On 24 April, the Italian Supreme Court handed down a judgment on computer fraud aggravated by digital identity theft, clarifying that the aggravating circumstance of digital identity theft affecting the injured party applies where computer access credentials are unlawfully used to gain unauthorized access to, or otherwise interfere with, data, information or software contained in an IT or telecommunications system, even where those credentials had previously been obtained or procured by third parties.
The Facts of the Case
The defendant had been convicted at both first instance and on appeal of aggravated computer fraud for using the injured party’s password to gain unauthorized access to the bank’s IT system and execute unauthorized transactions on the victim’s current account. In particular, the defendant transferred € 17,942.00 from the account holder’s bank account to a current account in his own name. Prior to the offence, unknown third parties had fraudulently obtained the victim’s home banking access credentials.
The defendant appealed to the Italian Supreme Court, arguing, inter alia, that the reasoning of the appellate judgment was deficient, contradictory and manifestly illogical with regard to the finding that the aggravating circumstance of digital identity theft applied. He contended that his acquittal at first instance on the original charge of unauthorized access to an IT system precluded the application of that aggravating circumstance, since the digital identity theft had been materially carried out by unknown third parties.
The Offence of Computer Fraud
The offence of computer fraud is committed by any person who, by altering in any manner the operation of an IT or telecommunications system, or by unlawfully interfering, by any means, with data, information or software contained in, or pertaining to, such a system, secures an unlawful profit for themselves or another, thereby causing financial loss to another person.
The Aggravating Circumstance of Digital Identity Theft
The aggravating circumstance of digital identity theft affecting the injured party is a specific aggravating circumstance applicable to the offence of computer fraud. It arises where the offender uses computer access credentials to unlawfully interfere with data, information or software contained in an IT or telecommunications system for the purpose of obtaining an unlawful profit for themselves or another. Such use is considered unauthorized even where the access credentials had previously been obtained or procured by third parties.
The Court’s Analysis of the Offence
In the case before the Italian Supreme Court, the unlawful transfer of funds was carried out through the fraudulent use of access credentials associated with the injured party’s digital identity, thereby creating the false appearance that the transactions had been authorized by the holder of the bank account.
The Supreme Court accordingly held that the aggravating circumstance applied, since the offence had been committed through the unauthorized use of the injured party’s digital identity. This conclusion was not affected by the fact that the access credentials had been physically obtained by persons other than the defendant, as the digital identity was ultimately exploited as the instrument through which the unlawful financial gain was achieved via the home banking system.
The Principle of Law Established by the Italian Supreme Court
The Italian Supreme Court clarified that the decisive factor is the knowing use of the access credentials to carry out an unauthorized interference with an IT system, thereby manipulating or altering the transactions performed through that system and obtaining an unlawful financial advantage.
Accordingly, the offence of computer fraud aggravated by digital identity theft is committed where a person unlawfully accesses the operating system of a home banking service by using access credentials associated with the injured party’s digital identity in order to obtain an unlawful profit through unauthorized fund transfer transactions, while falsely presenting those transactions as having been authorized by the holder of the bank account.
The Court’s Ruling
The Italian Supreme Court declared the appeal inadmissible and ordered the appellant to pay the costs of the proceedings, as well as a pecuniary penalty.
The law firm Dal Pozzo in Milan provides legal assistance to private individuals, public entities, and businesses, including matters related to to cybercrimes.