Email spoofing is illegal under federal law whenever the forged header or disguised sender address is used to defraud someone, steal an identity, or send deceptive commercial mail. The technical act of altering a “From” line is not itself a crime, and plenty of legitimate uses exist. What turns spoofing into a federal offense is intent: the moment a spoofed message is designed to trick a recipient into giving up money, credentials, or data, prosecutors have several statutes to work with, carrying penalties from one year in prison up to 30 years when a financial institution is involved.
When Spoofing Becomes a Crime
The underlying email protocol doesn’t verify sender identity, which is why modifying header information is technically trivial. IT teams test mail servers that way. Security researchers probe for vulnerabilities. Automated systems routinely send messages on behalf of employees. None of that is criminal because no one is being deceived for gain or harm.
The legal picture changes the moment a spoofed email is built to deceive. Forging a bank’s address to harvest login credentials, impersonating an executive to redirect a wire transfer, or disguising the origin of bulk commercial messages all take a lawful technical act and convert it into a tool of fraud. Federal prosecutors are not pursuing people who send a single misleading email as a joke. They pursue people who use spoofed emails to steal money, data, or identities. Intent to defraud is the hinge.
The Federal Laws That Apply
There is no standalone federal “email spoofing” statute. Prosecutors instead draw from several overlapping laws depending on what the spoofed message was used to accomplish.
Wire Fraud
Wire fraud under 18 U.S.C. 1343 is the workhorse charge. It covers anyone who devises a scheme to defraud and uses electronic communications to carry it out. Because every spoofed email crosses interstate networks, almost any email-based fraud qualifies, and each individual email can be charged as a separate count.1Office of the Law Revision Counsel. 18 USC 1343: Fraud by Wire, Radio, or Television
Computer Fraud and Abuse Act
The CFAA, 18 U.S.C. 1030, is the broad federal computer-crime statute. It targets anyone who accesses a computer without authorization, or who exceeds the access granted, to obtain information or cause damage. A spoofed email that tricks the recipient into clicking a link that installs malware or hands over credentials can bring the sender within this law. The statute reaches any system connected to interstate or foreign commerce, which effectively means any system on the internet.2Office of the Law Revision Counsel. 18 USC 1030: Fraud and Related Activity in Connection With Computers
CAN-SPAM Act and Its Criminal Counterpart
The CAN-SPAM Act, 15 U.S.C. 7704, directly targets misleading commercial email. It makes it unlawful to send a commercial message with materially false or misleading header information, including forged “From” addresses, deceptive routing data, or domain names obtained through fraudulent registration.3Office of the Law Revision Counsel. 15 U.S. Code 7704 – Other Protections for Users of Commercial Electronic Mail A header can be deemed misleading even if the address itself is technically valid, as long as the sender gained access to that address or domain through deception. CAN-SPAM applies to commercial messages, not personal emails.
The criminal companion is 18 U.S.C. 1037. It is a federal crime to falsify header information in bulk commercial emails, to use a protected computer to relay messages while disguising their origin, or to register email accounts and domains with fake identity information to send spam.4Office of the Law Revision Counsel. 18 U.S. Code 1037 – Fraud and Related Activity in Connection With Electronic Mail
Identity Theft Statutes
When a spoofed email impersonates a real person or organization to collect personal data, federal identity theft laws apply. Under 18 U.S.C. 1028, producing or using a false identification document or misusing someone’s personal identifiers is a federal crime carrying up to 15 years in prison for most offenses.5Office of the Law Revision Counsel. 18 U.S. Code 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
The aggravated identity theft statute, 18 U.S.C. 1028A, adds a mandatory two-year prison sentence on top of whatever punishment the underlying crime carries. The enhancement applies when someone uses another person’s identity during a felony such as wire fraud or computer fraud. Those two years must run consecutively, meaning a judge cannot let them overlap with the sentence for the underlying crime, and probation is not available.6Office of the Law Revision Counsel. 18 USC 1028A: Aggravated Identity Theft
Prison Time and Fines
Exposure depends on the statute charged and the scope of the scheme. The maximum sentences for the common charges:
- Wire fraud: Up to 20 years per count. If the scheme affects a financial institution, the maximum rises to 30 years and a fine of up to $1,000,000.1Office of the Law Revision Counsel. 18 USC 1343: Fraud by Wire, Radio, or Television
- Computer fraud (CFAA): One year for basic unauthorized access, up to five years when the offense was committed for financial gain or in furtherance of another crime, up to ten years for a first offense involving certain protected information, and up to 20 years for repeat offenders.2Office of the Law Revision Counsel. 18 USC 1030: Fraud and Related Activity in Connection With Computers
- Criminal email fraud (18 U.S.C. 1037): Up to five years if the spoofing was part of a felony or the defendant has a prior conviction. Up to three years for high-volume spam (more than 2,500 messages in 24 hours, for example) or schemes causing more than $5,000 in losses. Up to one year otherwise.4Office of the Law Revision Counsel. 18 U.S. Code 1037 – Fraud and Related Activity in Connection With Electronic Mail
- Identity fraud: Up to 15 years for most offenses, 20 years when connected to drug trafficking or a crime of violence, and 30 years when connected to terrorism.5Office of the Law Revision Counsel. 18 U.S. Code 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
- Aggravated identity theft: A mandatory two additional years, served consecutively, whenever someone uses another person’s identity to commit wire fraud, computer fraud, or a related felony.6Office of the Law Revision Counsel. 18 USC 1028A: Aggravated Identity Theft
These charges stack. A single business email compromise scheme can produce wire fraud charges, CFAA charges, and an aggravated identity theft enhancement at the same time. Because each spoofed email can be a separate count of wire fraud, a defendant who sent 15 fraudulent emails theoretically faces 15 separate 20-year counts. Sentences typically also include supervised release and a permanent federal conviction record.
