Yes, phishing is a crime. Under federal law it is prosecuted as wire fraud, computer fraud, and identity theft, and most states add their own criminal statutes on top. The FBI’s Internet Crime Complaint Center logged more than 193,000 phishing complaints in 2024, with reported losses above $70 million.1Internet Crime Complaint Center (IC3). 2024 IC3 Annual Report Penalties run from misdemeanor fines for small attempts to 20 or 30 years in federal prison for operations that hit banks or steal identities, and courts must order the defendant to repay victims.
The Federal Laws That Make Phishing Illegal
No single federal statute is titled “the phishing law.” Prosecutors stack several charges because a phishing scheme usually involves three separate acts: sending a deceptive message, breaking into an account, and taking someone’s personal information. Each act has its own statute.
Wire Fraud
Wire fraud is the backbone of most federal phishing cases. It covers anyone who uses electronic communications across state lines to carry out a scheme to defraud, which captures emails, text messages, phone calls, and websites. The maximum sentence is 20 years per count, and it rises to 30 years with a fine of up to $1 million when the fraud targets or affects a financial institution.2Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television The statute’s reach to “sounds” transmitted by wire also pulls in voice-based schemes like vishing.
Computer Fraud and Abuse Act
Once a phisher uses stolen credentials to log into a victim’s bank, email, or employer’s network, the Computer Fraud and Abuse Act applies. It makes it a federal crime to access a protected computer without authorization or beyond the access given. Accessing financial records or government data for commercial advantage or to further another crime carries up to five years for a first offense and ten years for a repeat conviction, and intrusions that cause serious damage or threaten public safety can reach 20 years.3Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
Identity Theft and Aggravated Identity Theft
Because most phishing exists to harvest personal data, identity theft counts almost always travel with the fraud charges. The identity fraud statute covers the knowing transfer or use of stolen identification information whenever the conduct crosses state lines or moves through electronic channels.4Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information
Aggravated identity theft is harder. If a defendant uses another person’s identifying information while committing a listed felony like wire fraud or computer fraud, the court must add a mandatory two-year prison term on top of the underlying sentence. That two years cannot run concurrently with any other sentence, and the judge cannot shorten the other sentence to offset it.5Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft It is the piece that gives prosecutors their biggest leverage in plea talks.
CAN-SPAM Act
Phishing emails that use false header information, like a forged “From” address or a spoofed domain, also violate the CAN-SPAM Act. Each noncompliant message can trigger a civil penalty of up to $53,088, and criminal penalties apply when the sender knows the message is part of a fraudulent scheme.6Federal Trade Commission. CAN-SPAM Act – A Compliance Guide for Business Over a campaign of thousands of messages, those per-message figures compound quickly.
State Phishing Laws
Several states have enacted laws aimed specifically at phishing rather than fraud in general. The important feature of these statutes is that they criminalize the attempt itself. A prosecutor does not have to prove that anyone fell for the message or lost money. Sending the deceptive communication, pretending to be a real business and asking for personal information, is enough.
State phishing laws usually open a civil path too. Depending on the state, someone who receives a phishing message may be able to sue for actual damages or for a fixed statutory penalty, often somewhere between $500 and $5,000 per violation. Rules and available damages vary, so a local attorney can advise on the options where you live.
Prison Time, Fines, and Restitution
What a convicted phisher actually faces depends on which charges stick, how many victims were affected, and how much was stolen.
- Small-scale attempts with minimal financial harm may be charged under state law as misdemeanors, with up to one year in jail and fines that vary by jurisdiction.
- Federal wire fraud carries up to 20 years per count, or up to 30 years if the fraud affects a financial institution.2Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
- Federal computer fraud ranges from five to 20 years per count, depending on the subsection and prior record.3Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
- Aggravated identity theft adds a mandatory two years, served consecutively on top of every other sentence, with no concurrent option.5Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
Federal felony convictions carry fines of up to $250,000 for individuals and $500,000 for organizations under the general federal sentencing statute.7Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine When the specific offense statute sets a higher cap, like the $1 million maximum for wire fraud affecting a financial institution, that higher number controls.
Courts also order restitution. The defendant must repay victims for the actual value of lost or damaged property, lost income, and expenses tied to the crime. Restitution is mandatory for most federal fraud convictions, and the judge has no discretion to waive it.8Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes
Longer Sentences for Targeting Vulnerable Victims
Federal sentencing guidelines increase punishment when a phishing operation preys on elderly or mentally impaired people. If the defendant knew or should have known a victim was unusually vulnerable because of age, physical condition, or mental condition, the offense level goes up by two. If the scheme involved a large number of vulnerable victims, another two levels are added.9United States Sentencing Commission. USSG 3A1.1 – Hate Crime Motivation or Vulnerable Victim Those added levels translate to months or years of extra prison time, which is why rings that target retirees often draw especially long sentences.
Does It Matter How the Phishing Happened?
Legally, no. The statutes above are written broadly enough to cover email phishing, text-message smishing, phone-call vishing, and newer schemes using AI-generated voice or video to impersonate a real person. Wire fraud reaches any electronic communication, and identity theft reaches any use of someone else’s identifying information. New techniques do not create a loophole.
What matters at sentencing is the scale and the harm: how many messages went out, how many people were defrauded, how much money moved, whether a bank was involved, and whether the victims were vulnerable. Those are the factors that move a case from a short state sentence to decades in federal prison.
If You Were Phished
Reporting a phishing attack does two things: it feeds law enforcement information that helps build cases against organized operations, and it creates the paper trail you will need to dispute charges with your bank or card issuer. The main federal intake point is the FBI’s Internet Crime Complaint Center at ic3.gov. You file the complaint online and hold onto your original evidence in case an investigator follows up.10Internet Crime Complaint Center (IC3). Frequently Asked Questions
Keep the full email with its headers rather than just the body, screenshots of any spoofed websites, text message logs, phone records, and statements showing unauthorized transactions. You can also forward phishing emails to reportphishing@apwg.org and file a complaint at ftc.gov.
Call your bank or card issuer the same day you realize what happened. For credit cards, federal law caps your liability for unauthorized charges at $50 as long as you report the fraud once you discover it.11Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card For debit cards and bank accounts, Regulation E ties your maximum liability to how fast you report: $50 if you call within two business days of learning of the compromise, $500 if you report within 60 days of your statement date, and potentially the entire loss if you wait longer than that.12eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Every day of delay with a compromised debit card raises what you could lose.