Cybercrime in Morocco: Complete 2026 Guide for Victims

Cybercrime in Morocco does not correspond to a single offence. Depending on the facts, the victim may rely on the special provisions governing computer systems, as well as the conventional provisions relating to fraud, blackmail, threats or invasion of privacy. The precise legal classification is highly important: it determines the applicable penalties, the available investigative measures and the court with jurisdiction. In practical terms, a hacked Facebook account, a fake banking website and the dissemination of an intimate video do not necessarily fall under the same articles.

The central text is Law No. 07-03, which introduced Articles 607-3 to 607-11 concerning attacks against automated data-processing systems into the Criminal Code. Article 607-3 punishes, in particular, unauthorised access to all or part of a computer system, as well as unlawfully remaining within that system. Depending on the circumstances, the following articles punish interference with operations, the fraudulent introduction or alteration of data, the falsification of computerised documents and participation in a group preparing such offences.

Other texts supplement this framework. Article 540 of the Criminal Code punishes fraud, including when committed through phishing, fake e-commerce or messaging-platform manipulation. Articles 447-1 to 447-3 protect privacy against the recording or non-consensual dissemination of statements, private images, manipulated content or false allegations. Caution: Article 447-2 is sometimes presented as a general provision on digital identity theft, whereas it more specifically covers certain forms of dissemination and manipulated content; identity theft may require several cumulative legal classifications.

Law No. 09-08 protects individuals against unlawful personal data processing and establishes oversight by the CNDP. Law No. 53-05, supplemented by legislation on trust services, governs electronic documents and signatures; Article 417-1 of the Code of Obligations and Contracts recognises the evidentiary value of electronic documents under certain conditions. Recent international cybercrime initiatives are gradually facilitating cooperation, but they replace neither a Moroccan criminal complaint nor national rules on evidence and jurisdiction.

The first priority is to preserve anything that might disappear. A useful screenshot shows the content, account name, date, time and, where possible, the full URL. Also capture the profile, the entire conversation and the context preceding the threat. Do not crop the only copy or add annotations to the original. Create a working copy, then save the files on two separate storage media. Evidence is freely assessed by the criminal court, but its authenticity may be challenged.

For decisive public content, a report drawn up by a judicial commissioner is often preferable to a simple screenshot. The professional describes the screen, the address accessed, the visible account, the date and the actions performed. The report does not automatically make every published statement true, but it provides stronger proof that the content existed at the time of the intervention. In practice in 2026, a simple digital report often costs between 500 and 1,500 DH, depending on travel, the number of pages and the requested operations.

Keep suspicious emails in their original mailbox and, if possible, export them in a format that preserves the technical headers. An ordinary forwarded message may alter or conceal certain useful metadata. For WhatsApp or similar messaging services, keep the original phone, export the conversation without deleting messages and record the full number with its international dialling code. Invoices, bank statements, transfer receipts, transaction numbers and responses from the platform help connect the digital event to the financial loss.

A computer forensic examination is useful when it is necessary to identify an intrusion, recover logs, establish the origin of a connection or verify a file’s integrity. Prefer an expert registered on a Court of Appeal list when the report is to be submitted in court. A private analysis commonly costs between 3,000 and 15,000 DH in 2026, depending on the volume of data and the assignment; this range is based on professional practice, not a mandatory national fee schedule. The investigator or judge may also order an independent expert examination.

Prepare a paper file and an organised digital copy. The first page should summarise the facts in a one- or two-page chronology. Attach a copy of the electronic national identity card, passport or residence permit, then number each item of evidence. For a company, add a recent registration certificate, documents establishing the representative’s authority and, where necessary, the authorisation granted to the employee responsible for filing the complaint. The originals must remain available for presentation to investigators or the court.

A simple criminal complaint filed with the police, Royal Gendarmerie or Public Prosecutor’s Office is free and does not require a fiscal stamp for each page. You should therefore be wary of general claims that a 20 DH stamp is automatically required to file a complaint. Costs may nevertheless arise for a formal report, certified copies, a translation, a private expert examination or a lawyer’s services. A complaint combined with an application to join the proceedings as a civil party may also require a security deposit set by the investigating judge, the amount of which depends on the case and the complainant’s resources.

