Yes. Hacking into someone’s phone is illegal under federal law, and in almost every situation it violates state law as well. Three federal statutes apply, penalties can reach ten years in prison for a first offense, and the person whose phone was accessed can sue separately for money damages. The rule holds whether you used spyware, guessed a password, or logged into an account someone never gave you permission to use.
The Federal Laws That Make It a Crime
Three overlapping federal statutes cover phone hacking, and a single act often violates more than one.
The Computer Fraud and Abuse Act is the broadest. It prohibits intentionally accessing a “protected computer” without authorization and obtaining information from it. A protected computer is any computer used in or affecting interstate or foreign commerce or communication, which covers any smartphone that connects to the internet or a cellular network.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
The Wiretap Act, part of the Electronic Communications Privacy Act, targets real-time interception. It prohibits intentionally intercepting any wire, oral, or electronic communication. Spyware that captures calls as they happen, reads texts as they arrive, or listens in on live conversations falls under this statute.2Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited
The Stored Communications Act covers messages already sitting on a server or in cloud storage. Breaking into someone’s email account or pulling text messages backed up to the cloud violates the SCA.3Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
Every state and U.S. territory also has its own computer crime laws, and state charges can be filed on top of federal ones.4National Conference of State Legislatures. Computer Crime Statutes
What Counts as Hacking
You don’t need technical skills to break the law. The statutes care about unauthorized access, not sophistication.
Logging into someone’s accounts with a password they didn’t give you is enough. Guessing a partner’s email password, using a password you watched them type, or keeping access to a shared account after being told to stop can all qualify. Phishing works the same way: tricking someone into handing over credentials and then using them creates liability even though the victim technically typed the password in.
Installing spyware or monitoring software on someone’s phone without their knowledge is one of the clearest violations. These apps track location, record calls, read messages, and log keystrokes. Because the software touches the device, intercepts live communications, and pulls stored data, a single installation can trigger the CFAA, the Wiretap Act, and the Stored Communications Act at once.
SIM swapping has drawn aggressive federal prosecution. The scheme involves convincing a phone carrier to transfer someone’s number to a SIM card the attacker controls, which routes the victim’s calls and texts, including two-factor codes, to the attacker. Federal prosecutors have charged SIM swapping under wire fraud conspiracy statutes.5United States Department of Justice. Portland Man Sentenced to Federal Prison for Role in SIM Swapping Identity Theft and Fraud Scheme
Prison Time and Fines
Sentencing depends on which statute was violated, whether another crime was involved, and whether the defendant has prior convictions.
Under the CFAA, first-offense maximums are:1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
- One year for simple unauthorized access.
- Five years for access involving fraud, obtaining something of value, or losses over $5,000.
- Ten years for accessing government or financial institution data, or knowingly causing damage to a computer.
A second CFAA conviction generally doubles the maximum. A five-year ceiling becomes ten.
A Wiretap Act violation carries up to five years in federal prison for a first offense.6United States Department of Justice. Criminal Resource Manual 1058 – Penalties A Stored Communications Act violation carries up to one year for a basic first offense, rising to five years if the access was for commercial gain, to further another crime, or to cause malicious damage.3Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
When phone hacking is used to stalk someone, a separate federal cyberstalking statute can apply. Using electronic communications to engage in a course of conduct that places someone in reasonable fear of serious injury or causes substantial emotional distress is itself a federal crime.7Office of the Law Revision Counsel. 18 USC 2261A – Stalking
Civil Lawsuits by the Victim
Criminal prosecution is the government’s remedy. The person whose phone was hacked has a separate right to sue for money, and the damages can be meaningful even when actual losses are hard to pin down.
The Wiretap Act lets a victim recover actual damages plus any profits the violator made, or statutory damages of $100 per day of violation or $10,000, whichever is greater. Punitive damages and attorney fees are also available.8Office of the Law Revision Counsel. 18 USC 2520 – Recovery of Civil Damages Authorized
The Stored Communications Act guarantees a minimum of $1,000 in damages for any successful claim, even without proof of specific losses. Willful violations open the door to punitive damages, and attorney fees and costs are recoverable.9Office of the Law Revision Counsel. 18 USC 2707 – Civil Action
The CFAA allows civil suits for compensatory damages and injunctive relief, but only when the violation caused at least $5,000 in aggregate losses or involved specified harms such as physical injury or a threat to public safety. The suit must be filed within two years of the act or discovery of the damage.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
Victims can also bring common-law tort claims for invasion of privacy and intentional infliction of emotional distress alongside the statutory claims.
