Phishing Laws, Criminal Penalties, and Victim Rights

Phishing laws and penalties in the United States come from a stack of federal statutes rather than a single law, with prison exposure running from two years to thirty depending on what the attacker did and whom they targeted. Wire fraud, computer fraud, identity theft, and email fraud statutes all apply, and prosecutors routinely charge several at once. The FBI’s most recent annual report logged more than 191,000 phishing and spoofing complaints with reported losses above $215 million, and those figures almost certainly undercount the real total because many victims never file.1FBI. 2025 IC3 Annual Report

Federal Statutes Used to Charge Phishing

No federal law is titled “the phishing statute.” Prosecutors assemble charges from fraud, identity, and computer crime provisions, and the mix depends on how the scheme worked, what was stolen, and whether a financial institution was involved.

Wire Fraud

Wire fraud under 18 U.S.C. § 1343 is the workhorse. It reaches any scheme to defraud someone of money or property through electronic communications, which covers email, text messages, and phone calls. Phishing almost always crosses state lines in transmission, which gives federal prosecutors jurisdiction over nearly every operation. The maximum sentence is 20 years in prison. If the scheme targets or affects a financial institution, the ceiling rises to 30 years and a fine of up to $1,000,000.2Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television

Computer Fraud and Abuse Act

When a phishing message leads to unauthorized access of a computer system, prosecutors add charges under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030. The statute reaches anyone who accesses a protected computer without authorization and obtains information, including financial records or consumer data. It separately covers anyone who accesses a protected computer with intent to defraud and gets something of value from that access.3Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers

Penalties scale with the conduct. A first offense involving unauthorized access to obtain information carries up to one year. Access for financial gain or in furtherance of another crime raises the maximum to five years. Repeat offenders face up to ten.3Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers

Identity Theft and Aggravated Identity Theft

Because phishing is fundamentally about stealing identifying information, identity theft charges appear in most cases. Under 18 U.S.C. § 1028, using another person’s identification without authorization to commit a federal crime carries up to five years for most offenses, and up to 15 years when the conduct involves producing or transferring documents like driver’s licenses or birth certificates. If the identity theft facilitated drug trafficking or a violent crime, the maximum reaches 20 years. Cases connected to terrorism carry up to 30.4Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information

Aggravated identity theft under 18 U.S.C. § 1028A is a separate charge that stacks on top of the underlying felony. Using another person’s identifying information during and in relation to a listed felony triggers a mandatory two-year sentence that must run consecutively, meaning it is added after the sentence for the underlying crime. Probation is not available for this charge.5Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft

CAN-SPAM and Email Fraud

The CAN-SPAM Act, 15 U.S.C. § 7704, makes it illegal to send commercial emails with false or misleading header information or deceptive subject lines. Phishing emails that disguise the sender’s identity violate its core prohibitions.6Office of the Law Revision Counsel. 15 USC 7704 – Other Protections for Users of Commercial Electronic Mail

The companion criminal statute, 18 U.S.C. § 1037, targets email-based fraud more directly. Sending large volumes of deceptive emails, using falsified registration information to send messages, or causing more than $5,000 in losses over a year all carry up to three years. If the email fraud furthers another felony, the maximum rises to five.7Office of the Law Revision Counsel. 18 USC 1037 – Fraud and Related Activity in Connection With Electronic Mail

Impersonating a Federal Officer

Some of the most effective phishing attacks pose as federal agencies, especially the IRS and Social Security Administration. Impersonating a federal officer or employee to obtain money or anything of value is a separate crime under 18 U.S.C. § 912, carrying up to three years.8Office of the Law Revision Counsel. 18 USC 912 – Officer or Employee of the United States This charge is often stacked on top of wire fraud and identity theft when an attacker claims to be a federal agent.

How the Penalties Stack

Because phishing prosecutions typically involve several of these statutes at once, actual exposure can run far beyond the maximum for any single count. The headline prison numbers:

Fines follow the general federal sentencing statute. For most felonies, an individual faces up to $250,000 and an organization up to $500,000 per offense.9Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine The $1,000,000 wire fraud cap for schemes affecting a financial institution overrides that schedule.2Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television

Restitution is not optional. Under the Mandatory Victims Restitution Act, courts must order the defendant to reimburse victims for the value of lost or damaged property and related expenses, including the costs of identity recovery.10Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes Criminal forfeiture of assets acquired through the scheme is standard as well.

