Fraud in Spain: A Complete Legal Guide for International Businesses and Professionals

Anti-fraud Law in Spain, Penalties, Reporting, Crypto and Investment Fraud Regulation, and Prevention Strategies under Spanish Law

Fraud in Spain has escalated dramatically in recent years, with billions of euros lost annually to scams, cybercrime, and tax evasion schemes—losses equivalent to roughly 0.5% of the country’s GDP. Cybercrime now accounts for one in every five registered criminal offences, online fraud attacks on Spanish banks have surged by triple digits, and international criminal networks are increasingly targeting the Spanish market with sophisticated investment and cryptocurrency schemes. For international businesses and professionals operating in Spain, understanding the fraud landscape is no longer optional—it is a strategic imperative. This guide provides a comprehensive overview of how fraud works under Spanish law, the key types and trends you must be aware of, the anti-fraud regulatory framework (including Law 11/2021), penalties, where and how to report fraud, and the practical steps your business can take to stay protected and compliant.

What Is Fraud Under Spanish Law?

Under the Spanish Penal Code, fraud is legally referred to as estafa and is regulated in Title XIII, Chapter VI, beginning at Article 248. In its simplest terms, estafa occurs when an individual or entity uses deception to induce another party into making a financial disposition that results in a loss for the victim and a gain for the perpetrator. Unlike some jurisdictions, Spanish law does not provide a closed or exhaustive list of what constitutes fraudulent conduct. Instead, courts assess each case on its merits, which makes judicial interpretation—and therefore legal counsel—critical for businesses navigating this area.

For fraud to be established under Spanish criminal law, the following elements must be present:

• Precedent and concurrent deception: The deception must occur before and during the commission of the offence. It cannot be established retroactively.
• Sufficient elaboration: The deception must be convincing enough—objectively and in context—to cause a reasonable person to be misled. A transparently implausible claim would not qualify.
• Direct causal link: The victim’s financial loss must result directly from the deception. For example, the victim transferred money, signed a contract, or delivered goods specifically because of the fraudulent misrepresentation.
• Act of disposition: The victim must have performed a concrete act—such as a payment, asset transfer, or service delivery—that caused them actual economic harm.
• Profit motive (ánimo de lucro): The perpetrator must have acted with the intention of financial gain, whether for themselves or a third party.

Spanish jurisprudence, particularly rulings by the Supreme Court (Tribunal Supremo), has further refined these elements over decades. Notably, deception can take any form—spoken, written, gestural, or even through omission—as long as it is adequate to produce error in the victim considering the specific circumstances.

For international businesses, it is also worth understanding the fraud triangle framework, which explains the three conditions that typically enable fraud to occur within organisations: opportunity (weak internal controls, poor oversight), incentive (personal financial pressure, performance targets), and rationalisation (the perpetrator’s justification for their actions). Of these three, opportunity is the only factor a company can directly control—making robust compliance structures and internal controls your first line of defence.

If you or your business has been a victim of fraud in Spain—or you suspect fraudulent activity—time is critical. Lawants’ team of expert criminal, commercial, and civil fraud lawyers assists individuals and companies from all over the world in recovering defrauded assets, initiating criminal proceedings, and demanding maximum liability from fraudsters. Contact us now for immediate legal advice.

International Fraud

The number of scams and frauds committed is significantly increasing, especially in the world of cryptocurrencies. These kind of crimes cause […]

Read More… from International Fraud

Find out more

Most Common Types of Fraud in Spain

Fraud in Spain takes many forms, ranging from high-volume digital scams targeting individuals to sophisticated corporate and tax fraud schemes with cross-border implications. For international businesses and professionals, understanding these categories is essential for effective risk mitigation. Below is a breakdown of the most prevalent types.

Online Fraud and Cybercrime

Digital fraud is by far the dominant category, accounting for approximately 90% of all cybercrimes reported in Spain. The most common attack vectors include:

• Phishing, vishing and smishing: Criminals impersonate banks, delivery companies, public authorities or business partners through fraudulent emails, phone calls and text messages to obtain credentials or induce payments.
• Bank impersonation and payment-transfer fraud: Fraudsters pose as bank employees or trusted contacts and use social engineering to persuade victims to authorise transfers. Strong customer authentication may not prevent the fraud when the victim approves the transaction.
• Identity theft and account takeover: Stolen personal or corporate credentials may be used to access email, messaging and social-media accounts, commit financial fraud or impersonate company representatives.
• Fake websites and online marketplace fraud: Common schemes include fraudulent property listings, counterfeit e-commerce platforms and websites that imitate legitimate professional-service providers.

