§ 263a StGB
Computer fraud
For example, using someone else’s login or card details.
Cybercrime
Defence lawyer for online offences in AachenThe police take your laptop away, a letter accuses you of computer fraud, or your bank account has been used for other people’s transfers. Karolin Hagemann de Grzymala, LL.M., defends you against allegations involving data, devices and accounts. She also helps if you yourself are attacked online.
An IP address is not an offender.We examine the digital traces.
Digital evidence is only as good as its analysis.
Cybercrime is not a single offence. The term covers offences committed with or against computers, networks and data. As a lawyer for cybercrime in Aachen, Karolin Hagemann de Grzymala, LL.M., defends private individuals, the self-employed and companies. In these cases, the evidence usually lies not in witness statements but in storage media, log files and forensic reports. That is where the defence starts.
Typical cybercrime allegations
§ 263 StGB
Online shopping fraud
For example, goods that were paid for but never delivered.
§§ 202a, 202b StGB
Spying on and intercepting data
§ 202c StGB
Preparing such offences
For example, by passing on passwords or malware.
§ 202d StGB
Handling stolen data, that is, trading in it
§ 303a StGB
Data tampering
For example, with ransomware.
§ 303b StGB
Computer sabotage
For example, through attacks that overload servers.
§ 269 StGB
Falsifying data relevant as evidence
For example, in phishing emails.
§ 261 StGB
Money laundering by passing on other people’s money
§§ 185, 238, 241 StGB
Insults, threats and stalking on social networks
Good to know
Drug deals on the darknet are also cybercrime in the broader sense. They are governed by the rules on drug offences. If the case involves fraud with large losses or fraud within a company, also read the page on business and white-collar crime.
If your account was used for other people’s money
A typical background: someone offers you easy extra income through a job portal or a messaging app. You are asked to receive money into your account and pass it on. Or you let an acquaintance use your account details. Later it turns out that the money came from a fraud.
The public prosecutor’s office then investigates for money laundering. This is a criminal offence even without intent. It is enough that you recklessly failed to recognise where the money came from (§ 261 Abs. 6 StGB). In addition, the victims can demand their money back from you. Whether you should have recognised its origin depends on the circumstances: on the messages you received, on how things unfolded and on what you knew about the person giving you instructions. That is why we examine the chat histories closely.
Call directly
+49 163 8461632You speak to the lawyer in person. Professional confidentiality applies from the first call.
Search and seizure of devices
In cybercrime cases, investigators are interested above all in your devices. During a search (Durchsuchung), they take laptops, phones, hard drives and USB sticks, sometimes also the devices of partners or flatmates.
As a rule, a search must be ordered by a judge. Only if any delay would put the investigation at risk (Gefahr im Verzug) may the public prosecutor’s office and the police order it themselves (§ 105 StPO). Object to your devices being taken and have your objection recorded in the report. You can apply for a court decision against the seizure (Beschlagnahme) and against devices being taken away for examination at any time (§§ 98 Abs. 2, 110 Abs. 4 StPO). On request, you will receive a list of the items taken (§ 107 StPO).
The investigators may examine the data, and under certain conditions also data in a cloud that the device can access (§ 110 Abs. 3 StPO). You do not have to give passwords or PINs. However, the Federal Court of Justice (Bundesgerichtshof) ruled in 2025 that, during a search ordered by a judge, the police may in some circumstances place your finger on the sensor to unlock a phone.
The analysis often takes months. We apply for the devices to be returned as soon as the data has been secured or the seizure is no longer proportionate. If you need a device for your work, tell us straight away.
If the police want to take your devices
Ask to see the warrant. Say nothing about the allegation and do not give any passwords. Object to the devices being taken and have this recorded. Ask for a list of the devices taken. Call us while the officers are still there: +49 163 8461632. For more, see what to do in an emergency.
What happens next
- 01
Summons or search
Suspects often only learn about the proceedings from a letter from the police, such as a summons (Vorladung), or from a search early in the morning.
- 02
Forensic analysis
Police IT specialists or external service providers analyse the devices. Their report later becomes a central part of the file.
- 03
Access to the file
We apply for access to the file (Akteneinsicht) and, where necessary, to the secured data. Only then can we check whether the report is correct.
- 04
Statement
We set out what the data proves and what it does not. The aim is for the case to be dropped, either for lack of sufficient suspicion or subject to a condition (§§ 170 Abs. 2, 153a StPO).
