Stalking: how to gather evidence that holds up in court.

Messages arriving at all hours, even after a «stop» said in the clearest possible terms. The car parked at the end of the street when you leave the house. The new profile that reappears punctually every time you block one. The person you run into «by chance» outside the office, at the gym, at your children's school gates. People who suffer persecutory conduct almost always describe the same dynamic: not a single dramatic episode, but a sum of small facts that, taken one by one, look like very little - and put together change the way they live, move around, sleep.

And that is exactly where the most frustrating question arises: how do I prove it? Many complaints stall not because the facts did not happen, but because they stay in the grey area of one person's word against another's. This guide explains what art. 612-bis of the Italian Criminal Code actually requires, how to document the repeated nature of the conduct without making mistakes that render the evidence unusable, when a warning from the Questore (the provincial chief of police) is preferable to a criminal complaint, and what role an authorized investigation agency can play. One non-negotiable premise: if there is immediate danger, call 112, and for guidance and support there is the anti-violence and anti-stalking helpline 1522, available 24 hours a day. No private investigation replaces law enforcement.

What art. 612-bis of the Italian Criminal Code actually says

The offence of persecutory conduct punishes anyone who, through repeated conduct, threatens or harasses a person in such a way as to cause at least one of these three outcomes:

• a persistent and serious state of anxiety or fear;
• a well-founded fear for the safety of oneself, of a close relative or of a person bound by an emotional relationship;
• being forced to change one's habits of life: changing route, hours, phone number, gym, even home or job.

Two words hold up the entire evidentiary structure. The first is repeated: a series of acts is required, not an isolated episode. The second is outcome: proving that the messages arrived is not enough, you have to show the effect they produced on the victim. Following legge 69/2019 (the so-called Codice Rosso) the penalty ranges from 1 year to 6 years and 6 months, with increases when the offence is committed by a spouse, including a separated or divorced one, by a person bound by an emotional relationship, through IT or electronic means, or against a minor, a pregnant woman or a person with a disability.

In practice: a solid case file is not a list of insults. It is a chronology that shows how often the conduct occurred and, alongside it, the concrete signs of its impact - the doctor's or psychologist's certificate, the request to change shifts at work, the report of the old number being given up, the house move brought forward.

Criminal complaint, police warning or ex officio prosecution: the available routes

For persecutory conduct the deadline for filing a criminal complaint is six months - twice the ordinary one - and it runs from the last act. Once filed, it can be withdrawn only in court, and the complaint is irrevocable when the offence was committed through serious and repeated threats. Prosecution proceeds ex officio, on the other hand, when the injured party is a minor or a person with a disability, when the offence is connected to another offence prosecutable ex officio, and when the perpetrator has already been formally warned by the Questore.

That warning (ammonimento) is precisely the tool many victims are unaware of. It is a preventive measure: it is requested from the Questore before filing a criminal complaint, it moves quickly and, if granted, the perpetrator is formally ordered to stop. If the conduct continues after the warning, the offence becomes prosecutable ex officio and the penalty is increased. Here too, however, the application has to be backed up: the Questore assesses concrete evidence, not impressions.

The Codice Rosso imposes a fast track: the public prosecutor must hear the injured party within three days of the crime report being registered. Arriving at that hearing with a chronology already in order and with the files properly preserved radically changes the quality of what goes on the record.

Why one person's word against another's is not enough

In criminal proceedings the injured party's statement carries evidentiary weight, but it needs corroboration - all the more so when the suspect offers an alternative reading of the facts: the relationship that was never truly over, the «chance» encounters in a small neighbourhood, the messages presented as mutual. Without external corroboration the file stays fragile and dismissal becomes a frequent outcome.

Corroboration that works has three features: it is dated (verifiable date and time), continuous (it shows repetition, not an isolated peak) and third-party (witnesses, cameras, medical records, company logs). Every element that moves the proof outside the victim's own account increases its weight.

The event diary: the most underrated tool

It is the first thing we ask people to start, from day zero. A diary kept properly is what turns a blurred memory into a verifiable sequence. For each episode, note down:

1. The exact date and time, and the precise location (a street address, not «near home»).
2. What happened, in a few factual lines: what they said or did, for how long, how it ended.
3. Who was present: name and contact details of any witnesses, even just the barista or the neighbour across the landing.
4. The effect on you: what you had to change, whether you saw a doctor, whether you avoided a place.
5. The file reference: screenshot number, audio file name, licence plate written down. The diary is the index, the files are the attachments.

Two technical precautions that count for a great deal: fill in the diary immediately, not from memory months later, and give it a certain date - for example by periodically sending the file to yourself by certified email (PEC), or lodging it with your lawyer. And never delete or alter the originals: messages, calls and voice notes must be left on the device where they arrived.