Investment and Cryptocurrency Fraud

Crypto-asset investment fraud represents a significant cross-border enforcement concern in Spain. These schemes frequently use fake trading platforms, social engineering, shell companies and multiple exchange accounts to obtain and transfer victims’ funds.

In June 2025, the Guardia Civil announced that Operation Borrelli had dismantled a network suspected of defrauding more than 5,000 victims in 30 countries of approximately €460 million, including €39 million from around 500 victims in Spain. Five suspects were arrested in Madrid and the Canary Islands.

In April 2025, another joint police operation led to six arrests over a fraudulent cryptocurrency investment scheme involving 208 victims and losses exceeding €19 million. The network used AI-manipulated videos of public figures to promote fake investments.

Spain also imposes specific tax-reporting obligations. Crypto-asset service providers may be required to report balances and transactions through Forms 172 and 173, while Spanish residents may have to report qualifying crypto-assets held abroad through Form 721. These obligations do not amount to general reporting of every cryptocurrency balance or holder.

Tax and VAT Fraud

Tax fraud represents a substantial challenge for Spain. According to estimates from the Ministry of Finance, tax fraud accounts for approximately 25% of Spain’s GDP—a figure that has driven the government to implement some of the most aggressive anti-fraud measures in Europe.

Key recent cases illustrate the scale of the problem:

• In July 2025, a €68 million VAT fraud scheme involving imported alcohol was dismantled by Spanish authorities.
• In early 2025, a luxury car VAT fraud ring led to 30 arrests.
• Off-the-books accounting facilitated by dual-use software (programmes that allow companies to maintain parallel accounting records) was so widespread that it became a primary target of Law 11/2021, which now prohibits such software entirely.

For international businesses, VAT compliance is a particularly sensitive area. Transnational fraud networks routinely exploit the complexity of cross-border VAT rules, and companies that inadvertently become involved in fraudulent supply chains may face severe legal consequences.

Corporate and Commercial Fraud

Businesses operating in Spain are exposed to several forms of fraud that directly target commercial operations:

• Corporate account manipulation: Under Articles 248 and 290 of the Spanish Penal Code, administrators who fraudulently modify accounts or alter documents reflecting a company’s economic and legal situation face criminal prosecution. The 2025 Penal Code reforms now allow directors to be held personally liable for compliance failures.
• Subsidy and grant fraud: In June 2025, a Spanish company and two of its representatives were convicted for a €3.8 million agricultural subsidy fraud—the first verdict delivered after a trial in a case investigated by the European Public Prosecutor’s Office (EPPO) in Spain. The defendants received prison sentences, fines of €3 million, and a three-year ban from public subsidies.
• Invoice fraud and man-in-the-middle (MITM) scams: Criminals intercept legitimate business communications—often email chains regarding payment instructions—and redirect funds to fraudulent accounts. This is a growing risk in B2B transactions.
• Money mule operations: Alarmingly, a 2024 survey found that 15% of respondents in Spain said they would consider acting as “money mules” (facilitating the movement of illicit funds), complicating both prevention and recovery efforts.
• Abuse of corporate governance: Practices such as fraudulent manipulation of voting processes through blank signature abuse or undue attribution of voting rights are addressed under Spanish corporate crime provisions.

Fraud Targeting Foreign Businesses and Professionals

International companies entering or operating in the Spanish market face specific fraud risks that exploit their unfamiliarity with local regulations and business practices:

• Fake contractors, suppliers, and intermediaries: Fraudulent entities may present convincing credentials, completed projects, or forged licences to secure contracts or advance payments from foreign companies establishing operations in Spain.
• Property and real estate fraud: Foreign investors are frequently targeted with fake rental listings, non-existent properties, or misrepresented ownership documentation.
• Fraudulent consultants and service providers: Individuals or firms may claim to expedite regulatory processes—such as company registration, visa applications, or tax filings—in exchange for fees, without delivering any legitimate service. No third party can guarantee the outcome of official administrative processes in Spain.
• Fraudulent business partnership proposals: Scammers may propose joint ventures or investment opportunities that are designed solely to extract capital from foreign investors.

