Spain’s Cibercomandancia, launched in León in 2025, has processed 50,000 online reports in its first year. Most cases involve cyber fraud, with suspects concentrated in Madrid, Barcelona, and Valencia. Over €5.8 million has been recovered.
Spain’s Cibercomandancia de la Guardia Civil, established in León in July 2025, has processed around 50,000 online reports in its first year, highlighting the scale of cybercrime now affecting the country. The majority of these cases involve digital fraud, with most suspects traced to Madrid, Barcelona, and Valencia. The unit, which operates from the same city as the Instituto Nacional de Ciberseguridad (INCIBE), has managed to recover more than €5.8 million for victims, underlining the financial stakes involved.
Of the 50,000 reports submitted through the Guardia Civil’s electronic portal, 42,000 were formally processed. These included 29,000 criminal incidents and 7,000 cases of lost documents. The remaining reports were rejected, often because they did not meet legal requirements or did not constitute a criminal offense. Investigators have clarified over 500 cases, with approximately 600 individuals under investigation. Notably, 55% of all cases handled by the unit relate to cyber fraud, reflecting a growing trend in digital crime across Spain.
The Cibercomandancia is the only police body in Spain currently accepting this type of online complaint. Previously, since 2015, only four types of offenses could be reported online, and citizens still had to confirm their complaint in person within 72 hours—a process described as cumbersome by Ángel Blanco, captain of the unit’s judicial police. The 2024 reform of the Ley de Enjuiciamiento Criminal (LeCrim) enabled a broader range of crimes to be reported digitally from January 2025, provided the complainant is identified with an electronic certificate. This includes online fraud, identity theft, document loss, and certain physical crimes like theft or vehicle damage, though not cases where the perpetrator is known or those involving sexual assault or gender violence.
Reports have come from across Spain, but the largest numbers originate from Madrid, Valencia, Alicante, and Barcelona. In Catalonia alone, between 1,500 and 2,000 reports have been filed, with Barcelona accounting for the majority. The unit’s investigators, known as equipos @, confirm that most suspects are based in major urban centers, where digital activity and overall crime rates are higher. In contrast, regions with older populations and less digital engagement, such as Galicia or Castilla y León, see fewer cases.
Upon receiving a report, agents enter the data into the Sistema Integral de Gestión Operativa (SIGO), making it accessible from any Guardia Civil post. The Cibercomandancia now employs around 100 officers, 15% of whom are women, and has prioritized recruiting younger staff with strong digital skills. The unit currently receives an average of 180 reports daily, with numbers peaking at 250 on weekdays and dropping to around 100 on weekends and holidays.
One of the unit’s key tasks is to act quickly in urgent cases, such as blocking fraudulent bank transfers. Speed is critical: if a report is filed within 24 to 32 hours of a suspicious transaction, there is a higher chance of recovering funds. The approach is to assign cases to whichever team is best positioned to act immediately. In some instances, such as a recent sexual assault case, the victim was able to file a detailed report online after declining to visit a police station, demonstrating the flexibility of the new system.
The decision to base the Cibercomandancia in León was influenced by the presence of INCIBE, which is overseen by the Ministry for Digital Transformation and provides infrastructure and collaboration opportunities for the unit. Despite limited publicity as the system is still developing, the volume of reports suggests a strong demand for digital policing. The trend mirrors broader shifts in Spanish law enforcement, where authorities are adapting to new forms of crime and updating procedures accordingly. This evolution in police work is also reflected in other areas, such as the recent push for more detailed documentation of violent incidents at sea, as seen in the move by Spain’s anti-drug prosecutor to enable piracy charges for narcolancha attacks.
Spain’s experience with the Cibercomandancia highlights the growing importance of digital security and the need for law enforcement to keep pace with technological change. The integration of electronic reporting, rapid response protocols, and specialized personnel marks a significant shift in how crimes—especially those involving technology—are addressed. As cybercrime continues to evolve, the effectiveness of such units will likely play a crucial role in protecting both individuals and businesses across the country.
