Is It Illegal to Hack Someone’s Account? 2026 Laws

Yes, hacking someone’s account is illegal under federal law in the United States, and it has been since 1986. The Computer Fraud and Abuse Act makes unauthorized access to any computer system or online account a federal crime, with penalties that range from misdemeanor fines to decades in federal prison.

Most people think hacking only applies to major corporations or government systems. That is wrong. Accessing a friend’s email, a partner’s social media, or an ex’s Netflix account without permission all fall under the same federal statute.

This article covers the exact laws that apply, the real penalties by offense type, the specific situations that surprise people most, and the narrow exceptions that exist in 2026.

For more context, see Is It Illegal to Get a Happy Ending? 2026 State Laws

Is It Illegal to Hack Someone’s Account

Yes, hacking someone’s account is illegal under federal law and under the computer crime statutes of all 50 US states. The act of accessing another person’s account without their permission is a criminal offense regardless of your motive, your relationship to the account holder, or whether you caused any damage.

The primary federal law is the Computer Fraud and Abuse Act (CFAA), codified at 18 U.S.C. 1030. The CFAA was enacted in 1986 and has been amended multiple times since, most recently expanded to address modern cybercrime. It prohibits unauthorized access to any computer or electronic system used in or affecting interstate commerce, which covers virtually every internet-connected account.

The law does not require that you be a skilled hacker. Guessing a password, using someone else’s login credentials, or exploiting a security weakness you happen to know about are all forms of unauthorized access that the CFAA covers.

Quick Facts:

• The CFAA has been federal law since 1986; violations are prosecuted by the DOJ
• All 50 states have separate computer crime statutes that can stack on top of federal charges
• “Hacking” does not require technical skill; any unauthorized account access qualifies
• Motive is irrelevant to whether the act is illegal; it affects sentencing
• Civil lawsuits can accompany criminal charges under the CFAA’s private right of action

Is It Illegal to Hack Into Someone’s Account

Hacking into someone’s account is a federal crime under 18 U.S.C. 1030(a)(2), which specifically prohibits intentionally accessing a computer without authorization and obtaining information from any protected computer. Every standard online account, from banking to email to streaming services, qualifies as a protected computer system under this definition.

The statute does not use the word “hacking.” It uses “unauthorized access” and “exceeds authorized access.” That broader framing captures a wide range of conduct. You do not need to write code, use specialized tools, or breach a firewall to violate the CFAA. Any method of gaining entry to an account you are not permitted to enter satisfies the statute.

Federal prosecutors have applied the CFAA to account access cases involving password guessing, social engineering, phishing, credential theft, and the use of another person’s stored credentials. Courts have consistently upheld these charges.

What counts as hacking into an account under federal law:

• Guessing or brute-forcing a password
• Using stolen or shared credentials without the account owner’s current permission
• Resetting someone’s password to gain access
• Using phishing to obtain login information and then using it
• Exploiting a known vulnerability to bypass account security
• Accessing an account after the account owner has revoked permission

Is Hacking Someone’s Account a Crime

Hacking someone’s account is a crime at both the federal and state levels in the United States. Federal prosecution occurs under the CFAA. State prosecution occurs under each state’s separate computer crime statute. Both sets of charges can be filed for the same act.

The criminal classification, misdemeanor or felony, depends on the specific circumstances. Under the CFAA, a first offense involving simple unauthorized access with no financial gain, no damage, and no aggravating factors is typically charged as a misdemeanor under 18 U.S.C. 1030(a)(2)(C). Add financial harm, government systems, or repeat offenses, and the charge escalates to a felony.

Beyond the CFAA, hacking an account often triggers additional criminal statutes. If the hacker reads stored emails or messages, the Stored Communications Act (18 U.S.C. 2701) applies. If personal information is stolen and used, identity theft statutes under 18 U.S.C. 1028 apply. Multiple charges from a single account access incident are common.

Key Takeaway: Hacking someone’s account is a federal crime, a state crime, and potentially multiple crimes simultaneously. A single unauthorized login can generate criminal charges under three or four different federal statutes at once.

What Law Makes Hacking Illegal in the US

The primary federal law that makes hacking illegal in the United States is the Computer Fraud and Abuse Act, codified at 18 U.S.C. 1030. The CFAA is the central statute for computer crime prosecution in federal courts and has been the foundation of cybercrime law since 1986.