Anti-Fraud Law in Spain: The Regulatory Framework

Spain has significantly strengthened its legal and regulatory framework to combat fraud in recent years. For international businesses, understanding these regulations is not merely advisable—it is a compliance obligation. Below are the key pillars of Spain’s anti-fraud regulatory architecture.

Law 11/2021 — Spain’s Anti-Fraud Law (Ley Antifraude)

Enacted on 9 July 2021, Law 11/2021 on Measures to Prevent and Combat Tax Fraud is the cornerstone of Spain’s modern anti-fraud strategy. Commonly known as the Ley Antifraude, it introduced sweeping changes to Spain’s General Tax Law and transposed key elements of the EU Anti-Tax Avoidance Directive (ATAD) into domestic legislation. The law is built on three pillars: aligning Spanish legislation with European tax avoidance standards, creating a fairer tax system, and implementing more active and effective fraud control measures.

The specific measures that international businesses must be aware of include:

VeriFactu and Electronic Invoicing Compliance

VeriFactu is Spain’s mandatory electronic invoicing reporting system, established by Royal Decree 1007/2023. It operationalises Law 11/2021’s requirements regarding invoicing software and represents one of the most significant compliance obligations for businesses operating in Spain.

Under VeriFactu, every invoice issued must be registered simultaneously (or immediately before) the transaction occurs and transmitted securely to the Spanish Tax Agency (AEAT). The system is designed to eliminate the possibility of altering, deleting, or hiding invoicing records after the fact. Key requirements include:

• Real-time or near-real-time invoice reporting to AEAT.
• All invoicing records must be linked in a verifiable sequence showing creation dates.
• An automatic log must record every action within the invoicing system, including access and software updates.
• Fiscal data must be kept separate from unrelated confidential business information.

Non-compliance carries severe consequences. Users of non-compliant or dual-use invoicing software face fines of up to €50,000 per fiscal year, while in serious cases, overall penalties for failure to adapt to electronic invoicing requirements can reach €600,000. Software vendors selling uncertified products face penalties of €1,000 per licence sold.

The Spanish Penal Code and Fraud Offences

Alongside the anti-fraud law, Spain’s Penal Code provides the criminal law framework for prosecuting fraud. The 2025 Penal Code reforms have significantly tightened penalties, particularly for digital and corporate crime. The key provisions include:

• Article 248: The core fraud (estafa) provision, covering deception-based offences and computer fraud (manipulation of systems for illicit financial gain).
• Article 250: Aggravated fraud, applicable when amounts exceed €50,000 or €250,000, or when aggravating circumstances are present (targeting vulnerable victims, abuse of professional trust, involvement of falsified documents).
• Articles 197 and 197 bis: Unauthorised access to personal data, computer systems, and interception of data transmissions.
• Article 264: Destruction, alteration, or deletion of data and computer systems.
• 2025 reforms: Heavier penalties for cybercrime, identity theft, and online fraud. Critically for the business community, companies can now face increased legal liability, and directors can be held personally accountable for breaches of regulatory compliance standards.

EU Regulations Affecting Fraud Prevention in Spain

Several EU-level regulations also impact businesses operating in Spain:

• EU Anti-Tax Avoidance Directive (ATAD): Transposed into Spanish law through Law 11/2021, introducing Controlled Foreign Company rules, exit taxation, and anti-hybrid mismatch provisions.
• Regulation (EU) 2024/886 on instant payments: Coming into force on 9 October 2025, this regulation requires banks to verify that the beneficiary’s name matches the IBAN before executing an instant euro transfer. If there is a discrepancy, the bank must alert the customer before proceeding—a measure specifically designed to combat invoice fraud and man-in-the-middle scams.
• Cross-border law enforcement cooperation through Europol: Spain works closely with Europol to dismantle international fraud networks, as demonstrated by Operation Borrelli and numerous other joint operations.

What Is the Penalty for Fraud in Spain?

The penalties for fraud in Spain vary depending on the type of offence, the amount involved, and the presence of aggravating factors. The following breakdown covers the main penalty categories under current legislation.

