Article 852 LECrim (presumption of innocence). An error of fact under Article 849.2.º requires a document that is conclusive on its face (documento literosuficiente) and demonstrates the trial court's mistake without being contradicted by other evidence. Where the appeal can only be based on Article 849.1.º (Article 847.1 b LECrim), procedural arguments are excluded. If the appeal is dismissed, the costs are imposed on the appellant (Article 901 LECrim).

IX. Conclusions

1. Computer fraud under Article 249.1 a) CP is an autonomous result offence that dispenses with deception, error and an act of disposal by a person; its core is the manipulation of the system, or a similar artifice, that brings about a non-consented transfer.
2. The subjective element requires intent and a profit motive. There is no negligent form of the offence, so a mistake as to an element of the offence always means that the conduct falls outside it.
3. Since LO 14/2022, the amount involved can no longer reduce the conduct to a minor offence, in line with Directive (EU) 2019/713.
4. A person who provides the destination account before completion, with intent and in a manner essential to the perpetrator's plan, is liable as a necessary cooperator and not as an accomplice (Art. 28 b CP).
5. If they intervene after completion, the classification shifts to money laundering (Art. 301 CP), which can be committed through gross negligence, or, where there is no personal profit motive, to concealment of offenders (Art. 451.1.º CP).
6. Knowledge is proved by circumstantial evidence. The defence should focus on offering a plausible, documented alternative explanation and on contesting the charge, the degree of participation and the mitigating circumstances.

Legislation and case law cited

Legislation: LO 10/1995 (CP), Articles 2, 8, 10, 12, 14, 16, 21.6.ª, 28, 29, 63, 66, 74, 77, 116, 249, 250, 301 and 451; LO 14/2022 of 22 December; LECrim, Articles 847, 849, 852 and 901; Directive (EU) 2019/713 of 17 April 2019, Articles 6, 8 and 9.

Decisions: STS 51/2026 of 28 January 2026; STS 2032/2026 of 22 April 2026; SAP Málaga 1198/2025 of 12 March 2025 (which cites STS 838/2023 and SSTS 622/2013 and 369/2007).

This article is for information purposes only and is no substitute for legal advice on a specific case.

Are you under investigation for lending your bank account or for computer fraud? Contact the firm for an initial confidential assessment of your case.

Dr. Álvaro Heredia Lara. Criminal lawyer, member no. 10.846 of the Ilustre Colegio de Abogados de Málaga (Málaga Bar Association).