Cybercrime covers illegal acts carried out through computers or the internet, and in 2024 alone, victims reported more than $16 billion in losses to the FBI.1FBI. FBI Releases Annual Internet Crime Report Federal law treats a computer as both a potential target of crime and a tool for committing one, and the penalties for either role can be severe. The categories below cover the main types, the statutes that reach them, and what you can do if you are the victim.
Hacking and Unauthorized Access
The Computer Fraud and Abuse Act is the backbone of federal cybercrime law. Enacted in 1986 and amended several times since, it covers nearly every way a person can misuse a computer or network and creates both criminal penalties and a private right of action for victims.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
At its core, the CFAA prohibits gaining unauthorized access to a computer or exceeding the access you do have. The Supreme Court narrowed that second phrase in 2021. In Van Buren v. United States, the Court held that someone “exceeds authorized access” only when they reach into areas of a system that are off-limits to them, like restricted files or databases they were never permitted to open. Using authorized access for an improper reason does not trigger the statute.3Supreme Court of the United States. Van Buren v. United States, 593 U.S. 374 (2021)
Beyond unauthorized access itself, the CFAA targets several specific attacks. Malware distribution covers transmitting viruses, worms, spyware, or ransomware that damages or takes control of a victim’s computer. Denial-of-service attacks flood a server or network with traffic until it becomes unavailable, and the distributed version harnesses thousands of compromised computers to amplify the assault. Password trafficking covers selling or distributing stolen login credentials or other tools that let unauthorized people into protected systems.
Penalties scale with severity. Intentionally damaging a computer through malware or a denial-of-service attack carries up to 10 years in prison for a first offense, jumping to 20 years for a repeat conviction. If the attack recklessly causes serious bodily injury, the maximum is 20 years; if it causes death, a life sentence is on the table. Password trafficking carries up to one year for a first offense and up to 10 years after a prior CFAA conviction.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
Victims also have a civil path. The CFAA lets anyone who suffers damage or loss from a violation sue for compensatory damages and injunctive relief. The suit must be filed within two years of the act or the discovery of the damage.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
Online Fraud and Scams
A large share of cybercrime is old-fashioned deception carried out through new channels. When someone uses the internet to execute a scheme to defraud, federal prosecutors often reach for the wire fraud statute, which predates the internet but applies squarely to online conduct. Wire fraud carries up to 20 years in prison, rising to 30 years if the scheme targets a financial institution.4Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
Phishing is the most common delivery method. Attackers send emails, text messages, or build websites that mimic legitimate businesses, trying to trick people into handing over credit card numbers, passwords, or other sensitive data. These messages usually manufacture urgency, claiming your account has been compromised or a payment is overdue. A more targeted version, sometimes called spear phishing, involves researching specific victims and crafting personalized messages that impersonate a colleague or business partner, often requesting a wire transfer. Romance scams, lottery scams, and auction fraud follow their own familiar patterns and are typically charged under the same wire fraud statute, depending on how the scheme is structured.
Federal law also addresses bulk fraudulent email operations. Sending commercial email using falsified header information or hijacked accounts can carry up to five years in prison when done to further another felony, or up to three years for high-volume operations.5Office of the Law Revision Counsel. 18 US Code 1037 – Fraud and Related Activity in Connection With Electronic Mail
Identity Theft
Identity theft means stealing someone’s personal information to impersonate them, typically for financial gain. The targeted data usually includes Social Security numbers, driver’s license numbers, or bank account details, and criminals use it to open credit accounts, file fraudulent tax returns, or take out loans in the victim’s name. A single large data breach can expose millions of records at once.
The Identity Theft and Assumption Deterrence Act of 1998 made this a standalone federal crime, prohibiting use of another person’s identifying information without authority and with intent to commit any unlawful activity.6Federal Trade Commission. Identity Theft and Assumption Deterrence Act Penalties come in tiers:
- Up to 15 years for producing or transferring forged government-issued identification or birth certificates, creating five or more fake identification documents, or using stolen identities to obtain $1,000 or more in value during a one-year period.
- Up to 5 years for other production, transfer, or use of false identification.
- Up to 20 years when the offense is connected to drug trafficking, a crime of violence, or follows a prior identity theft conviction.
- Up to 30 years when the offense facilitates domestic or international terrorism.
Congress added another layer with the Identity Theft Penalty Enhancement Act. “Aggravated identity theft” applies when someone uses stolen identity information during the commission of another felony. Conviction adds a mandatory two-year prison term that runs consecutively, stacking on top of whatever sentence the underlying felony carries. Courts cannot reduce the sentence for the underlying crime to offset the add-on.8Office of the Law Revision Counsel. 18 US Code 1028A – Aggravated Identity Theft
Cyberstalking and Online Threats
Some cybercrimes target a person’s safety rather than their wallet. Cyberstalking means using the internet or electronic communication to engage in a pattern of conduct that causes someone to reasonably fear for their safety or suffer serious emotional distress. It can include sending repeated threatening messages, monitoring someone’s online activity, tracking their physical location through technology, or posting their private information to intimidate them.
