When are Austrian criminal law enforcement authorities (police and public prosecutors) entitled to take action?
- Territoriality as the Starting Point – “Domestic Offence”
As a general rule, Austrian criminal law is based on the principle of territoriality (Section 62 of the Austrian Criminal Code “StGB”). This means that offences fall under Austrian jurisdiction if they are committed in Austria. Whether an offence is deemed to have been committed “within Austria” is determined by Section 67 (2) StGB. According to this provision, an offence is considered to have been committed at the place where
- the perpetrator acted (place of action), or
- the legally relevant result occurred (place of result).
In cybercrime cases, this distinction is often problematic, as the place of action and the place of result frequently lie in different countries.
Example: A perpetrator drafts a phishing email in Germany. The victim transfers funds from Austria to a bank account in France. Whether Austrian authorities are competent in such a scenario is not always straightforward.
- Jurisdiction Even Without a Domestic Offence (Section 64 StGB)
In certain constellations, Austrian criminal law applies even if both the act and the result occurred entirely abroad. Section 64 StGB provides for extraterritorial jurisdiction with respect to specific criminal offences.
In the cybercrime context, the following offences are particularly relevant:
- espionage of business or trade secrets for the benefit of a foreign state
- participation in a criminal Organisation
- aggravated coercion
- money laundering
In addition, persons who contribute from abroad to an offence committed in Austria may also be prosecuted under Austrian law (Section 64 (1) no 8 StGB).
Example: A person located in Switzerland shares, likes or comments on criminal content posted on Instagram or Facebook by a perpetrator acting in Austria.
- Cybercrime Offences of Practical Relevance and Austrian Jurisdiction
a) Fraud (Section 146 StGB) and Extortion (Section 144 StGB)
Fraud and extortion are classic result-based offences under Austrian criminal law.
Jurisdiction is determined by the place where the financial damage occurs. This is the location where the victim loses the ability to freely dispose of the affected assets – for example, where a transfer is made to a third-party bank account held with the victim’s bank.
Until recently, Austrian jurisdiction was therefore typically established where the victim initiated the transfer from an Austrian bank account.
Supreme Court update (2025): In 2025, the Austrian Supreme Court clarified that a legally relevant intermediate result is sufficient to establish Austrian jurisdiction, even if the actual financial loss materialises only abroad. This constitutes a significant facilitation for victims of crypto fraud and investment scams, where perpetrators often exploit intermediary foreign bank accounts or crypto accounts.
b) Cyberbullying (Section 107c StGB)
Cyberbullying constitutes both a result-based offence and, potentially, an endangerment offence.
Jurisdiction depends on whether the perpetrator used telecommunications services or a computer system located in Austria to commit the offence, or whether the violation of honour is perceptible in Austria “for a longer period of time”.
Accordingly, Austrian law enforcement authorities will regularly have jurisdiction if the relevant content is accessible within Austria.
c) Hacking – Unauthorised Access (Section 118a StGB)
Hacking in the criminal law sense occurs where a perpetrator gains access to a computer system over which they have no (or no exclusive) right of control by overcoming a specific security measure.
A domestic place of offence exists where the perpetrator accesses the system from Austria (place of action) or where the attacked computer system itself is located in Austria (place of result).
d) Data Interference (Section 126a StGB)
Criminal data interference is committed where a person causes damage by altering, deleting, suppressing or otherwise rendering unusable data that are processed, transmitted or made available by automated means and over which the perpetrator has no (or no exclusive) right of control.
As Section 126a StGB requires the occurrence of damage, it constitutes a result-based offence.
Austrian jurisdiction therefore also applies where the perpetrator acts abroad, provided that the damage occurs to data located in Austria.
e) Misuse of Computer Programs (Section 126c StGB)
Section 126c StGB criminalises the manufacture of computer programs intended to unlawfully obtain access to data.
This offence frequently constitutes a preparatory act for other cybercrime offences. It is a pure conduct-based offence and does not require the occurrence of any damage.
Austrian criminal jurisdiction is established where the preparatory act is carried out within Austria.
f) Data Falsification (Section 225a StGB)
Under Section 225a StGB, criminal liability arises where a person creates false data or falsifies genuine data by entering, altering, deleting or suppressing data, with the intention that such data be used as evidence of a right or a legally relevant fact.
For the purpose of establishing Austrian jurisdiction, it is sufficient that genuine data are falsified in Austria or that false data are produced in Austria.
4. Conclusion
Whether Austrian police and public prosecutors initiate investigations depends on the specific type of offence involved and on whether it qualifies as a conduct-based or result-based offence.
Where perpetrators act from abroad, Austrian jurisdiction generally arises only in relation to result-based offences. In complex cybercrime cases, however, intermediate results or the mere perceptibility of harmful effects within Austria may already be sufficient to establish jurisdiction.
For further analysis, we refer to the specialist publication by Dr Paul Krepil, “Cybercrime and Domestic Jurisdiction” (ecolex 2025/426).
5. Legal Support in Cybercrime Matters
Cybercrime cases are both technically and legally demanding. Questions of international jurisdiction determine whether Austrian authorities may initiate proceedings or whether affected parties must pursue their claims abroad. This is relevant both for victims of cybercrime and for the defence of accused persons.
Do you require legal support? LEUKOS provides legal support, in particular, in the following areas:
- assessment of criminal liability and jurisdiction
- representation of victims and defence of accused persons in criminal and civil proceedings
- international cooperation and mutual legal assistance in cross-border matters
- tracing and recovery of misappropriated assets
Contact LEUKOS for a confidential consultation.