What Is Email Fraud? Schemes, Penalties, and Recovery

Email fraud is the use of email to deceive someone into sending money, handing over sensitive personal data, or taking another action that benefits the sender. Federal prosecutors treat it primarily as wire fraud under 18 U.S.C. § 1343, which carries up to 20 years in prison per offense and up to 30 years when a financial institution is involved.¹ The FBI’s Internet Crime Complaint Center recorded $16.6 billion in total internet crime losses in 2024, with business email compromise alone accounting for $2.77 billion of that figure.²

What Counts as Email Fraud Under Federal Law

To secure a wire fraud conviction, prosecutors must prove three things: the defendant created or participated in a scheme to defraud, the scheme involved false statements or misrepresentations of fact, and the defendant used interstate electronic communications to carry it out.¹ Courts read “scheme to defraud” broadly. No victim has to have actually lost money; intent and attempt are enough to support charges.

Because email crosses state and national borders by default, federal jurisdiction applies to nearly every case. That puts email fraud in the hands of the FBI and U.S. Attorney’s offices rather than local police alone. Prosecutors also commonly stack charges under statutes for computer fraud, identity theft, and conspiracy on top of the base wire fraud count.

The Schemes You Are Likely to Encounter

Phishing is the broadest form. Attackers send mass messages designed to look like they came from a bank, a government agency, or a well-known company, directing recipients to fake websites that harvest login credentials, Social Security numbers, or payment information. The approach relies on volume. Even a tiny response rate across thousands of messages produces usable stolen data.

Spoofing is the technical backbone behind many phishing campaigns. The attacker alters the email header so the “From” field shows a trusted name or domain. A spoofed message might appear to come from your bank, your employer, or a family member.

Business email compromise (BEC) is the most financially destructive variant. Rather than blasting strangers, the attacker targets a specific company, usually by first getting into a real employee’s email account through an earlier phishing attack or a credential leak. Once inside, they monitor conversations, wait for a high-value transaction, and then step in with instructions to redirect payment to a fraudulent bank account. Because the message comes from a legitimate internal address, standard filters miss it and recipients rarely question the request. BEC accounted for more than $2.7 billion in reported losses in 2024.²

How to Spot a Fraudulent Email

Look at the actual email address, not the display name. A message might show “Chase Bank” in bold at the top but come from an address like support@chse-alerts.com. Subtle misspellings in the domain are the most common giveaway. Hover over any link without clicking to see where it leads. If the URL doesn’t match the organization’s real website, treat the entire message as suspicious.

Urgency is the primary psychological lever. Messages threatening account suspension, legal action, or missed deadlines within hours are almost always scams. Legitimate organizations don’t set countdown timers on routine communications. Any request to pay through gift cards, cryptocurrency, or wire transfers to an individual should be treated as fraudulent. No real bank, government agency, or employer collects money that way.

For messages that pass the visual test but still feel off, check the full headers. Most email clients let you view them through a “Show Original” or “Message Source” option. A mismatch between the “From” address and the “Return-Path” domain is a strong indicator of spoofing. Failed SPF, DKIM, or DMARC authentication results mean the message didn’t come from the server it claims to represent.

Penalties for Email Fraud

Prosecutors pick the combination of statutes that fits the conduct, and defendants regularly face charges under more than one.

Wire Fraud

18 U.S.C. § 1343 is the primary tool. The base offense carries a fine of up to $250,000 and up to 20 years in federal prison.¹³ When the fraud affects a financial institution or involves a federally declared disaster, the maximum rises to a $1 million fine and 30 years in prison. Courts can also impose a fine equal to twice the defendant’s gain or twice the victim’s loss, whichever is greater, if that amount exceeds the statutory cap. Each fraudulent email can be charged as a separate count, so sentences for prolific schemes add up quickly.

Computer Fraud and Abuse Act

When email fraud involves hacking into accounts or unauthorized access to computer systems, prosecutors add charges under 18 U.S.C. § 1030. Accessing a protected computer with intent to defraud carries up to five years in prison for a first offense and up to ten years for a subsequent conviction.⁴ This statute is especially relevant in BEC cases where the attacker broke into a legitimate corporate email account before sending fraudulent payment instructions.

Aggravated Identity Theft

If the defendant used someone else’s identity during the fraud, 18 U.S.C. § 1028A adds a mandatory two-year prison sentence on top of whatever sentence the underlying wire fraud conviction produces. The two years must run consecutively, so the court cannot absorb them into the other sentence or reduce the wire fraud sentence to compensate.⁵ Probation is not an option for this charge.

Conspiracy

Many email fraud operations involve multiple people handling different parts of the scheme. The federal conspiracy statute, 18 U.S.C. § 1349, carries the same penalties as the underlying offense, so a conspiracy to commit wire fraud is punishable by up to 20 years in prison even if the planned fraud never succeeded.⁶

CAN-SPAM Act

CAN-SPAM is a civil enforcement tool rather than a criminal one, but it adds another layer of liability for fraud sent through commercial email. The law requires accurate sender information and honest subject lines, and each individual email sent in violation can draw a penalty of up to $53,088.⁷ For operations sending thousands of messages, those per-message penalties accumulate fast.