For businesses found guilty of fraud, consequences extend beyond fines and imprisonment. A company may be prohibited from receiving public subsidies, barred from providing services related to the fraudulent activity, have its management placed under court-appointed supervision, or—in the most serious cases—be dissolved entirely.

Key aggravating factors that can increase sentences include: the number of victims affected, the extent of financial damage, falsification of public documents or signatures, repeat offender status, targeting of vulnerable individuals, abuse of a position of trust, and involvement of an organised criminal network.

Following the 2025 Penal Code reforms, penalties for cybercrime, corporate fraud, and money laundering have all been increased. Directors and managers of companies can now be held personally criminally liable for compliance failures—a development that significantly raises the stakes for corporate governance in Spain.

Where to Report Fraud in Spain

If you or your business becomes a victim of fraud in Spain, knowing where and how to report it quickly is essential. Spain has multiple reporting channels depending on the type of fraud involved.

Reporting Channels

1. Spanish National Police (Policía Nacional): The primary reporting body for most fraud types. Their specialised Cybercrime Unit—the Unidad de Investigación Tecnológica (UIT)—handles digital fraud cases. You can file a report online through the Denuncias Telemáticas section at policia.es, or in person at any police station.
2. Civil Guard (Guardia Civil): The Civil Guard operates the Grupo de Delitos Telemáticos (GDT), a specialised cybercrime unit. Reports can be submitted by email at gdt@guardiacivil.org or via the Colabora section at guardiacivil.es.
3. Local Police (Policía Local): For filing reports at the municipal level. Contact details can be found on your local municipality’s website.
4. Spanish Tax Agency (AEAT — Agencia Tributaria): For reporting tax fraud, invoicing violations, and anti-fraud law non-compliance. Reports can be filed through the AEAT online portal.
5. National Anti-Fraud Office (Oficina Nacional Antifraude): An autonomous body within the State Agency of the Labour and Social Security Inspectorate (ITSS), handling undeclared work, irregular employment, and social security fraud under Law 23/2015.
6. Europol / Internet Crime Complaint Center (IC3): For cross-border fraud cases or scams with international dimensions. Spanish authorities work closely with Europol, and the IC3 (a partnership between the FBI, NW3C, and BJA) handles cases with a U.S. connection.

Steps to Take If Your Business Is a Victim of Fraud

Acting quickly and methodically can significantly improve your chances of recovering losses and building a successful legal case. Here is the recommended course of action:

1. Stop all communication with the suspected fraudster. Do not attempt to resolve the situation directly or confront them—this can compromise your legal position.
2. Secure your accounts and systems. If financial data or credentials have been compromised, immediately contact your bank, change passwords, and isolate any affected systems.
3. Preserve all evidence. Collect and securely store screenshots, emails, contracts, invoices, bank transfer records, chat messages, and any other documentation related to the fraud. This evidence will be critical for both criminal proceedings and civil recovery.
4. Quantify the financial damage. Calculate the total losses as precisely as possible. Under Spanish law, the severity of the penalty depends directly on the amount defrauded—the €400, €50,000, and €250,000 thresholds each trigger different penalty categories.
5. File a formal complaint (denuncia) with the appropriate authority as soon as possible.
6. Engage specialised legal counsel immediately. With only 17% of fraud victims in Spain managing to recover their losses, professional legal representation significantly improves your prospects—both for criminal prosecution and civil recovery of funds.

Asset recovery in fraud cases is notoriously difficult—which is why acting quickly with the right legal team makes all the difference. Lawants intervenes in complex criminal proceedings in Spain, from filing complaints with police authorities and courts to pursuing bank claims in cases involving fraudulent transfers such as false supplier fraud. Get in touch with our fraud specialists to protect your rights and maximise your chances of restitution.

International Fraud

The number of scams and frauds committed is significantly increasing, especially in the world of cryptocurrencies. These kind of crimes cause […]

Read More… from International Fraud

Find out more

Fraud Prevention: How International Businesses Can Protect Themselves in Spain

Given that fraud recovery rates in Spain remain low, prevention is unquestionably the most cost-effective strategy. Below are the key areas where international businesses should focus their protective efforts.

