Is It Illegal to Hack Someone’s Phone? Federal and State Laws

Yes, it is illegal to hack someone’s phone. The conduct violates at least three federal statutes and a parallel unauthorized-access law in nearly every state, and a first federal offense can carry up to five years in prison and a fine as high as $250,000. Repeat offenses, financial motives, or access to sensitive categories of information push the exposure higher. On top of criminal charges, the person whose phone was hacked can file a civil lawsuit for damages.

The Federal Laws That Apply

Three federal statutes do most of the work in phone-hacking cases, and they cover slightly different conduct.

The Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act, at 18 U.S.C. § 1030, is the main federal statute. It criminalizes intentionally accessing a “protected computer” without authorization or beyond the access you were given. A protected computer is any device used in or affecting interstate commerce or communication, and because smartphones connect to the internet and rely on interstate networks, they fit that definition.¹

The Stored Communications Act

The Stored Communications Act, at 18 U.S.C. § 2701, targets a slightly different angle. It makes it a crime to intentionally access a facility providing electronic communication services and obtain, alter, or prevent access to stored communications.² In practice, this covers breaking into someone’s email, reading stored text messages, listening to voicemail, or going through private social media messages, whether those messages sit on the phone itself or on a server.

The Federal Wiretap Act

The federal Wiretap Act, 18 U.S.C. § 2511, covers real-time interception rather than stored data. Intentionally intercepting a wire, oral, or electronic communication is a felony carrying up to five years in prison.³ Installing spyware that captures calls as they happen, reading texts as they transmit, or using malware that streams a microphone feed all fall under this statute. Disclosing or using information you know came from an illegal intercept is a separate violation.

State Laws Add Another Layer

Nearly every state has its own unauthorized-access statute, and these laws usually define “computer” broadly enough to cover smartphones and tablets. The same conduct can be prosecuted at both the state and federal level because state and federal governments are separate sovereigns, so double jeopardy does not block it. State penalties vary, with maximum fines for a first offense commonly running from $1,000 to $10,000. Many states also have wiretapping and eavesdropping statutes, and some require all parties to a conversation to consent to recording, not just one.

What Counts as Hacking a Phone

The legal definition is broader than most people assume. Any deliberate, unauthorized access to another person’s phone or the accounts linked to it qualifies. Common methods include:

Installing spyware or stalkerware that runs silently and feeds calls, texts, photos, browsing history, or microphone and camera access to the installer.
Stealing, guessing, or resetting someone’s password to get into their email, cloud storage, or social media.
Phishing, where a deceptive message mimics a legitimate company to capture login credentials.
Using someone’s phone GPS to track their movements without their consent. A growing number of states have specific statutes prohibiting private use of electronic tracking devices.

Technical skill is not the dividing line. Picking up an unlocked phone and reading through private messages is the same category of offense as deploying remote-access malware.

Criminal Penalties

Punishment depends on which statute applies, whether the person has a prior conviction, and whether aggravating factors are present.

Under the CFAA:

Basic unauthorized access as a first offense: up to one year in prison under 18 U.S.C. § 1030(c)(2)(A).¹
Access for financial gain or with a prior conviction: up to five years.
Obtaining classified or national defense information: up to ten years for a first offense and up to twenty for a repeat offense.

The Stored Communications Act carries up to one year for a basic first offense, rising to five years if the access was for financial gain or to further another crime, and ten years for a repeat violation.⁴ A Wiretap Act violation is a straight felony carrying up to five years.³

Fines are set by the general federal sentencing statute at 18 U.S.C. § 3571. For a felony, the maximum is $250,000 for an individual. For a misdemeanor that doesn’t result in death, the cap is $100,000.⁵ Any felony-level CFAA or Wiretap Act conviction exposes the defendant to that range.

The Victim Can Also Sue

Criminal prosecution is one track. The other is a civil lawsuit by the person whose phone was hacked. The CFAA allows victims to sue for compensatory damages and injunctive relief if the offense involved a loss of at least $5,000 during any one-year period.¹ Courts have found that the cost of investigating the breach counts toward that threshold, including forensic analysis and attorney time spent assessing the damage. Victims can also bring state-law claims for invasion of privacy, emotional distress, and financial losses.

Does It Matter if It’s a Spouse, Partner, or Ex?

No. A large share of phone-hacking cases involve current or former spouses, romantic partners, and exes, and there is no spousal exception to the CFAA, the SCA, or the Wiretap Act. Being married to someone does not authorize you to access their phone, install tracking software, or read their private messages without their knowledge.