The federal stalking statute makes it a crime to use any electronic communication system in interstate commerce to engage in conduct that places a person in reasonable fear of death or serious bodily injury, or that causes substantial emotional distress. It applies to threats made through email, social media, messaging apps, or any other internet-based platform.9Office of the Law Revision Counsel. 18 USC 2261A – Stalking
A separate statute covers interstate threats more broadly. Sending a threat to kidnap or injure someone over the internet carries up to five years in prison. If the threat is made with intent to extort money, the maximum jumps to 20 years.10Office of the Law Revision Counsel. 18 US Code 875 – Interstate Communications Most states also have their own cyberstalking or harassment statutes with varying definitions and penalties, so victims facing online threats should consider both state and federal reporting options.
Intellectual Property Crimes
Theft of creative works and proprietary business information through computers forms its own category, with two main federal laws doing the work: one for copyrighted material and one for trade secrets.
Digital Piracy and the DMCA
Digital piracy is the unauthorized copying or distribution of copyrighted material, from downloading a movie off an unauthorized site to running a large-scale pirated software operation. The Digital Millennium Copyright Act of 1998 strengthened protections by making it a crime to bypass technological protection measures that control access to copyrighted works, such as encryption or digital rights management systems.11U.S. Copyright Office. The Digital Millennium Copyright Act
Criminal penalties for willful DMCA violations committed for commercial gain include fines up to $500,000 and imprisonment up to five years for a first offense. A second conviction doubles the stakes to $1,000,000 and 10 years.12Office of the Law Revision Counsel. 17 USC 1204 – Criminal Offenses and Penalties
Trade Secret Theft and Economic Espionage
When attackers hack a company’s network to steal product designs, source code, or customer databases, the conduct falls under the Economic Espionage Act. The law draws a sharp line between two situations. If the theft is intended to benefit a foreign government, it is economic espionage, carrying up to 15 years in prison and fines up to $5 million for individuals. Organizations face fines up to $10 million or three times the value of the stolen secret, whichever is greater.13Office of the Law Revision Counsel. 18 US Code 1831 – Economic Espionage
If the theft benefits a private competitor rather than a foreign government, it is charged as theft of trade secrets, with penalties up to 10 years in prison for individuals. Organizations convicted under this provision face fines up to $5 million or three times the value of the stolen secret.14Office of the Law Revision Counsel. 18 US Code 1832 – Theft of Trade Secrets
Online Child Sexual Exploitation
Federal law treats the production, distribution, and possession of child sexual abuse material as among the most serious computer-related crimes, with some of the harshest penalties in the federal code. Distributing, receiving, or transporting such material carries a mandatory minimum of 5 years and a maximum of 20 years in prison for a first offense. A prior conviction for a related sex offense raises the range to a 15-year minimum and 40-year maximum. Simple possession can result in up to 10 years, and if the material depicts a child under 12, the maximum doubles to 20 years.15Office of the Law Revision Counsel. 18 USC 2252 – Certain Activities Relating to Material Involving the Sexual Exploitation of Minors
Crimes against children discovered online should be reported to the National Center for Missing and Exploited Children rather than the general cybercrime reporting channels.16Internet Crime Complaint Center. Home Page
How to Report Cybercrime
If you are the victim of an internet crime, the FBI’s Internet Crime Complaint Center is the central federal portal. The IC3 accepts complaints about every type of cyber-enabled fraud, scam, and computer intrusion. Filing a report feeds data into FBI investigations and, in some fraud cases, can help freeze stolen funds before they disappear. The IC3 encourages reporting even if you are unsure whether your situation qualifies as a crime.16Internet Crime Complaint Center. Home Page
Preserving evidence matters as much as reporting quickly. Digital evidence is easy to delete or alter, so acting early strengthens any investigation or legal case. Take screenshots of threatening messages or fraudulent websites before they disappear. Save email headers that show the sender’s actual address. Keep records of any financial transactions involved. Avoid deleting messages or clearing browser history. If the crime involves ongoing harassment or stalking, the person doing it may have access to your devices or accounts, so change passwords and secure your accounts before collecting evidence to keep the perpetrator from destroying it.
Rules are stricter for critical infrastructure operators like hospitals and energy companies. The Cyber Incident Reporting for Critical Infrastructure Act requires reporting major cyber incidents to the Cybersecurity and Infrastructure Security Agency within 72 hours of detection. Ransomware payments made by these entities must be reported within 24 hours. The clock starts when the organization first suspects a significant incident, not when the forensic investigation wraps up.