Types of Cybercrime: Examples, Reporting, and Penalties

The main types of cybercrime recognized under federal law include financial fraud and identity theft, investment and cryptocurrency scams, malware and ransomware attacks, AI-generated deepfakes and nonconsensual intimate imagery, cyberstalking and online harassment, digital piracy, and cyber espionage. Penalties scale with the conduct and the harm: a basic unauthorized access conviction can bring a year in prison, while a stalking offense that causes a victim’s death can bring life. Americans reported more than $16.6 billion in cybercrime losses in 2024 to the FBI’s Internet Crime Complaint Center.¹

Financial Fraud and Identity Theft

Financially motivated schemes do the most damage. Investment fraud and business email compromise alone accounted for more than $9 billion of the losses reported to the FBI in 2024.¹ The common thread is deception that gets you to hand over sensitive information or move money to an account the criminal controls.

Phishing is the most familiar form. An email, text, or call mimics a bank, employer, or government agency, creates urgency, and routes you to a fake site that captures your credentials, Social Security number, or payment details. Once criminals have that, they can empty accounts, open credit lines in your name, or sell the data on underground markets. Credit card fraud, sometimes called carding, uses stolen card numbers to make purchases or pull cash, and victims often spot it only when unauthorized charges appear.

Business Email Compromise

Business email compromise is one of the costliest scams in existence, with worldwide reported losses topping $55 billion between 2013 and 2023.² The attacker takes over a real business email account, then impersonates an executive or vendor to order a wire transfer to a fraudulent account. The requests look authentic because they come from genuine addresses, and the money is usually gone by the time anyone catches on.

Federal Penalties

The Computer Fraud and Abuse Act is the main statute prosecutors use for unauthorized access and digital fraud. Accessing a computer to commit fraud and obtain something of value carries up to five years in federal prison for a first offense and up to ten for a subsequent one. Unauthorized access to government systems or restricted data can bring up to ten years for a first offense and twenty for a second.³ The general federal fine statute permits fines of up to $250,000 per felony count for individuals.⁴

Wire fraud usually rides alongside these charges. It covers any scheme to defraud that uses electronic communications and carries up to 20 years in prison, rising to 30 if the scheme affects a financial institution.⁵ Nearly every online scam crosses state lines through some electronic channel, which gives prosecutors significant leverage.

When someone uses another person’s identity during a federal felony, aggravated identity theft adds a mandatory two-year prison sentence on top of the underlying crime. That term runs consecutively, so it cannot be absorbed into or served at the same time as the other sentence. If the identity theft is tied to terrorism, the mandatory add-on jumps to five years.⁶

Investment and Cryptocurrency Fraud

Investment fraud was the single costliest cybercrime category in 2024, responsible for more than $6.5 billion in reported losses, and cryptocurrency was involved in over $9.3 billion of total losses across all crime types that year.¹ The speed and relative anonymity of crypto transactions suit scammers who need to move money before anyone can intervene.

The dominant scheme is “pig butchering.” A scammer makes contact through a dating app, social media, or a text that looks misdirected. Over weeks or months they build trust, then steer the conversation toward a supposedly lucrative cryptocurrency investment on a fraudulent platform that shows fake returns. The victim invests more, and eventually the scammer disappears with the funds.⁷ These operations are often run by organized criminal networks overseas.

Federal prosecutors typically charge these schemes as wire fraud, carrying up to 20 years in prison.⁵ When the scammers also harvest victims’ personal information to set up accounts, aggravated identity theft can stack an additional two-year mandatory sentence.⁶

Malware, Ransomware, and DDoS Attacks

Malware attacks target the machines rather than the people. Viruses replicate across systems, worms spread without any human interaction, and spyware silently monitors what you do. These programs can damage files, steal data, or hand attackers remote control of your computer.

Ransomware is the most visible form. The attacker encrypts your files and demands payment, usually in cryptocurrency, before supplying a decryption key. Hospitals, school districts, city governments, and businesses of every size have been hit, and paying does not guarantee the attacker will actually restore access. Prosecutors charge ransomware under the CFAA’s extortion provision, which covers demands for money connected to damage of a protected computer. First offenses carry up to five years, repeat offenders up to ten.³

Distributed denial-of-service attacks take a different route. The attacker floods a server with so much traffic that it crashes and legitimate users cannot get through. E-commerce sites, banks, and government portals are frequent targets. The CFAA prohibits knowingly transmitting code or commands that intentionally damage a protected computer, and when damage is intentional a first conviction can bring up to ten years in federal prison, doubling to twenty on a second conviction.³ Courts also factor the cost of forensic investigations and system repairs into restitution.

AI Deepfakes and Nonconsensual Intimate Imagery

Generative AI tools can produce realistic fake images and video of real people, and criminals have used that capability to create nonconsensual intimate imagery for harassment, extortion, and blackmail. The TAKE IT DOWN Act specifically criminalizes publishing or threatening to publish nonconsensual intimate images, including AI-generated ones.

Penalties depend on the victim’s age:

Publishing nonconsensual intimate imagery of an adult carries up to two years in prison; threatening to publish for intimidation or extortion carries up to 18 months.
Publishing imagery of a minor carries up to three years; threatening to publish carries up to 30 months.