Consent is what the courts look at, and they evaluate it case by case. If your spouse has routinely shared their passwords and allowed you to use their accounts, a court may find implied consent for continued access. But using a password that was shared for one purpose, such as a shared calendar, to go through private messages exceeds the scope of whatever consent was given. The Electronic Communications Privacy Act specifically prohibits access that exceeds authorization, not just access with none at all.

People facing divorce sometimes hack a spouse’s phone hoping to find evidence of infidelity or hidden assets. The evidence may be inadmissible if it was obtained illegally, and the hacking itself can produce criminal charges and a separate civil lawsuit that makes the divorce far more expensive and adversarial.

Knowing the Password Does Not Mean You Have Permission

One of the most dangerous misconceptions is that having someone’s password means you are allowed to use it. Authorization under the CFAA comes from the system owner, not from someone who happens to share their credentials with you. Federal courts have consistently held that once the owner revokes your access, using previously shared login information is unauthorized access, even if no one changed the password. The Ninth Circuit addressed this directly in United States v. Nosal, holding that a former employee who directed others to use a current employee’s credentials acted “without authorization” under the CFAA.

When Access Can Be Lawful

A few situations sit outside the usual rule, and it helps to know where the lines are.

Parents and a Minor Child’s Phone

Parents generally have the legal authority to monitor a minor child’s phone activity. Minors do not hold the same privacy rights as adults, and parents are typically within their rights to review messages, set screen-time limits, and install parental-control software on a device they provide. That authority is not unlimited. Recording a teenager’s conversations with third parties can violate state wiretapping laws in jurisdictions that require all-party consent, and invasive monitoring software on an older teen’s phone, especially without their knowledge, can push into territory some courts have called excessive. Transparent monitoring that is proportionate to the child’s age is the safer approach.

Employers and Work Phones

Companies that issue work phones generally have broad authority to monitor those devices, including internet traffic, email, and GPS location. The Electronic Communications Privacy Act has a “business extension” exception that allows employers to monitor communications made on company equipment in the ordinary course of business. Employers are expected to stop listening once a call is clearly personal, and prior notice through an employee handbook or onboarding acknowledgment strengthens the employer’s position. Personal devices used for work under bring-your-own-device policies sit in a grayer area, and courts weigh factors like who owns the device, who owns the account, and whether the employer had a published, enforced policy.

Police and the Warrant Requirement

Police can search your phone, but not without a warrant. The Supreme Court ruled in Riley v. California (2014) that searching a cell phone’s digital contents during an arrest without a warrant is unconstitutional.⁶ To get a warrant, law enforcement must present a written application to a judge demonstrating probable cause that the phone contains evidence of a crime. Narrow exceptions exist for genuine emergencies, but the default rule is clear.

If You Think Your Phone Has Been Hacked

What you do in the first few days matters. Digital evidence is fragile and easy to alter, and courts require proof it hasn’t been tampered with before they’ll admit it.

Do not wipe or reset the phone yet. That destroys the evidence a forensic examiner needs. If you can, stop using the phone and avoid installing or deleting apps until a professional can create a forensic copy.
Document everything. Screenshot suspicious activity, unfamiliar apps, unusual battery drain, and strange messages. Note dates and times.
Change your passwords from a device you trust. Update credentials for email, banking, social media, and cloud storage. Turn on two-factor authentication wherever it is offered.
File a report with the FBI’s Internet Crime Complaint Center at ic3.gov. The form asks for your contact information, details about the incident, any financial losses, and whatever you know about the person responsible. File a report with local law enforcement too, since state charges may apply independently.⁷
Consult a forensic examiner. A professional can image the phone without altering the original data, preserve the chain of custody, and produce evidence that holds up in court. If you plan to sue, the cost of this work can count toward the CFAA’s $5,000 loss threshold.

Evidence degrades, attackers cover their tracks, and statutes of limitations start running from the date of discovery. The sooner you document the intrusion and bring in professionals, the stronger your position.

1
Office of the Law Revision Counsel. 18 U.S.C. 1030 – Fraud and Related Activity in Connection With Computers
2
Office of the Law Revision Counsel. 18 U.S.C. 2701 – Unlawful Access to Stored Communications
3
Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited
4
Office of the Law Revision Counsel. 18 U.S. Code 2701 – Unlawful Access to Stored Communications
5
Office of the Law Revision Counsel. 18 U.S. Code 3571 – Sentence of Fine
6
Justia U.S. Supreme Court. Riley v. California, 573 U.S. 373 (2014)
7
Internet Crime Complaint Center. IC3 Complaint Form