In brief. Computer fraud (frode informatica) is the digital counterpart of ordinary fraud and is set out in art. 640-ter of the Italian Criminal Code (codice penale, c.p.). It punishes anyone who, by altering the functioning of a computer or telematic system, or by intervening without right on data, information or programs it contains, obtains an unjust profit for themselves or others to the detriment of another. It is the offence under which Italian prosecutors typically charge phishing, banking malware, SIM-swap scams and unauthorised online payment fraud.

What art. 640-ter punishes

The structure of art. 640-ter mirrors the classic fraud of art. 640 c.p., but replaces the deception of a human victim with the manipulation of a machine. The offence is committed by two alternative forms of conduct: altering in any way the functioning of a computer or telematic system, or intervening without right, by any means, on data, information or programs contained in or pertaining to a system. The result element is the same as in ordinary fraud: an unjust profit (ingiusto profitto) obtained with corresponding damage (danno) to another.

Because the offence centres on machine manipulation rather than human deception, it captures a very broad range of modern conduct: deploying malware that diverts a bank transfer, using stolen credentials to authorise a payment, manipulating a betting or metering system, or interfering with an automated process to obtain a benefit. The offence is one of intent (dolo): the accused must knowingly and wilfully manipulate the system to obtain the unjust profit.

Phishing and digital identity theft

Most phishing cases reach the Italian courts under art. 640-ter, frequently in combination with other offences. The typical pattern — a fraudulent email or message that captures the victim’s credentials, followed by an unauthorised transfer — is treated as computer fraud at the moment the captured credentials are used to alter the functioning of the banking system. The preparatory deception may additionally engage art. 615-ter c.p. on unauthorised access to IT systems where the offender enters the victim’s protected online-banking area.

Digital identity theft carries its own statutory weight. Art. 640-ter, third paragraph, contains a specific aggravating circumstance where the fraud is committed with theft or unlawful use of digital identity (furto o indebito utilizzo dell’identità digitale) to the detriment of one or more persons. This circumstance was introduced by Decree-Law 93/2013 precisely to address impersonation scams and raises the penalty to imprisonment from two to six years and a fine from €600 to €3,000. In phishing chains, prosecutors also routinely add charges of handling stolen goods (ricettazione, art. 648 c.p.) for the proceeds and of money laundering or self-laundering (riciclaggio / autoriciclaggio, artt. 648-bis and 648-ter.1 c.p.) where the funds are moved through accounts.

Aggravating circumstances and penalties

The basic offence is punished with imprisonment from six months to three years and a fine from €51 to €1,032, and is prosecuted on complaint (querela) of the injured party.

The offence is punished more severely and prosecuted ex officio in the aggravated forms:

  • where the offence is committed to the detriment of the State, another public body or the European Union (art. 640, para. 2, no. 1 c.p.), where it produces a transfer of money, monetary value or virtual currency, or where it is committed with abuse of the status of system operator (operatore del sistema) — imprisonment from one to five years and a fine from €309 to €1,549;
  • where it is committed with theft or unlawful use of digital identity — imprisonment from two to six years and a fine from €600 to €3,000.

Prosecution is also ex officio where the general aggravating circumstances of art. 61 no. 5 (taking advantage of the victim’s personal circumstances, including age) or no. 7 c.p. (damage of significant seriousness) apply. Law 90/2024, which increased penalties for several other computer crimes, did not change the penalties for art. 640-ter.

Where the computer fraud is committed within an organised or transnational structure, the conduct frequently attracts additional charges and exposes the accused to precautionary measures (misure cautelari) and to the seizure and confiscation of the proceeds, including by equivalent value (confisca per equivalente). Corporate entities may also face administrative liability under D.Lgs. 231/2001 where the fraud benefits the company.

Defences

A defence under art. 640-ter is built on the same forensic and legal axes as other computer-crime charges, with particular attention to attribution and intent.

Attribution. The central battleground is whether the prosecution can reliably attribute the conduct to the accused. IP addresses, device identifiers and account logs are circumstantial; shared networks, spoofing, compromised devices and the use of money-mule accounts all break the chain between the accused and the manipulation. ILA challenges weak attribution head-on with independent forensic analysis.

Absence of intent. A person who unknowingly receives or transfers fraudulent proceeds — the classic position of a money mule recruited under false pretences — may lack the intent required for art. 640-ter and for the associated laundering charges. Demonstrating good faith and absence of awareness is often the decisive defence.

Quantification of the unjust profit. The penalty bands and the confiscation depend on the amount of the unjust profit and the damage. Contesting the calculation, and isolating sums that were never actually obtained, can materially reduce exposure.

Evidence integrity. As with all Italian cyber prosecutions, the acquisition and preservation of digital evidence must respect the standards introduced by L. 48/2008 (Budapest Convention). A defective acquisition or a broken chain of custody can be challenged.

Cross-border dimension. Phishing and payment fraud are inherently transnational. Where victims, servers and accused sit in different jurisdictions, questions of Italian jurisdiction, parallel proceedings and international cooperation become central — ILA’s core terrain.

How ILA defends these cases

ILA represents English-speaking individuals and companies accused of computer fraud in Italy, from single online-payment disputes to complex transnational phishing investigations. The firm pairs Italian criminal-defence counsel with independent digital-forensic experts, contests attribution and the lawfulness of the evidence, and manages the parallel exposure to laundering and confiscation. For the broader picture of the firm’s computer-crime work, see the pillar guide to cybercrime in Italy.

FAQ

Is phishing prosecuted as computer fraud in Italy? Yes. Phishing is typically charged under art. 640-ter c.p. once the captured credentials are used to alter the functioning of a banking or payment system. Prosecutors often add charges of unauthorised access (art. 615-ter), handling stolen goods and money laundering.

What is the penalty for computer fraud? The basic offence carries imprisonment from six months to three years plus a fine from €51 to €1,032. Where the fraud produces a transfer of money, monetary value or virtual currency, or is committed by abusing the status of system operator, the penalty is one to five years plus a fine from €309 to €1,549; where it involves theft or unlawful use of digital identity, imprisonment from two to six years plus a fine from €600 to €3,000.

I unknowingly received fraudulent funds — am I liable? Computer fraud requires intent. A person who acts in genuine good faith, without awareness that the funds are the proceeds of fraud, may lack the subjective element required by art. 640-ter and the related laundering offences. Establishing good faith is a frequent line of defence.

Contact the firm

If you or your company has been notified of an investigation for computer fraud, phishing or digital identity theft in Italy, contact ILA immediately. See the cybercrime pillar guide and reach us through the Contact page or our 24/7 line.