All violations also carry federal fines. The law additionally requires social media platforms to establish a removal process, and once a platform receives a valid request it must take the image down and make reasonable efforts to remove known copies within 48 hours.⁸

Cyberstalking and Online Harassment

Cyberstalking is a pattern of threatening or harassing behavior carried out through email, social media, messaging apps, or other electronic channels. Online harassment covers repeated digital communications meant to alarm or intimidate. Doxing, which means publishing someone’s home address, phone number, or workplace to encourage others to harass them, often accompanies these offenses. What separates these crimes from fraud is intent: the goal is fear or emotional distress, not money.

Under 18 U.S.C. § 2261A, it is a federal crime to use electronic communication services to engage in a course of conduct that places someone in reasonable fear of death or serious injury, or that causes substantial emotional distress.⁹

Sentencing scales with the harm caused:

Death of the victim: life imprisonment or any term of years
Permanent disfigurement or life-threatening injury: up to 20 years
Serious bodily injury: up to 10 years
All other cases: up to 5 years

Violating a restraining order or no-contact order through stalking conduct triggers a minimum of one year in prison.¹⁰ Courts also frequently issue protective orders restricting how a defendant can use technology to contact the victim going forward.

Digital Piracy and Copyright Infringement

Digital piracy — the unauthorized copying and sharing of copyrighted movies, music, software, and other works — remains a persistent category of cybercrime. Large-scale operations distribute content through file-sharing networks, streaming sites, and encrypted platforms. The PRO-IP Act expanded federal authority to seize equipment, media, and financial records used in intellectual property crimes.¹¹

On the civil side, copyright holders can seek statutory damages instead of proving actual losses. A court can award up to $30,000 per work infringed, rising to $150,000 per work if the infringement was willful.¹² Because the figure is per work, someone who pirated 50 movies could face millions in damages in a single civil suit.

Corporate and Government Cyber Espionage

Cyber espionage covers targeted operations designed to steal trade secrets, proprietary technology, or classified government data. State-sponsored hacking groups are the primary actors, and their aim is long-term economic or military advantage rather than quick cash. A successful operation can undermine entire industries when a foreign competitor gains access to years of research and development.

The Economic Espionage Act targets trade secret theft committed to benefit a foreign government, and its penalties are among the steepest in cybercrime law. An individual convicted of economic espionage faces up to 15 years in prison and fines up to $5 million. Organizations face the greater of $10 million or three times the value of the stolen trade secret, including the research and development costs the organization avoided by stealing rather than innovating.¹³ That multiplier can produce staggering fines when the stolen technology represents billions in R&D spending.

How to Report Cybercrime and Recover Losses

If you have been victimized, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. IC3 accepts reports of any cyber-enabled crime regardless of the dollar amount, and its data feeds directly into FBI investigations.¹⁴ If money was stolen, contact every financial institution involved immediately. Speed matters, because banks can sometimes freeze or reverse transfers that have not fully cleared.

For identity theft specifically, the FTC’s recovery process at IdentityTheft.gov builds a personalized plan. The core steps: contact the fraud department of every company where unauthorized activity occurred, place a free fraud alert with one of the three credit bureaus (which is then legally required to notify the other two), and review your credit reports for accounts you did not open.¹⁵ Filing at IdentityTheft.gov produces an official identity theft report, which businesses and creditors are more likely to act on than an informal complaint.¹⁶

When federal prosecutors convict a cybercriminal, victims may be entitled to court-ordered restitution. Restitution is mandatory in federal cases for identified victims whose losses are included in the conviction or plea agreement. To claim it, you complete a Victim Loss Statement provided by a U.S. Probation Officer after the conviction, documenting your losses with receipts or other verification.¹⁷ In fraud cases, courts typically order restitution equal to the amount fraudulently obtained. Collecting from cybercriminals who moved funds offshore can take years, but the legal right to recover does not expire quickly.

1
FBI. 2024 IC3 Annual Report
2
FBI IC3. Business Email Compromise: The $55 Billion Scam
3
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
4
Office of the Law Revision Counsel. 18 US Code 3571 – Sentence of Fine
5
Office of the Law Revision Counsel. 18 US Code 1343 – Fraud by Wire, Radio, or Television
6
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
7
United States Secret Service. Avoid Scams: Investment Fraud and Pig Butchering
8
Congress.gov. S.146 – TAKE IT DOWN Act
9
Office of the Law Revision Counsel. 18 US Code 2261A – Stalking
10
Office of the Law Revision Counsel. 18 USC 2261 – Interstate Domestic Violence
11
GovInfo. Public Law 110-403 – Prioritizing Resources and Organization for Intellectual Property Act of 2008
12
Office of the Law Revision Counsel. 17 USC 504 – Remedies for Infringement: Damages and Profits
13
Office of the Law Revision Counsel. 18 USC 1831 – Economic Espionage
14
FBI. FBI Releases Annual Internet Crime Report
15
Federal Trade Commission. How to Recover From Identity Theft
16
Federal Trade Commission. IdentityTheft.gov Helps You Report and Recover From Identity Theft
17
U.S. Department of Justice. The Restitution Process for Victims of Federal Crimes