Yes, social engineering is illegal in the United States. The tactics social engineers use — tricking people into handing over passwords, account numbers, or money through impersonation, phishing, or pretexting — are prosecuted under federal statutes covering wire fraud, computer fraud, bank fraud, pretexting, and identity theft, with sentences that run from five years to thirty years depending on the offense. Most states add their own criminal charges on top, and victims can sue in civil court regardless of whether a prosecutor files a case.
The Federal Crimes That Apply
There is no single statute titled “social engineering.” Instead, federal prosecutors reach for whichever law fits the conduct, and a single scheme usually violates several at once.
Wire Fraud
The federal wire fraud statute, 18 U.S.C. § 1343, is the workhorse. It covers anyone who uses interstate electronic communications — email, phone calls, text messages — to carry out a scheme to defraud.1Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television A single phishing email sent from one state to another satisfies the interstate element, which gives federal prosecutors broad reach. One count carries up to twenty years in prison and a fine of up to $250,000 for an individual under the general federal fines statute.2Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine If the scheme targets or affects a financial institution, the maximum climbs to thirty years and a $1,000,000 fine.
Computer Fraud
The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, prohibits accessing a computer without authorization or exceeding authorized access. That applies when a social engineer tricks a legitimate user into sharing login credentials and then uses those credentials to reach data they were never supposed to see. A first offense for commercial advantage or private financial gain carries up to five years in prison. Offenses involving national security information or repeat convictions can reach twenty years.3Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
Bank Fraud
Schemes that use false pretenses to pull money or property out of a federally insured financial institution fall under 18 U.S.C. § 1344. A conviction carries up to thirty years in prison and a fine of up to $1,000,000.4Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud This is the statute most often charged when a social engineer convinces a bank employee to release funds or reset credentials.
Access Device Fraud
18 U.S.C. § 1029 targets fraud involving “access devices” — a category that includes credit card numbers, account numbers, PINs, and anything else that can be used to obtain money or transfer funds. A social engineer who talks a victim into reading off a credit card number has obtained an access device with intent to defraud. Using, trafficking, or soliciting such information carries up to ten or fifteen years in prison for a first offense, depending on the specific conduct, and up to twenty years for repeat offenders.5Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices
Pretexting for Financial Records
Federal law has a statute aimed squarely at one of the most common social engineering tactics. The Gramm-Leach-Bliley Act, at 15 U.S.C. §§ 6821–6823, makes it illegal to obtain customer information from a financial institution through false or fraudulent statements, whether the deception targets a bank employee or the customer directly.6Office of the Law Revision Counsel. 15 USC 6821 – Privacy Protection for Customer Information of Financial Institutions Hiring or asking someone else to pretext on your behalf is also prohibited.
A first offense carries up to five years in prison. If the pretexting is part of a pattern of illegal activity involving more than $100,000 in a twelve-month period, or occurs alongside another federal crime, the maximum doubles to ten years.7Office of the Law Revision Counsel. 15 USC 6823 – Criminal Penalty This statute matters because it does not require a computer or a wire. A person who picks up the phone, pretends to be a customer, and extracts account details has violated the law regardless of the technology involved.
Identity Theft
When a social engineering scheme produces someone’s name, Social Security number, or date of birth, separate identity theft charges apply under 18 U.S.C. § 1028. Using another person’s identifying information to commit or aid any federal crime or state felony is prohibited, with penalties that depend on what was taken and how it was used.8Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information Producing or transferring a false U.S.-issued ID, birth certificate, or driver’s license — or using someone’s identity to obtain $1,000 or more in value within a one-year period — carries up to fifteen years. Other misuse, or theft below the $1,000 threshold, carries up to five years.
The Two-Year Add-On That Changes Everything
A separate statute, 18 U.S.C. § 1028A, imposes a mandatory two-year prison sentence for “aggravated identity theft.” It applies whenever someone uses another person’s identity during certain predicate felonies, and the predicate list includes wire fraud, bank fraud, and computer fraud — the exact charges prosecutors bring in social engineering cases. The two years run consecutively, meaning they are added on top of whatever sentence the court imposes for the underlying crime. Courts cannot reduce the underlying sentence to compensate, and probation is not an option for this charge.9Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft For a defendant already looking at a wire fraud count, this provision guarantees at least two additional years behind bars.
State Charges Stack On Top
Most states have their own statutes targeting the same conduct. Many have enacted laws that specifically criminalize sending deceptive electronic communications designed to mimic legitimate businesses or government agencies in order to collect personal information. These phishing-specific laws typically become felonies when multiple victims are involved or when financial losses cross a statutory threshold.
States also apply general fraud, computer crime, and identity theft statutes to social engineering. Penalties vary, but felony charges carrying several years of imprisonment are common. State charges can be brought alongside federal charges for the same conduct, and a scheme that reached victims in several states can draw prosecutions in each one, in addition to any federal case.
What Victims Can Do
Sue in Civil Court
Victims can pursue compensation through the civil system independent of any criminal case. The usual theories are fraud, which requires showing the perpetrator made a false representation intending the victim to rely on it, and conversion, which applies when specific funds or property were taken and the victim wants them back.
The civil standard is “preponderance of the evidence” — more likely than not — rather than the “beyond a reasonable doubt” standard used in criminal court. That lower bar makes it realistic to win a civil judgment even when no criminal charges have been filed. Courts can award compensatory damages for actual losses and, in some cases, punitive damages.
Report to IC3
Reporting quickly is often the difference between recovering stolen money and losing it. The FBI’s Internet Crime Complaint Center (IC3) accepts complaints from anyone who believes they have been the victim of an internet-enabled crime, including social engineering. Complaints are analyzed and may be referred to federal, state, local, or international law enforcement.10Internet Crime Complaint Center (IC3). About Internet Crime Complaint Center For wire transfers, the IC3’s Recovery Asset Team works with banks to freeze funds before they are moved beyond reach. Filing a report does not guarantee an investigation, but it creates an official record and feeds into fraud-tracking databases that help build larger cases.
Federal civil asset forfeiture is another route for recovery. In a 2025 case, the Department of Justice used forfeiture to recover $7 million in proceeds from an investment fraud scheme that relied on social engineering, with victims invited to petition for the return of funds after the process was complete.11U.S. Department of Justice. United States Uses Civil Asset Forfeiture to Recover $7M of Investment Fraud Proceeds
Know the Regulation E Gap
One area where the law offers less protection than victims expect involves transfers the victim authorized themselves, even under deception. Federal Regulation E, which governs electronic fund transfers, defines an “unauthorized” transfer as one initiated by someone other than the consumer, without the consumer’s authority, and from which the consumer received no benefit.12eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) When a social engineer takes over an account and moves money without the consumer, the bank generally must investigate and reimburse.
The analysis shifts when the consumer is the one who sent the money. In schemes where the victim is talked into initiating a wire or payment-app transfer, the transaction was technically authorized, so Regulation E’s protections may not apply. Federal regulators have not issued specific guidance on bank liability for these “authorized fraud” transactions. The practical result: a victim who was manipulated into pressing “send” often has a harder time clawing back funds than one whose account was accessed directly.