Lawyers’ fees are not set by a mandatory national fee schedule for this type of case. Depending on the city, complexity, hearings and investigations, criminal-law representation may cost approximately 3,000 to 20,000 DH in 2026, and sometimes more for an international or corporate case. An initial retainer of 2,000 to 5,000 DH is common in practice in Casablanca and Rabat. Request a written fee agreement specifying the services included, expenses, travel and the handling of any appeal.

Investigation time frames vary considerably. A simple case involving an identified perpetrator may progress within a few weeks or months, whereas a case requiring data held by Meta, Google, TikTok, a foreign bank or an international hosting provider may take much longer. In practice, a complex judicial investigation often takes six to eighteen months, and sometimes longer; this is not a guaranteed time frame. International requests alone may take several months. Follow up on the case periodically using its reference, without filing multiple identical and uncoordinated complaints.

The offender’s criminal conviction does not automatically reimburse the victim. To seek compensation before the criminal court, the victim must join the proceedings as a civil party and quantify, as far as possible, the harm suffered. Articles 77 and 78 of the Code of Obligations and Contracts establish liability for a wrongful act that caused harm. You may claim the misappropriated amount, expenses directly caused by the attack, proven professional losses, and non-pecuniary harm, but each amount must be explained and supported by documents.

An application to join the proceedings as a civil party may be made during the proceedings in accordance with the forms prescribed by the Code of Criminal Procedure, particularly before the trial court. In certain sufficiently serious and documented cases, a complaint with an application to join the proceedings as a civil party may be filed with the investigating judge pursuant to Articles 92 et seq. of the Code of Criminal Procedure. The judge may set a deposit intended to cover procedural costs. This avenue should not be pursued automatically: an abusive or insufficiently substantiated complaint may have financial and procedural consequences.

A decision by the King’s Public Prosecutor to close a case without further action is not a judgment of innocence and does not, by itself, extinguish all remedies. The victim may submit new evidence to the Public Prosecutor’s Office, send a reasoned complaint to the King’s Prosecutor General at the Court of Appeal, or consider with a lawyer filing a complaint with an application to join the proceedings as a civil party. A direct summons may also be considered for certain misdemeanors when the offender has been identified, the offender’s address is known, and the evidence is sufficient to support the accusation at the hearing.

Obtaining a favorable judgment and actually recovering the money are two different matters. If the offender has no identifiable assets or has transferred the funds abroad, enforcement may remain difficult. Where there is a risk that assets will be dissipated, a lawyer may consider a protective attachment in accordance with the applicable procedural requirements. Bank details, known assets, any company operated, and identifiable income are then useful. The judge retains control over the measure and the amount of damages; no compensation can be promised in advance.

The first mistake is waiting for content to be deleted before taking action. A post, story, or fraudulent account can disappear within minutes. The second is believing that a report to Facebook, a bank, the CNDP, or maCERT constitutes a criminal complaint. These steps are useful, but only referral to the competent judicial authorities can initiate a criminal justice response. Retain confirmation of each report, then file a structured complaint with the police, the Royal Gendarmerie, or the Public Prosecutor’s Office.

Also avoid altering the evidence. Do not reset the compromised phone, delete the phishing email, or forward all messages in a way that loses their technical data. Nor should you attempt to hack the offender’s account to identify them: you could yourself commit unauthorized access within the meaning of Article 607-3. Searches must remain lawful, and sensitive identification requests must be made through an order issued by the police, the Public Prosecutor’s Office, or the judge.

A criminal defense lawyer is particularly useful when the harm is substantial, the offender is unknown, the facts are international, or the complaint has been closed without further action. The lawyer legally classifies the offenses without limiting them to the term “hacking,” organizes the documents, quantifies the civil claim, and chooses between a simple complaint, joining the proceedings as a civil party, and a direct summons. The lawyer may also request investigative measures, prepare the victim’s interview, and follow up on the case reference with the Public Prosecutor’s Office. However, the lawyer’s role is neither to conduct a covert investigation nor to guarantee a conviction.

Before a consultation, prepare a timeline, a list of accounts and numbers, the original evidence, and the provisional total amount of the harm. Ask the lawyer about their experience with digital evidence, expert assessments, and international mutual legal assistance. The profession is governed by Law No. 28-08 on the organization of the legal profession. A clear fee agreement limits misunderstandings concerning hearings, appeals, expert assessments, and enforcement. The clearer the case file is from the outset, the more precise the requests addressed to investigators can be.