„Cybercrime” is a label for different criminal acts, primarily provided for by the Criminal Code. The classification depends on what was actually done: accessing a system without authorization, modifying data, disrupting its functioning, obtaining a benefit through manipulating data, or fraudulently using a payment instrument. A fraud committed online does not automatically become cybercrime.

What actions can fall into this category

The Criminal Code regulates, among other things, illegal access to an information system (art. 360), illegal interception of an electronic data transmission (art. 361), tampering with the integrity of data (art. 362), disruption of system operation (art. 363), unauthorized transfer of data (art. 364), and certain illegal operations with computer devices or programs (art. 365). Each offense has its own elements and requirements; mere use of a computer or the internet is not sufficient.

Other relevant offenses may include computer fraud (Article 325), computer fraud (Article 249), and fraudulent financial transactions (Article 250). For example, computer fraud involves tampering with data or the functioning of a system in order to obtain material gain and cause damage, in accordance with the terms of the legal text. Computer fraud also involves, among other things, the introduction, modification, or deletion of data without the right to do so, with the result and purpose provided for in Article 325.

If the victim was persuaded to send money through a false advertisement or a misleading story, the actions may raise issues of fraud or other crimes. If there were also interventions on the system or data, other rules may become relevant as well. The classification is based on concrete acts, intent, consequences and evidence, not just on the fact that the incident occurred online.

What digital evidence can count

Depending on the accusation, messages and emails in the available form, account statements, transaction data, connection history, server logs, file metadata, backup copies, and provider records may be relevant. Keep the original materials and note when and where they were obtained. Screenshots can help document the context, but they do not always replace original data or other evidence.

In an investigation, the technical conclusions must be linked to the accusation: what system was accessed, what data were modified or transferred, who carried out the operation and how the link to the damage is established. An IP address, a used account or the presence of a file on a device do not in themselves demonstrate all these circumstances. Interpretation depends on the available data and the technical explanations.

Computer forensics and obtaining data

Article 168 of the Criminal Procedure Code regulates the search of an information system or storage medium and requires the use of appropriate means and procedures to protect the integrity of the information. During criminal proceedings, the measure is ordered by the judge of rights and liberties at the request of the prosecutor, under the conditions of the article; during the trial, the court may order it. The minutes must record the relevant operations. The Code also separately regulates the handing over of objects, documents or computer data (art. 170).

A defense can verify the mandate and limits of the system and the data concerned, the persons who performed the operation, the record, the copies produced, and the way in which the data were kept and analyzed. A hash can be useful for verifying the identity of a digital copy, but the Code does not transform any lack of a specific technical tool into an automatic conclusion about the admissibility of the evidence.

According to Article 102 of the Code of Criminal Procedure, evidence obtained illegally cannot be used, and the nullity of the act by which a sample was ordered, authorized, or administered can lead to its exclusion. This does not mean that any technical discrepancy automatically leads to its exclusion: the irregularity, the legally violated provision, and the effect on the evidence must be analyzed within the applicable procedural framework.

What the injured person and the company can do

Document the incident without unnecessarily modifying the relevant devices or files: keep messages, transaction data, alerts, and access credentials available. For an organization, this involves the IT security team and legal staff, limits unauthorized access to systems, and keeps logs that risk being overwritten. If the devices could become evidence, coordinate their preservation with a specialist and the lawyer. Reporting to judicial authorities and technical measures are chosen based on the incident and the risks to data and activity.

Defense landmarks

  • requests that the actions imputed and the data supporting each element of the offense be described in precise detail;
  • verify whether access was authorized and what were the concrete limits of the authorization;
  • analyzes the source, integrity, context and interpretation of digital evidence;
  • compare the claimed damage with the course of the transactions and with the proven computer operations;
  • verifies the legality of measures to obtain evidence and requests an expert opinion when relevant;
  • The legal framework for access, data manipulation, fraud, and possible deception are discussed separately.

Evidence kept by suppliers from other states

Some data may be retained by providers operating across borders. Regulation (EU) 2023/1543 on European orders for the disclosure and preservation of electronic evidence in criminal proceedings applies from August 18, 2026. The European mechanism has its own conditions and competent authorities; it does not replace internal rules regarding the authorization and administration of evidence.

Official sources

Informational material, not individual legal advice. The classification and strategy depend on the documents in the case file, the nature of the data, and the current form of the law.