Business email compromise is where this stacking shows up most often. The FBI’s Internet Crime Complaint Center reported $2.77 billion in BEC losses in 2024.7Internet Crime Complaint Center (IC3). 2024 IC3 Annual Report Federal investigators trace the money through banking records and cryptocurrency ledgers, so the assumption that spoofed emails are untraceable is wrong more often than attackers expect.
Civil Penalties for Commercial Spoofing
On top of criminal exposure, CAN-SPAM carries civil penalties of up to $53,088 for each individual email that violates the law, adjusted periodically for inflation.8Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business A sender that pushes out 10,000 messages with falsified headers faces potential liability exceeding $530 million. That math is why even a modest commercial spoofing operation can produce ruinous financial consequences.
Enforcement sits with the FTC, other federal regulators depending on the industry, and state attorneys general.9Office of the Law Revision Counsel. 15 U.S. Code 7706 – Enforcement Generally Individual consumers cannot sue under CAN-SPAM. Internet access service providers can bring a private civil action if they were adversely affected by the spoofed messages, but that right is limited to the providers themselves, not their subscribers.
When Spoofing Is Legal
Good-Faith Security Research
The Department of Justice announced in May 2022 that it will not prosecute good-faith security researchers under the CFAA. The policy defines good-faith research as accessing a computer solely to test, investigate, or correct a security flaw, in a manner designed to avoid harm, where the findings are used to improve the security of the devices or services involved.10Department of Justice. Department of Justice Announces New Policy for Charging Cases Under Computer Fraud and Abuse Act Security professionals who send spoofed emails as part of authorized penetration testing fall within that policy. Research done to find vulnerabilities for the purpose of extortion does not qualify, even when the attacker calls it research.11Justice Manual. 9-48.000 – Computer Fraud
Authorized Testing and Internal Use
Companies routinely send simulated phishing messages to their own employees as part of security awareness training. Email administrators test server configurations by modifying headers. Automated systems send messages on behalf of other users inside an organization. All of these involve a form of spoofing, and all are legal because they happen with authorization and without intent to deceive for gain.
Parody and Satire
The First Amendment protects parody and satire. A spoofed email that is obviously humorous and not designed to trick anyone into giving up money or data generally falls within that protection. The operative word is “obviously.” If a reasonable recipient would believe the message actually came from the purported sender, the parody defense weakens considerably.
What To Do If You Were Targeted
Where To Report
If you receive a spoofed email that attempts fraud, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. Include the sender’s email address, any URLs in the message, the full headers if you can extract them, and details of any financial transactions you were tricked into making.12Internet Crime Complaint Center (IC3). Threat Actors Spoofing the FBI IC3 Website for Possible Malicious Activity You can also report phishing and spoofed messages to the FTC at reportfraud.ftc.gov. Don’t click any links in the suspicious email when copying its content into a report.
Limiting Your Financial Exposure
If a spoofed email tricked you into authorizing an electronic transfer from your bank account, federal law caps your liability based on how quickly you report. Notify your bank within two business days and your maximum loss is $50. Wait longer than two business days but less than 60 days after your account statement is sent, and the cap rises to $500. After 60 days, you can be liable for the full amount of any unauthorized transfers that occurred after the deadline.13eCFR. 12 CFR 205.6 – Liability of Consumer for Unauthorized Transfers Speed matters. Call the bank before you do anything else.
Court-Ordered Restitution
When federal prosecutors convict someone of email-based fraud, courts can order the defendant to pay restitution covering the victim’s full financial loss. Under the Mandatory Victims Restitution Act, restitution is required in cases involving property offenses committed through fraud or deceit when the victim suffered an identifiable financial loss.14Office of the Law Revision Counsel. 18 U.S. Code 3663A – Mandatory Restitution to Victims of Certain Crimes Collection is a separate problem. Many email fraud defendants have spent or moved the stolen funds by sentencing. A restitution order remains enforceable indefinitely, though, and can be collected through wage garnishment and asset seizure if the defendant ever accumulates assets.