What you can lawfully document (and what blows everything up)

This is where the most delicate part of the game is played: badly gathered evidence is not merely useless, it can backfire on whoever obtained it. In short, with the caveat that every case has to be assessed with your own lawyer:

• Recording a conversation you are taking part in - in person or on the phone - is lawful, and the recording can be used as documentary evidence. Recording conversations between third parties, on the other hand, in private dwellings and without being a party to them, amounts to the offence of unlawful interference with private life (art. 615-bis c.p.).
• Photographing or filming in a public place is permitted for the purpose of protecting a right in legal proceedings; filming inside someone else's home or other private dwellings is prohibited.
• Screenshots are fragile. They are easily challenged as altered: when a message is central to the case, a forensic copy of the device or of the chat is better, with hash calculation and preservation of the metadata. And keep the original phone, not just the exported images.
• Never install spyware on the alleged stalker's phone or a GPS tracker on their car. It is an understandable but serious mistake: it exposes you to criminal liability and renders the evidence unusable. We devoted a separate piece to the subject in GPS tracker on a car: when it's a crime.
• Do not provoke an escalation in order to get a reaction on camera. Beyond the concrete risk to your safety, it opens the door to a counter-complaint and shifts the proceedings onto the ground of mutual conflict.

Digital stalking: fake profiles, cloned accounts, stalkerware

A growing share of this conduct goes through the phone. The most recurrent forms are profiles created and recreated after every block, false identities used to get close to friends and family, the circulation of private content, defamatory reviews and posts, and silent monitoring through stalkerware installed on the victim's device - often during the relationship, when access to the phone was normal.

On the attribution side, an OSINT and cyber investigation analysis works on the traces accounts leave behind: recurring times and language, reuse of images and nicknames, correlations between apparently unconnected profiles. The result is not a name pulled out of a hat, but a documented body of circumstantial evidence that defence counsel can bring before the judicial authority so that it orders the technical checks only the authority can order.

On the defensive side, if you suspect someone knows too much about your movements, checking your device comes before anything else: a phone sweep for spyware identifies monitoring apps, anomalous configuration profiles and unauthorized access to accounts. We have written a practical guide on the signs to look out for: how to find hidden bugs and tell if your phone is tapped.

The role of the private investigator and defensive investigations

An agency holding a prefectural licence under art. 134 TULPS does not take the place of the judicial police: it supports the injured party and their lawyer in the part that falls to it, namely building an orderly evidentiary foundation. Within the scope of defensive investigations under artt. 327-bis and 391-bis c.p.p., instructed by defence counsel, the typical activity includes:

• Documenting the repetition through observation in public places, photos and video with certified date and time, corroboration of stakeouts outside the home or the workplace.
• Identifying the perpetrator when the conduct is anonymous or screened behind fake profiles, cross-referencing open sources and field checks.
• Tracing and collecting statements from people informed of the facts, in the forms prescribed by the code when the instruction comes from defence counsel.
• Crystallizing digital evidence with a chain of custody, so that it cannot be challenged at trial.
• Drafting a forensic report that is chronological and documented, usable in criminal proceedings, in civil ones (compensation for damages) and in family proceedings, where it also weighs on decisions concerning children - as we explain in the article on sole custody to protect children.

The other side of the coin holds as well, and it should be said honestly: the same defensive investigations serve those on the receiving end of an instrumental complaint, perhaps filed in the middle of a bitter separation, to reconstruct what actually happened. Our job is to document reality, wherever it leads. For the full scope of the service, see the page on stalking and persecutory conduct investigations; some anonymized examples are in our publishable cases.

Assessing the risk, not just gathering evidence

There is a question that comes before the evidence: how dangerous is this person, right now? Some signals point to a risk of escalation and have to be read straight away - a relationship that has just ended, obsessive monitoring of movements, threats of suicide or retaliation, the presence of weapons, children being drawn in, a sudden increase in the frequency of contact.

In these cases evidence gathering runs in parallel with protective measures: support with personal safety planning - from reviewing daily habits through to structured personal protection services in the most critical phases - and full cooperation with law enforcement, which holds the tools no private party possesses: precautionary measures, restraining orders, electronic tagging. Our work stands alongside that of the authorities, not in its place.

On timing: an engagement concerning persecutory conduct normally unfolds over several weeks, because it is continuity that makes the proof. Objectives, duration and budget are set out in writing before we begin - an overview of rates is on the page about how much a private investigator costs.

Sesto San Giovanni, North Milan and Brianza: a first confidential consultation

Arcadia Company's operational headquarters is in Sesto San Giovanni, at Piazza Don Mapelli 60: a position that allows us to move quickly across Milan and the entire northern belt - Cinisello Balsamo, Cologno Monzese, Bresso, Cusano Milanino - and the province of Monza and Brianza, with operations extending throughout Italy.

Every engagement starts with a confidential consultation, protected by professional secrecy, in which we assess together the situation, the level of risk and the real evidentiary viability of the case: if the right route is a different one - the warning from the Questore, 112, an anti-violence centre - we tell you beforehand, not afterwards. We process data in compliance with the Regolamento UE 2016/679 and work with an ISO 9001 certified method. If you are living through a situation like this, request a confidential analysis: the preliminary assessment comes with no commitment.