Is It Illegal to Log Into Someone Else’s Account? Laws and Penalties

Yes, it is illegal to log into someone else’s account without their permission. The Computer Fraud and Abuse Act makes unauthorized access to any internet-connected account a federal crime, and the account holder can separately sue you for money damages. Depending on the type of account and what you do once inside, additional federal statutes and most state computer crime laws can apply on top of the CFAA.¹

The Login Itself Is the Crime

Under 18 U.S.C. § 1030, intentionally accessing a “protected computer” without authorization is prohibited. A protected computer is any computer involved in interstate or foreign commerce, which in practice means anything connected to the internet.¹

You don’t have to steal anything, change a password, or cause any damage. Logging in with someone else’s credentials when you lack permission is the violation. Email accounts, social media profiles, banking portals, cloud storage, dating apps, work systems — all covered. Even a quick look at an ex-partner’s inbox counts.

Most states have their own computer crime statutes with similar prohibitions, and a single unauthorized login can be prosecuted under both federal and state law at the same time.

When You Actually Have Permission

Authorization is the dividing line, and it has to be real. Express authorization is clear: the account holder gives you their password and tells you to use it for a specific purpose. A manager handing an employee login credentials for a company social media account fits.

Implied authorization is a much weaker position. A shared household computer where everyone knows each other’s passwords might support an argument, but courts are skeptical. Unless someone explicitly told you to use a specific account, assume you don’t have permission.

Permission can also be revoked. If someone previously shared a password with you and later told you to stop using it, continuing to log in turns what used to be legal access into a potential federal offense. This comes up constantly after breakups and job terminations, and people routinely underestimate the risk.

The Supreme Court sharpened one piece of this in Van Buren v. United States. The Court held that “exceeding authorized access” under the CFAA means getting into parts of a system that are off-limits to you, like files or databases you were never supposed to open. It does not reach someone who views information they are allowed to see but uses it for an improper purpose.² That ruling narrowed how terms-of-service violations are treated, but it did not change the core prohibition: logging into someone else’s account without their consent still sits squarely within the statute.

No Exception for Spouses or Family Members

One of the most persistent misconceptions is that marriage or a family relationship creates some kind of legal pass. It doesn’t. Federal privacy statutes apply between spouses with the same force they apply between strangers.

Accessing a spouse’s personal email without consent can violate the CFAA, the Stored Communications Act, and the Federal Wiretap Act at once. Logging into a spouse’s individual bank account without signatory authority or explicit permission triggers CFAA liability.¹ The same goes for credit card accounts where you are not an authorized user. A spouse also lacks a valid need to pull the other’s credit report under the Fair Credit Reporting Act, and doing so without a permissible purpose could be treated as fraud.

Divorce makes this worse, not better. The urge to dig through a soon-to-be-ex’s accounts is understandable, but evidence obtained through unauthorized access can be excluded from court, and the snooping spouse can end up facing criminal charges on top of whatever they were hoping to prove.

Criminal Penalties You Could Face

The CFAA’s penalties scale with what you did, why you did it, and whether you have a prior conviction.

Basic unauthorized access to obtain information, first offense: a misdemeanor carrying up to one year in prison.¹
Unauthorized access with aggravating factors, first offense: a felony carrying up to five years in prison if the access was for commercial advantage or private financial gain, in furtherance of another crime, or the information obtained is worth more than $5,000.¹
Accessing a computer to defraud and obtain something of value, first offense: up to five years.¹
Repeat offenders: a second conviction for unauthorized access to obtain information or for computer fraud raises the maximum to ten years.¹
Intentional damage or national security offenses: up to ten years for a first offense and up to twenty years for a repeat or aggravated conviction.¹

Fines follow the general federal schedule under 18 U.S.C. § 3571: up to $100,000 for a misdemeanor conviction and up to $250,000 for a felony.³

Stored Communications Act

If the account holds messages, the Stored Communications Act at 18 U.S.C. § 2701 adds another layer. Reading someone’s stored emails, saved social media messages, or text message backups without authorization is a separate offense. A first conviction can bring up to one year in prison; up to five years if the access was for commercial advantage, private gain, or in furtherance of another crime; and up to ten years for a repeat offense under those aggravating circumstances.⁴

Federal Wiretap Act

If you log into an account and read messages as they arrive rather than only viewing stored ones, the Federal Wiretap Act at 18 U.S.C. § 2511 can apply. The maximum criminal penalty is five years in prison.⁵ The line between stored and in-transit communications is often blurry, which is why prosecutors frequently charge under several statutes at once.

Aggravated Identity Theft

When the unauthorized login is part of a broader scheme, prosecutors can add aggravated identity theft under 18 U.S.C. § 1028A. Using another person’s credentials, which qualify as a “means of identification,” during a qualifying felony like wire fraud, bank fraud, or computer fraud triggers a mandatory two-year prison sentence that runs consecutive to any other sentence. The two years are added on top of the underlying sentence and cannot be reduced through a plea bargain, good behavior, or early release.⁶

Getting Sued by the Account Holder

Criminal prosecution is only half of the exposure. The person whose account you accessed can file a civil suit under the CFAA, provided they clear a threshold. The most commonly used one is proving “loss” of at least $5,000 within a one-year period.¹ “Loss” is defined broadly to include response costs, damage assessment, data or system restoration, and lost revenue from any service interruption, so hiring a digital forensics expert to figure out what happened can push a victim past the threshold on its own. Successful plaintiffs can recover compensatory damages and get an injunction against further access.

The Stored Communications Act is friendlier to victims in one key way: it guarantees at least $1,000 in statutory damages per violation, even without proof of specific financial harm, and courts can award actual damages, the violator’s profits, punitive damages for willful violations, and attorney’s fees.⁷ That is why victims often file under both statutes.

If Someone Logged Into Your Account

Report the incident to the FBI’s Internet Crime Complaint Center at ic3.gov, and use the phrase “account takeover” in the description so it routes correctly. Complaints are analyzed and may be referred to federal, state, or local law enforcement; not every report leads to an active investigation, but the filing creates a documented record that can support later legal action.⁸

Then contact the platform directly so they can secure the account. Change your password on any other service that used the same credentials, and turn on two-factor authentication wherever it is offered. If a financial account was involved, call your bank or card issuer immediately so they can flag transactions and issue new numbers.

1
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
2
Supreme Court of the United States. Van Buren v. United States
3
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
4
Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
5
Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications
6
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
7
Office of the Law Revision Counsel. 18 USC 2707 – Civil Action
8
Internet Crime Complaint Center (IC3). Account Takeover Fraud