Hacking a Spouse’s or Partner’s Phone
This is where most people get caught off guard. Being married to someone does not give you the right to access their phone, read their messages, or install monitoring software.
The Wiretap Act prohibits “any person” from intercepting electronic communications without consent, and most federal appeals courts have rejected an interspousal exception. The Fourth, Sixth, Eighth, and Tenth Circuits have held that wiretapping a spouse’s phone is actionable under the Wiretap Act, and that it makes no legal difference whether the wiretap was placed by a spouse or by a hired private investigator. Only the Fifth Circuit has carved out a narrow exception for wiretapping inside the “marital home,” and that holding has been widely criticized and not adopted elsewhere.10Notre Dame Journal of Legislation. Wiretapping and the Confines of the Marital Home
In divorce cases the temptation to grab evidence of infidelity or hidden assets runs high, and the move usually backfires. Federal law and many state statutes specifically bar illegally intercepted communications from being used in any proceeding, criminal or civil. A spouse who hacks a phone to find evidence of an affair can end up facing criminal charges while the evidence itself gets thrown out.
Child custody is the one area where courts have shown more flexibility, sometimes allowing evidence that would otherwise be excluded when the child’s best interest is at stake. That is a judicial balancing test, not a green light. Anyone thinking about monitoring a spouse’s phone during a custody dispute should talk to a family law attorney first.
Parents and Minor Children
Parents have significantly more legal room with their minor children. Most courts recognize a “vicarious consent” doctrine: a parent can consent on behalf of a minor child to the interception of their communications, provided the parent is acting in the child’s best interest. Installing parental controls, reviewing text messages, and monitoring app usage are generally permissible.
The best-interest requirement matters. A parent monitoring a child to protect against online predators or cyberbullying is on solid legal ground. A parent intercepting a child’s communications to gain leverage in a custody fight with the other parent is not, because the motive isn’t the child’s welfare.
Once the child turns 18, this latitude disappears. An adult child’s phone is protected the same as anyone else’s, even if the parent owns the device or pays the plan. Owning the hardware does not equal authorization to access the communications on it.
Employer-Owned Phones
Employers generally can monitor phones they issue for work. The device is company property, and employees typically agree in writing to monitoring of messages, emails, internet activity, location, and app usage as a condition of using it.
The boundaries shift with personal devices used for work. Reaching into an employee’s personal phone raises different legal questions, which is why many employers require a separate bring-your-own-device agreement spelling out what the company can access. Without that written consent, employer access to a personal phone is risky.
If Your Phone Was Hacked
What you do in the first few days shapes both criminal prosecution and any civil suit you might bring later.
Start by changing passwords on every account connected to the phone, including email, banking, social media, and cloud storage. Turn on two-factor authentication where available, and look through the phone for apps you don’t recognize. Call your carrier to confirm no unauthorized SIM changes or call forwarding have been set up on your line.
Preserve evidence before you clean up. Don’t factory-reset the phone or delete suspicious apps until you’ve documented them. Take screenshots of anything unusual: unfamiliar apps, altered settings, login notifications for sessions you didn’t start. If you plan to pursue legal action, a forensic examiner can create an exact image of the phone’s data without disturbing the original, and that forensic copy is far more useful in court than screenshots alone. Preserve back-up files, synced cloud folders, and any linked devices too.
File a complaint with the FBI’s Internet Crime Complaint Center (IC3) through its website. IC3 handles computer hacking and intrusion-based crimes. You’ll provide your contact information, details about the suspected perpetrator if known, any financial losses, and a description of what happened. Save or print a copy of the complaint right after filing, because IC3 does not send an electronic copy later.11Internet Crime Complaint Center. FAQ – Internet Crime Complaint Center (IC3)
If personal data such as Social Security numbers, bank account details, or login credentials were exposed, report the breach at IdentityTheft.gov. The site builds a personalized recovery plan and generates pre-filled letters for disputing fraudulent accounts.12Federal Trade Commission. Identity Theft – IdentityTheft.gov For situations involving immediate danger or threats, call 911 or local police rather than relying on online reporting.