Federal prosecutors generally have five years from the date of the offense to charge wire fraud or computer fraud.11Office of the Law Revision Counsel. 18 USC 3282 – Offenses Not Capital That window doubles to ten years when the wire fraud scheme affects a financial institution.12Office of the Law Revision Counsel. 18 USC 3293 – Financial Institution Offenses The longer window matters because large phishing operations against bank customers may not be fully uncovered for years.

What to Do Right After You’ve Been Phished

If you clicked a link, entered credentials, or shared personal information in response to a phishing message, speed matters. The first few hours determine whether an attacker can exploit what they obtained.

  • Change compromised passwords immediately. Start with the directly targeted account, then change any other account where you used the same or a similar password. Turn on multi-factor authentication wherever it is available.
  • Call your bank or credit card company. If you shared financial information, your bank can freeze the account, reverse unauthorized transactions, and issue new card numbers. The sooner you call, the better your chances of recovering stolen funds.
  • Place a credit freeze. A freeze stops anyone from opening new credit accounts in your name, including you. It is free to place and free to lift, and you have to contact all three credit bureaus individually: Equifax, Experian, and TransUnion. The freeze stays in place until you remove it.13Federal Trade Commission. Credit Freezes and Fraud Alerts
  • Consider a fraud alert instead or in addition. An initial fraud alert lasts one year and requires lenders to verify your identity before granting new credit. You only need to contact one bureau; it notifies the other two. If you file an identity theft report with the FTC or police, you qualify for an extended alert lasting seven years.13Federal Trade Commission. Credit Freezes and Fraud Alerts
  • Watch your accounts and credit reports. Check bank and card statements daily for several weeks, and pull your credit reports to look for unfamiliar accounts or inquiries.

The difference between a freeze and a fraud alert matters. A freeze blocks new accounts entirely until you lift it. A fraud alert only requires lenders to take extra verification steps, which is less protection but does not require you to remember to lift it before applying for credit yourself.

Where to Report Phishing

Reporting serves two purposes. It feeds law enforcement data they use to build cases against phishing networks, and it creates documentation you may need when disputing fraudulent charges or recovering stolen funds.

The FBI’s Internet Crime Complaint Center is the central federal intake for cyber-enabled crime. File at ic3.gov with as much detail as you can: the content of the message, email headers, URLs, and records of any resulting financial transactions. You will get a confirmation and complaint number. An individual investigation is not guaranteed for every report, but IC3 data feeds directly into FBI efforts against large operations.14Internet Crime Complaint Center. Internet Crime Complaint Center

If the attack compromised your personal information, also report to the FTC at IdentityTheft.gov. The FTC uses your answers to generate a personalized recovery plan and an Identity Theft Report, which serves as official documentation when you contact credit bureaus, banks, and other institutions to dispute fraudulent activity.15Federal Trade Commission. Stolen Identity? Get Help at IdentityTheft.gov

For IRS impersonation, forward suspicious emails to phishing@irs.gov. Save and attach the email rather than simply forwarding, because a plain forward strips metadata investigators need. Forward IRS-themed text scams to 7726 (SPAM), and report phone-based IRS impersonation to the Treasury Inspector General for Tax Administration at 800-366-4484.16Internal Revenue Service. Report Fake IRS, Treasury or Tax-Related Emails and Messages

You can also forward phishing emails to reportphishing@apwg.org. The Anti-Phishing Working Group is a global coalition that aggregates phishing data and shares it with member organizations working on fraud prevention and criminal tracking.17APWG. Report Phishing Most major email services also have built-in reporting tools. Outlook lets you flag a message as phishing through its menu, and Gmail has a “Report phishing” option under the three-dot menu on a message.

Can You Sue the Person Who Phished You?

The criminal statutes above are prosecuted by the government, not by individual victims. If you are hoping to file your own federal lawsuit, the options are narrow.

Wire fraud has no private right of action, so victims cannot sue under 18 U.S.C. § 1343 directly. The CAN-SPAM Act allows civil suits only by internet service providers that can prove they were adversely affected by specific violations, a standard courts have found nearly impossible to meet even for ISPs. Individual consumers have no standing under CAN-SPAM at all.

State law is where civil remedies live. Most states have consumer fraud statutes, deceptive trade practices acts, or computer crime laws that provide a civil cause of action for people harmed by fraudulent schemes. The elements, available damages, and filing fees vary by jurisdiction. If your losses are large enough to justify litigation, a lawyer familiar with your state’s fraud statutes can tell you whether a civil case is worth pursuing. The practical obstacle is usually identifying the attacker and finding assets to recover, which is why the criminal process and the restitution that comes with it tends to be the more realistic route to getting money back.