Internal Controls and Compliance Frameworks

• Implement strict segregation of duties for financial processes—no single employee should control an entire payment cycle.
• Conduct regular internal audits and financial reconciliation, with particular attention to cash transactions and invoice processes.
• Establish clear whistleblowing mechanisms that allow employees to report suspected fraud confidentially.
• Ensure full compliance with Spain’s electronic invoicing requirements (VeriFactu) well ahead of the January/July 2026 deadlines.
• Adopt certified invoicing and accounting software that meets all Law 11/2021 requirements—remember that even possessing dual-use software can be punishable.
• Train all employees on recognising fraud, with specific focus on phishing, social engineering, and invoice manipulation.

Due Diligence for Business Operations in Spain

• Verify the identity and legitimacy of all business partners, suppliers, contractors, and intermediaries before entering into any agreements.
• Request and verify company registration documents through the Registro Mercantil (Commercial Registry).
• Confirm tax identification numbers (NIF/CIF) through the AEAT verification services.
• Be cautious with any intermediary or consultant who promises expedited regulatory processes. Official administrative procedures in Spain follow established timelines that cannot be bypassed by third parties.
• Conduct thorough background checks before entering joint ventures or partnership agreements, particularly with entities you have not previously worked with.
• Independently verify bank account details for all payments—especially for new suppliers or when payment instructions change unexpectedly. This is the single most effective measure against man-in-the-middle invoice fraud.

Cybersecurity and Digital Fraud Prevention

• Implement multi-factor authentication (MFA) across all business systems, email accounts, and financial platforms.
• Provide regular cybersecurity training to staff, with a focus on identifying phishing emails, suspicious calls, and fraudulent SMS messages.
• Use verified and encrypted communication channels for all financial transactions and sensitive business communications.
• Monitor for data exposure—following breaches like the 2024 Santander incident, criminal networks may use stolen data to craft targeted scams against your business or employees.
• Keep all systems, software, and security patches fully updated at all times.

Leveraging Spain’s Banking Industry Anti-Fraud Initiatives

Spain’s major banks have recognised the severity of the fraud threat and have launched collaborative countermeasures. FrauDfense, a joint initiative by BBVA, Banco Santander, and CaixaBank, is building a shared information platform to discuss fraudulent tactics and develop collective defences—with plans to expand membership to additional institutions.

Additionally, from 9 October 2025, EU Regulation 2024/886 requires all banks to verify that the beneficiary’s name matches the IBAN before executing instant euro transfers. If a discrepancy is detected, the bank must alert the customer before proceeding. For businesses making frequent cross-border payments, this provides an additional layer of protection against invoice fraud and payment redirection scams.

When choosing a banking partner in Spain, international businesses should prioritise institutions that actively participate in anti-fraud data-sharing initiatives and offer advanced fraud detection capabilities, including AI-powered behavioural analysis of transaction patterns.

Key Considerations for Foreign Businesses and Professionals Operating in Spain

Beyond the general fraud landscape, international companies and entrepreneurs face specific compliance obligations and risk factors that demand particular attention. The following points address the unique position of foreign entities operating in or entering the Spanish market.

Foreign businesses should also be aware that Spain’s digital literacy landscape varies significantly by region. Companies with operations across multiple Spanish regions should adapt their security practices and employee training programmes accordingly.

Finally, the upcoming EU Regulation 2024/886 on instant payments, effective from October 2025, introduces IBAN-name verification requirements that will affect all cross-border euro transfers involving Spanish entities. Businesses should ensure their payment processes and banking relationships are prepared for this change.

How Lawants Can Help You Navigate Fraud Risk in Spain

Navigating Spain’s fraud landscape—and the increasingly complex regulatory framework designed to combat it—requires more than good intentions. It demands experienced, locally grounded legal expertise combined with an understanding of the unique challenges international businesses face.

Lawants is a multidisciplinary firm of international lawyers, accountants, and labour consultants based in Spain, specialising in assisting large companies and entrepreneurs with interests in the Spanish market. Our team provides comprehensive support across every dimension of fraud prevention and response:

• Compliance audits: We assess your current operations against the requirements of Law 11/2021, VeriFactu, and all applicable anti-fraud regulations, identifying gaps and building compliant structures before problems arise.
• Corporate structuring and due diligence: From company formation to partner verification and supply chain checks, we help you build a fraud-resilient business foundation in Spain.
• Fraud response and litigation support: If your business becomes a victim of fraud, our criminal and commercial law specialists provide immediate legal counsel, manage the filing of formal complaints (denuncias), gather and preserve evidence, and represent your interests in both criminal proceedings and civil recovery actions.
• Tax advisory: Expert guidance on CFC rules, exit taxation, cryptocurrency reporting obligations, and the full scope of Spain’s anti-fraud tax provisions.
• Labour law compliance: We ensure your employment contracts, payroll structures, and social security contributions are fully compliant, eliminating exposure to labour fraud investigations.
• Ongoing regulatory monitoring: Spain’s anti-fraud framework continues to evolve rapidly. We keep our clients informed of all relevant changes and proactively adjust their compliance strategies.

