Is It Illegal to Change Someone’s Password? Laws and Penalties

Yes. Changing someone else’s password without their permission is illegal in virtually every situation under federal law, and every state has its own computer-crime statute that reaches the same conduct. So if you are asking whether it is illegal to change someone’s password, the short answer is that doing so can expose you to federal prison time, state criminal charges, and a civil lawsuit from the account holder, often all at once.

The rules apply whether the account belongs to a stranger, a coworker, a former partner, or a family member. There are a few narrow situations where authorization is genuinely unclear, and those are worth understanding before assuming you have the right to touch someone else’s login.

The Federal Laws That Make It Illegal

Two federal statutes do most of the work here.

The Computer Fraud and Abuse Act (CFAA) criminalizes intentionally accessing a “protected computer” without authorization, or exceeding the authorization you were given. A protected computer is defined as one used in or affecting interstate commerce or communication, which in practice means any device connected to the internet. The statute defines “damage” to include any impairment to the integrity or availability of data. Changing a password fits that definition cleanly: you are impairing the owner’s ability to reach their own data.¹

CFAA penalties scale with the conduct. A basic first offense of unauthorized access to obtain information carries up to one year in prison. That ceiling rises to five years when the access was for commercial gain, to further another crime, or when the value of the information exceeded $5,000. Intentional damage to a protected computer can bring up to ten years for a first offense and up to twenty for a repeat offender. Trafficking in passwords (selling or sharing stolen credentials) is a separate offense with its own penalties, even if the trafficker never logs in.¹

The Stored Communications Act (SCA) adds a second federal layer, specifically for email and messaging accounts. The SCA makes it illegal to intentionally access, without authorization, a service that stores electronic communications when that access obtains, alters, or blocks someone’s stored messages. Locking someone out of their email or social media triggers this law because you are preventing them from reaching their communications.²

A first SCA offense is punishable by up to one year in prison. If the conduct was done for commercial gain, to cause malicious damage, or to further another crime, the maximum jumps to five years for a first offense and ten years for a repeat violation. Because the CFAA and SCA are separate statutes, prosecutors can charge both for the same act.²

State Computer Crime Laws

All 50 states, plus Puerto Rico and the U.S. Virgin Islands, have their own computer-crime statutes.³ Most address unauthorized access and computer trespass, and some go further than federal law by explicitly defining the act of locking a user out of their own account as tampering or interference. Penalties range from misdemeanors for minor intrusions to felonies when the conduct causes significant financial harm or facilitates another crime. State prosecutors tend to handle localized or smaller-dollar cases; federal prosecutors tend to pick up cases involving larger losses or interstate conduct.

When Authorization Is Unclear

Everything in these laws depends on whether your access was authorized. The Supreme Court in Van Buren v. United States (2021) adopted a “gates-up-or-down” test: either you had permission for a specific area of a system, or you didn’t. There is no middle category where someone had access but used it for the “wrong purpose.”⁴ Guessing, cracking, or phishing a stranger’s password is clearly unauthorized. The harder questions come up in relationships where permission once existed.

Former Partners and Shared Accounts

Couples who shared passwords during a relationship often assume they can keep using them afterward. They generally cannot. Courts evaluate consent on the surrounding circumstances. A password shared for a specific purpose, like paying a joint bill, does not authorize other uses. After a separation, previously shared access is widely treated as implicitly revoked, and using an ex’s credentials at that point carries real criminal and civil risk.

Parents and Minor Children

Parents have broad authority to monitor a minor child’s online activity, and most courts recognize that authority. Monitoring is not the same as taking the account over. A parent who resets a password briefly to review activity stands on different footing than one who changes the password to seize the account outright, particularly when the child is nearing adulthood or the dispute involves custody.

Employers and Former Employees

The Third Circuit held in United States v. Eddings (2025) that an employee’s resignation alone does not automatically revoke the employer’s earlier grant of access under the CFAA. Because resignation is the employee’s act, authorization continues until the employer affirmatively rescinds it, by disabling credentials, issuing a written revocation, or applying a policy that terminates access on separation. The court left open whether being fired (an employer’s act) automatically revokes access.¹ The practical lesson for employers is to disable accounts immediately and confirm the revocation in writing. The lesson for departing employees is that using old credentials after you leave is dangerous, even if IT forgot to disable them.

Civil Lawsuits

Prosecutors are not the only threat. The account holder can also sue in civil court.

The CFAA creates a private right of action for anyone who suffers damage or loss from a violation. Most civil plaintiffs need to show at least $5,000 in aggregate losses within a one-year period, with “loss” defined broadly to include the cost of responding to the breach, restoring data, and any interruption of service. The statute of limitations is two years from the violation or from when the victim discovered the damage.¹

The SCA is often the more practical civil tool. There is no $5,000 threshold. The court must award at least $1,000 per violation, even if actual losses were minimal, plus reasonable attorney’s fees. Willful violations can also draw punitive damages.⁵ For someone whose email or social media password was changed, the SCA’s minimum damages and fee-shifting make a lawsuit viable even when out-of-pocket losses are hard to prove.

When Charges Pile Up

A password change is often just the first count on an indictment.

Login credentials qualify as a “means of identification” under the federal identity theft statute. Using someone else’s identifying information without lawful authority, with intent to commit or facilitate any federal crime, is a separate offense with its own penalties.⁶ Changing a password and then impersonating the owner, viewing their financial accounts, or making purchases layers identity theft charges on top of the CFAA count.

When the conduct is part of a pattern of harassment, the federal cyberstalking statute may also apply. That law reaches the use of any interactive computer service with the intent to harass or intimidate another person in a way that causes substantial emotional distress.⁷ Repeatedly locking someone out of their accounts during a domestic dispute can supply exactly that course of conduct.

What to Do if Someone Changed Your Password

Speed matters. The longer someone controls your account, the more damage they can do.

Get Back In

Start with the platform’s “Forgot Password” link, which sends a reset code to your backup email or phone. If the intruder also changed your recovery information, contact the platform’s support team directly. Be ready to verify your identity with a photo ID, security questions, or proof of the original email on file.

Preserve Evidence Before You Fix Anything

Document the account’s current state before you change it back. Screenshot any messages the intruder sent, any settings they altered, and any login activity the platform shows. Save the files with their original timestamps. The strength of a later lawsuit or criminal complaint depends on what you captured in the moment. Once you are back in, turn on two-factor authentication and change the password on every other account that used the same or a similar credential.

Report It

File a police report. Even if your local department does not aggressively investigate cybercrimes, the report creates an official record you will need to pursue charges or a civil claim later. Then file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov, which accepts reports covering the CFAA, identity theft, wire fraud, and other internet-related federal crimes.⁸ IC3 does not accept attachments, so hold on to your evidence in case an investigating agency later asks for it.⁹

1
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
2
Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
3
National Conference of State Legislatures. Computer Crime Statutes
4
Supreme Court of the United States. Van Buren v. United States
5
Office of the Law Revision Counsel. 18 USC 2707 – Civil Action
6
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information
7
Office of the Law Revision Counsel. 18 USC 2261A – Stalking
8
Internet Crime Complaint Center (IC3). Complaint Form
9
Internet Crime Complaint Center (IC3). Frequently Asked Questions