You are suspected of a cybercrime: what to do in the first 24 hours?

Have you been served with a notice of suspicion of unauthorised access, cyber fraud or crypto related offences? The first 24 hours after service are critical – mistakes at this point can seriously complicate the defence. Attorney Vitalii Petryk explains what to do and what to avoid at all costs.

Key points

• From the moment you receive a notice of suspicion you acquire the status of a suspect and the right to a defence lawyer (Article 42 CPC).
• You have the right to remain silent and not to incriminate yourself – a constitutional right (Article 63 of the Constitution).
• The first thing to do is call a lawyer, not explain to the investigator how it really was.
• In cyber cases the investigation gathers digital evidence rapidly: every hour without legal protection can matter.
• Do not delete files, correspondence or accounts after receiving a suspicion – this may add a charge of destroying evidence.

What are your rights from the moment of suspicion?

Once a notice of suspicion is served you are officially a suspect in criminal proceedings. The CPC (Article 42) guarantees you the following rights:

• To know what you are suspected of and to receive a copy of the notice.
• To have a defence lawyer from the moment of service, or earlier if you are detained.
• To remain silent and not to give evidence that may be used against you.
• To review the case materials in the manner set out in the CPC.
• To submit evidence and file applications.
• To challenge decisions, acts and omissions of the investigator, prosecutor and court.

What must you absolutely NOT do after receiving a suspicion?

• Give explanations to the investigator without a lawyer. “I will just explain how it was” is the most common mistake. Every word is recorded and may be used against you.
• Delete files, correspondence, accounts or logs. Destroying potential evidence is a separate offence (Article 396 of the Criminal Code) and sharply worsens your position.
• Provide passwords or device access without a court decision. You are not obliged to do so.
• Discuss the case with colleagues, friends or in messengers. All of those people may be questioned as witnesses.
• Contact the victim or witnesses yourself. This may be treated as obstruction of the investigation.

First steps: what to do in the first 24 hours

1. Call a lawyer immediately after service, or even during the investigative action.
2. Read the notice carefully – which articles of the Criminal Code, which specific acts are alleged, what date and circumstances.
3. Sign nothing without reviewing it with your lawyer – neither reports nor agreements.
4. Record all circumstances of service: time, place, who was present, whether the procedure was observed.
5. Publish nothing on social media about the case or your position.

How does the investigation gather evidence in cyber cases?

Understanding investigative methods helps to build the defence correctly:

• Seizure and examination of devices: phones, laptops, servers – the investigation obtains a court ruling and seizes them for forensic analysis.
• Analysis of network traffic and IP addresses: provider logs, connection data, metadata.
• Requests to platforms and services: Google, Apple, Telegram, exchanges, cloud storage.
• Blockchain analysis: in cryptocurrency cases the investigation engages specialists to trace transactions.
• Witness interviews: colleagues, employees, clients, people from your correspondence.

Which defence tactics work in cyber cases?

An effective defence in cyber cases works on several fronts at once:

• Challenging the admissibility of evidence obtained in breach of procedure (Article 87 CPC).
• Engaging an independent technical expert for an alternative analysis of the digital evidence.
• Checking compliance with time limits and procedures for investigative actions.
• Applying to close the proceedings or reclassify the charge where the evidence is insufficient.
• Building an alternative version of events supported by technical evidence and testimony.

Frequently asked questions

If I have not been detained, must I attend when the investigator summons me?

A suspect must attend when summoned by the investigator (Article 42 CPC), but has the right to give evidence in the presence of a lawyer. Ignoring summonses may lead to compulsory attendance or a preventive measure.

Can I be arrested immediately after being served with a suspicion?

Service of a suspicion is not an automatic ground for arrest. The investigation must apply separately to the court for a preventive measure (Articles 176-183 CPC). A lawyer can challenge any preventive measure.

How long can a pre-trial investigation in a cyber case last?

Time limits depend on the gravity of the offence and the complexity of the case. A lawyer can monitor compliance with procedural deadlines and challenge breaches.

Can I travel abroad after receiving a suspicion?

It depends on the preventive measure chosen. Without a prohibition, formally yes. But the investigation may ask the court to impose a duty not to leave. Consult a lawyer before any travel.

What is a plea agreement and should I sign one?

A plea agreement (Articles 468-475 CPC) can reduce the sentence in exchange for admitting guilt. Whether to sign is a decision to be taken solely together with a lawyer after a careful analysis of the evidence.

Read also: Unauthorised interference with IT systems (Article 361) | A search at an IT company: rights and algorithm | Legal services

Received a suspicion in a cybercrime case and unsure what to do?

Attorney Vitalii Petryk specialises in criminal defence in cases of cybercrime, unauthorised access and digital economy offences.

• Phone: +38 (096) 878-07-36
• Email: info@advokat-petrik.com
• Address: Kyiv, Holosiivskyi Avenue 132, RELE Business Centre

This article is informational and is not legal advice. To assess your specific situation, contact an attorney.