What to Do If You’ve Been Targeted

Speed matters enormously when money has already left your account. Contact your bank first and ask them to initiate a recall on the transfer. Then file a complaint with the FBI’s Internet Crime Complaint Center (IC3), which serves as the central federal intake point for cybercrime.⁸ The IC3 Recovery Asset Team works directly with banks to freeze fraudulent transfers. In 2024, the team froze approximately $561.6 million, a 66% success rate on attempted thefts.² That rate drops sharply with every hour that passes, so filing within the first 24 to 48 hours gives you the best chance of recovery.

Beyond IC3, file a report with the Federal Trade Commission at ReportFraud.ftc.gov. The FTC feeds reports into a database shared with more than 2,800 law enforcement agencies.⁹ If the fraud involved identity theft, the FTC’s IdentityTheft.gov portal generates a personalized recovery plan and an official identity theft report that you can use with creditors and banks.¹⁰

For phishing emails impersonating the IRS or U.S. Treasury, forward the message to phishing@irs.gov with the subject line “IRS” or “Treasury.”¹¹ You can also forward any phishing email to reportphishing@apwg.org, which feeds into a global database used by security researchers and email providers to shut down phishing infrastructure.

Preserve the original email without clicking links or downloading attachments. Include the full headers, the date and time the message arrived, the sender’s address, and any transaction records if money changed hands. That forensic detail is what investigators need to trace the attack.

Getting Your Money Back

Your legal protection depends heavily on how the money left your account. For unauthorized electronic transfers from a bank account, Regulation E caps your liability based on how quickly you report:

Within two business days: maximum liability of $50.
Between two and 60 days: liability rises to $500.
After 60 days: you could be liable for the full amount of any transfers that occurred after the 60-day window, if the bank can show that prompt reporting would have prevented them.¹²

Wire transfers are a different story. Regulation E doesn’t cover traditional wire transfers, which fall under UCC Article 4A instead. If your bank followed its security procedures and processed the transfer in good faith, you generally bear the loss for an authorized payment that you were tricked into making. The distinction is harsh but important. If someone hacked your account and sent a wire without your knowledge, the bank may be liable. If you authorized the wire yourself because a scammer deceived you, recovery through the bank is far more difficult.

That is why the IC3 Recovery Asset Team matters so much. For domestic wire transfers, the team contacts the receiving bank to freeze funds before withdrawal. For international transfers, a SWIFT recall request should be initiated within 24 to 48 hours.¹³ The longer you wait, the more likely the money has already been moved or withdrawn as cash.

Protecting Your Identity After Sharing Information

If you handed over your Social Security number, date of birth, or account credentials in response to a fraudulent email, the damage extends well beyond the initial loss.

Place a security freeze with all three credit bureaus: Equifax, Experian, and TransUnion. A freeze prevents anyone from opening new credit accounts in your name. You can submit the request online or by phone, and the bureaus must freeze your file within one business day. There is no cost to place or lift a freeze.¹⁴

If your Social Security number was compromised, call the Social Security Administration at 1-800-772-1213 and request a Block Electronic Access on your record. This prevents anyone, including you, from viewing or changing your information online or through the automated phone system until you contact SSA to remove the block.¹⁵

Change passwords immediately on any account that shared credentials with the compromised one, and on any other account where you reused the same password. Enable two-factor authentication on email, banking, and anything else that supports it. The single most common way BEC attackers get into corporate email is through reused or stolen passwords.

Can You Deduct the Loss on Your Taxes

Individuals who lost personal funds to email fraud generally cannot deduct the loss on their federal tax return. Since 2018, personal theft losses are deductible only if they result from a federally declared disaster, and email fraud doesn’t qualify.¹⁶

There is one exception, for losses from transactions entered into for profit. If you invested money based on a fraudulent solicitation, you may be able to claim a theft loss deduction under IRS Section 165, provided the conduct qualifies as theft under your state’s laws and you have no reasonable prospect of recovering the funds.¹⁶ Businesses that lose money to BEC or other email fraud can generally deduct the loss as a business expense. Whether the money was personal or profit-related is the deciding factor.

1
Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
2
Internet Crime Complaint Center. 2024 IC3 Annual Report
3
Office of the Law Revision Counsel. 18 US Code 3571 – Sentence of Fine
4
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
5
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
6
Office of the Law Revision Counsel. 18 US Code 1349 – Attempt and Conspiracy
7
Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business
8
Internet Crime Complaint Center. IC3 Home Page
9
Federal Trade Commission. ReportFraud.ftc.gov
10
Federal Trade Commission. IdentityTheft.gov
11
Internal Revenue Service. Report Fake IRS, Treasury or Tax-Related Emails and Messages
12
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
13
Department of Justice. Domestic Financial Fraud Kill Chain Process
14
USAGov. How to Place or Lift a Security Freeze on Your Credit Report
15
Social Security Administration. How You Can Help Us Protect Your Social Security Number and Keep Your Information Safe
16
Internal Revenue Service. Instructions for Form 4684