Whether you need to initiate criminal proceedings before a Spanish court, report fraud to police authorities, or pursue a bank claim for fraudulent transfers, Lawants’ criminal and commercial fraud specialists are ready to act on your behalf. We assist victims worldwide in recovering assets and holding fraudsters fully accountable under Spanish law. Contact our team today for the best legal advice on fraud recovery in Spain.

International Fraud

The number of scams and frauds committed is significantly increasing, especially in the world of cryptocurrencies. These kind of crimes cause […]

Read More… from International Fraud

Find out more

Frequently Asked Questions About Fraud in Spain

What is the penalty for fraud in Spain?

Penalties depend on the amount defrauded. Minor fraud involving €400 or less is punished with a fine. Standard fraud exceeding €400 carries a prison sentence of 6 months to 3 years. Aggravated fraud—involving amounts over €50,000 or €250,000, or with other aggravating factors—can result in 1 to 6 years imprisonment plus substantial fines.

Where can I report fraud in Spain?

The main channels are the Spanish National Police (Policía Nacional), particularly the UIT cybercrime unit, and the Civil Guard (Guardia Civil) through the GDT unit. For tax fraud, reports should be directed to the AEAT (Spanish Tax Agency). Reports can be filed online, by email, or in person at any police station.

What is the anti-fraud law in Spain?

Law 11/2021, known as the Ley Antifraude, is Spain’s comprehensive anti-fraud regulation enacted in July 2021. It targets tax fraud through measures including cash payment limits (€1,000 for professional transactions), mandatory certified electronic invoicing, prohibition of dual-use accounting software, cryptocurrency reporting obligations, and stricter penalties for non-compliance.

How does fraud affect foreign businesses operating in Spain?

Foreign businesses are subject to the same anti-fraud regulations as Spanish companies when operating in the country. This includes electronic invoicing compliance (VeriFactu), cash payment limits, tax reporting obligations, and adherence to the Penal Code’s fraud provisions. Non-compliance can result in significant financial penalties, criminal liability for directors, and operational restrictions.

What is VeriFactu and when must my business comply?

VeriFactu is Spain’s mandatory electronic invoicing reporting system, requiring real-time invoice registration with the Spanish Tax Agency (AEAT). Companies must comply by 1 January 2026, and self-employed professionals by 1 July 2026. Non-compliance carries fines of up to €50,000 per fiscal year, with serious violations reaching up to €600,000.

Can I recover money lost to fraud in Spain?

Recovery is possible but statistically challenging—only about 17% of fraud victims in Spain recover their losses. Acting immediately, preserving evidence, filing a formal complaint, and engaging specialised legal counsel all significantly improve the likelihood of a successful recovery, whether through criminal restitution or civil proceedings.

Is cryptocurrency fraud regulated in Spain?

Yes. Law 11/2021 introduced mandatory reporting of cryptocurrency balances and holders, and Spain has implemented stricter controls on digital assets. Spanish authorities, working with Europol, have actively dismantled major international crypto fraud networks—including a ring that laundered €460 million from over 5,000 victims worldwide, broken up in June 2025.

Fraud in Spain is a growing and evolving threat, but the regulatory framework is robust and the enforcement landscape is becoming increasingly sophisticated. For international businesses and professionals, the key to operating safely in the Spanish market lies in proactive compliance, rigorous due diligence, and expert legal support. With the right approach—and the right advisors—you can navigate this complex environment with confidence.

Related Articles

• Capital Gains Tax in Spain: Complete Guide for Residents and Non-Residents (2026)
• Taxation on Share Deals in Spain: Capital Gains, Corporate Tax, VAT, and What International Investors Need to Know
• Dividend Tax in Spain: Rates, Exemptions & Filing Requirements