Is It Illegal to Hack Someone’s Email? Laws, Penalties, and Lawsuits

Yes, it is illegal to hack someone’s email. Accessing another person’s email account without permission is a federal crime in the United States, punishable by up to five years in prison for a first offense and up to ten years for a repeat offense. Two federal statutes apply: the Computer Fraud and Abuse Act and the Stored Communications Act. Many states have their own computer-access laws on top of the federal ones, and the person whose account was broken into can also sue for money damages.

What Counts as Hacking

You do not have to be a skilled hacker to break these laws. The legal question is whether you had authorization to open the account, not how technically sophisticated the access was. All of the following qualify as unauthorized access:

Guessing someone’s password.
Using a password a person shared with you after they told you to stop.
Logging into an account someone left open on a shared device.
Installing spyware or a keylogger to capture login credentials.

The Supreme Court addressed the meaning of “authorized access” in its 2021 decision in Van Buren v. United States. The Court held that a person exceeds authorized access when they reach into areas of a system that are off-limits to them. If you were never given permission to open someone’s email, any access at all is unauthorized. If permission was once given and then revoked, every login after revocation crosses the line.

The Federal Laws That Apply

Two statutes do most of the work in email-hacking cases, and both usually apply to the same conduct.

The Computer Fraud and Abuse Act, at 18 U.S.C. § 1030, makes it a crime to intentionally access a computer without authorization and obtain information from it. The statute reaches any “protected computer,” meaning any computer used in or affecting interstate commerce or communication. Virtually any internet-connected device fits that definition, so email accounts hosted on Gmail, Outlook, Yahoo Mail, and similar services fall squarely within the law.¹

The Stored Communications Act, at 18 U.S.C. § 2701, is narrower and written for exactly this scenario. It criminalizes intentionally accessing a facility that provides electronic communication services, without authorization, and through that access obtaining, altering, or blocking access to stored communications. Breaking into someone’s inbox to read their messages is the paradigm case.²

Prison Time and Fines

Penalties depend on intent, the harm caused, and whether the person has a prior conviction.

Under the Computer Fraud and Abuse Act

Simple unauthorized access to obtain information is a misdemeanor punishable by up to one year in prison for a first offense. The maximum jumps to five years if the offense was committed for commercial advantage or financial gain, in furtherance of another crime, or if the value of the information obtained exceeds $5,000. A repeat offense carries up to ten years.³

Accessing a computer with intent to commit fraud is punished more severely from the start: up to five years for a first offense and up to ten for a subsequent one.

Under the Stored Communications Act

If the access is for commercial gain, malicious destruction, or in furtherance of another crime, a first offense carries up to five years in prison and a repeat offense up to ten. Other violations carry up to one year for a first offense and up to five for a repeat.²

State Charges

Nearly every state has its own unauthorized-computer-access statute, which gives local prosecutors a parallel path. A state may charge a first offense as a misdemeanor and escalate repeats to felonies, or tie the grade of the offense to the dollar value of the harm. Smaller cases that would never attract federal attention are routinely prosecuted at the state level.

Getting Sued by the Victim

Criminal charges are not the only exposure. Both federal statutes let the person whose email was hacked sue in civil court.

Under the CFAA, someone who suffers damage or loss from a violation can seek compensatory damages and injunctive relief. The lawsuit must be filed within two years of when the victim discovered the hack. When the only qualifying factor is that losses exceeded $5,000 in a one-year period, recoverable damages are limited to economic losses.³

The Stored Communications Act offers stronger civil remedies. A successful plaintiff recovers actual damages plus any profits the hacker earned from the violation, with a guaranteed minimum of $1,000 even when provable damages fall short. Willful or intentional violations open the door to punitive damages, and the court can award reasonable attorney’s fees and litigation costs.⁴

For most email-hacking victims, the SCA is the stronger lawsuit. The $1,000 floor, punitive damages, and fee-shifting matter especially when economic losses are hard to put a number on.

When Reading Someone’s Email Is Not Illegal

A few situations are genuinely different, and silence on them tends to mislead.

Employer Access to Company Email

Employers generally have broad authority to monitor messages sent through company email systems. The Electronic Communications Privacy Act contains an exception for service providers acting in the normal course of business to protect their services and property, and an employer that owns the system falls within it.⁵ Most employers also obtain written consent through handbooks or onboarding paperwork, and the ECPA permits interception when one party has consented. If you are using your employer’s email, assume your employer can read it.

Spouses and Shared Passwords

Marriage does not create an automatic right to read a spouse’s email. Courts analyze spousal access the same way they analyze anyone else’s: was it authorized? A password shared for a limited purpose, like checking a shipping confirmation, is not a license to read the whole inbox or monitor messages over time. Using a shared password beyond its intended scope can trigger the same criminal and civil liability that applies to a stranger.

Implied consent can exist, for example in a household that has always shared device passwords without restriction, but courts assess it case by case. Relying on implied consent during a contentious divorce is risky, and emails obtained through unauthorized access are often inadmissible in family court, meaning the evidence may be useless while the person who took it still faces charges.

What To Do If Your Email Was Hacked

Act on security first, then report. Change the password immediately and turn on two-factor authentication. Check for forwarding rules the intruder may have set up to silently copy incoming messages to another address. Review the recovery phone number and backup email on the account, since hackers often change these to keep a way back in after a password reset. If you reused the password elsewhere, change those accounts too.

Preserve evidence before it ages out. Save copies of any emails the intruder sent from your account, screenshots of unauthorized login activity and setting changes, and any suspicious-login notices from your provider. If your provider offers an activity log with IP addresses and timestamps, download or screenshot it. Keep originals in their native digital format where possible; metadata in email files and server logs is often more useful than the text alone.⁶

You can file a federal complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. The form asks for your contact information, what you know about the person responsible, a description of what happened, and any financial losses. The IC3 reviews complaints and refers them to the appropriate agency rather than investigating itself, so for time-sensitive situations contacting local law enforcement directly is the faster path.⁶

1
Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers
2
Office of the Law Revision Counsel. 18 U.S. Code 2701 – Unlawful Access to Stored Communications
3
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
4
Office of the Law Revision Counsel. 18 U.S. Code 2707 – Civil Action
5
Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited
6
Internet Crime Complaint Center (IC3). Frequently Asked Questions