- 05
Penalty order or indictment
If the public prosecutor’s office does not drop the case, it applies for a penalty order (Strafbefehl) or brings charges. You have two weeks to object to a penalty order (§ 410 StPO).
- 06
Trial
In court, the defence questions the expert witnesses and makes its own applications for evidence to be taken, for example for a further IT expert report.
Good to know
The overview of the proceedings on the home page shows how the stages of criminal proceedings fit together.
IP address, account, offender: the question of proof
An IP address points to an internet connection, not to a person. Several people often use the same Wi-Fi, accounts get hacked and login details are passed on. Timestamps and log files can also contain errors.
We therefore check whether the investigators have proved the link between the data and the person. Was the data secured completely and in a way that can be traced? Does the analysis match the raw data? Are there other explanations? Where the file has gaps, we apply for a report by an independent expert.
For companies, there is an additional dimension. If suspicion falls on employees, for example staff with administrator rights, questions of employment law and data protection also arise. There is more on this under internal investigations and compliance.
Online defamation: when you are the target
Not everyone who comes to us is accused of something. Some people are attacked online themselves: with insults, false claims, threats or images shared without their consent. Many of these acts are criminal offences, for example as insult, defamation or intentional defamation (§§ 185–187 StGB), as threats (§ 241 StGB) or as a violation of intimate privacy through images (§ 201a StGB).
Secure the evidence: screenshots showing the date, time and address of the page.
§ 77b StGB
As a rule, insults are only prosecuted if the victim requests it. The request for prosecution (Strafantrag) must be made within three months of you learning of the offence and the offender.
§ 406e StPO
As a victim, you can inspect the investigation file through a lawyer
Unlawful content can be reported to the platform. We support you with this.
Good to know
We discuss with you whether civil claims for removal or for an injunction also make sense.
How we defend you
Karolin Hagemann de Grzymala, LL.M., certified specialist lawyer for criminal law in Aachen
Karolin Hagemann de Grzymala, LL.M., is a certified specialist lawyer for criminal law (Fachanwältin für Strafrecht). During her legal training, she worked at a criminal law firm and at a large commercial law firm, among others. She later became a partner at DMFH Fachanwälte für Strafrecht. She defends private individuals as well as companies and their employees.
In cybercrime cases, a great deal depends on technical details. We read forensic reports closely, put specific questions to the investigators and turn the results into a clear line of defence. Because sensitive data is often involved, we can advise you confidentially by video conference if you wish. The language of the consultation is agreed at first contact, and a sworn interpreter can be involved if needed.
What you should do now
Do not comment on the allegation, not even by email or chat. Do not delete any data or accounts, as this can be interpreted as tampering with evidence. Do not make a statement before we know the file, and call us. You can also send an enquiry via the contact page.
Cybercrime in Aachen
For larger cybercrime cases, North Rhine-Westphalia has a dedicated central unit, the ZAC NRW.
Aachen
In the Aachen area, the Public Prosecutor’s Office Aachen investigates, and in larger cases ZAC NRW as well. Devices are often analysed by police specialists.
Criminal defence lawyer in AachenOther practice areas
Defence for individuals and companies, from penalty orders to extradition proceedings.
Frequently asked questions
Short answers to questions about devices, data and accounts that often come up in a first consultation.
PasswordsDo I have to give the police my password or PIN?
No. As a suspect, you do not have to help prove your own guilt. Fingerprints can be a different matter: according to a 2025 decision of the Federal Court of Justice, the police may, under certain conditions, place your finger on the sensor by force.
DevicesWhen will I get my laptop or phone back?
That depends on how long the analysis takes. Often it is months. We can apply for the data to be copied and the devices returned earlier. You can challenge the seizure itself in court (§ 98 Abs. 2 StPO). If an offence is proved, the court can confiscate the devices that were used to commit it.
Money launderingMy account was used for other people’s transfers. Have I committed an offence?
That depends on what you knew or should have recognised. Reckless money laundering is also a criminal offence (§ 261 Abs. 6 StGB). Do not explain the background to the bank or the police before we have seen the file and your chat histories.
EvidenceIs an IP address enough as evidence?
On its own, it only shows which connection was used. It does not show who was sitting at the device. What matters is what other evidence the file contains and how reliable the analysis is.
DefamationWhat can I do about insults or false claims online?
First, secure evidence showing the date and the address of the page. Make a request for prosecution within three months (§ 77b StGB). We check with you which offences have been committed and support you in reporting the content to the platform.