The CFAA identifies seven categories of prohibited conduct in its subsections 1030(a)(1) through 1030(a)(7). The ones most relevant to account hacking are:

• 18 U.S.C. 1030(a)(2): Accessing a computer without authorization and obtaining information
• 18 U.S.C. 1030(a)(3): Unauthorized access to a government computer
• 18 U.S.C. 1030(a)(4): Accessing a computer to commit fraud
• 18 U.S.C. 1030(a)(5): Intentionally damaging a protected computer
• 18 U.S.C. 1030(a)(7): Threatening to damage a computer or demand money to stop

Beyond the CFAA, two other federal statutes frequently apply to account hacking. The Stored Communications Act (18 U.S.C. 2701 to 2712) prohibits unauthorized access to electronic communications stored on a service provider’s servers. The Electronic Communications Privacy Act (ECPA) governs the interception of electronic communications in transit.

State computer crime laws provide a parallel enforcement track. Every US state has its own computer intrusion statute that can be prosecuted independently of or alongside federal charges.

What Is Unauthorized Access to a Computer

Unauthorized access to a computer means accessing a computer system, network, or account in a way that the system owner has not permitted. The CFAA defines two types: pure unauthorized access, where you have no permission at all, and exceeding authorized access, where you have some permission but go beyond its boundaries.

The “exceeding authorized access” concept is one of the most legally significant and frequently litigated aspects of the CFAA. It captures situations where a person has legitimate access to some part of a system but uses that access to reach areas or information they are not permitted to see.

The Supreme Court addressed this in Van Buren v. United States (2021), ruling that “exceeding authorized access” applies to information a person is not entitled to obtain through their granted access, not simply using that access for an improper purpose. That decision narrowed the CFAA’s reach in some employment contexts but left the core prohibition on unauthorized account access fully intact.

Unauthorized access in practical terms:

• Accessing an account for which you have never been given credentials: Clearly unauthorized
• Using old credentials after the account owner changed the password: Unauthorized
• Using a shared household Netflix account after a breakup to monitor the ex’s activity: Unauthorized
• An employee accessing HR files they are not authorized to view from a work computer: Exceeds authorized access
• A system administrator reading private user files outside their job scope: Exceeds authorized access

Computer Fraud and Abuse Act Hacking Penalties

The Computer Fraud and Abuse Act sets penalty tiers based on the type of violation, whether it is a first offense, and whether any aggravating factors apply. Penalties range from misdemeanor fines to 20 years in federal prison for the most serious offenses.

Under 18 U.S.C. 1030(c), the sentencing structure is as follows:

The CFAA also allows the government to pursue civil forfeiture of any property derived from or used in the commission of a CFAA violation. This means computers, phones, and funds obtained through hacking can be seized.

Can You Go to Jail for Hacking Someone’s Account

Yes, you can go to federal prison for hacking someone’s account. The CFAA authorizes imprisonment for virtually every category of unauthorized computer access, and federal prosecutors pursue account hacking cases resulting in real prison sentences every year.

The most commonly charged account hacking offense, simple unauthorized access under 18 U.S.C. 1030(a)(2)(C) with no damage or financial gain, carries up to one year in prison for a first offense. That is a federal misdemeanor. Federal misdemeanor convictions carry real consequences beyond the sentence itself, including loss of certain professional licenses, immigration consequences for non-citizens, and a federal criminal record.

Cases involving financial gain, damage, or government systems jump to felony territory immediately. Documented federal cases of account hacking convictions have resulted in sentences ranging from 18 months to over 10 years in federal prison, depending on the scale and damage involved.

Factors that increase the likelihood and length of imprisonment:

• Financial gain from the hacked account
• Large number of accounts accessed
• Damage caused to the victim or their data
• Use of the hacked account to commit further crimes
• Access to government, military, or financial institution accounts
• Prior convictions for computer crimes
• Use of hacked information for stalking, harassment, or domestic abuse

Federal Hacking Charges and Penalties

Federal hacking charges are brought by the Department of Justice and prosecuted in federal district courts. The FBI Cyber Division is the primary investigative agency for federal account hacking cases. Federal charges carry more severe consequences than state charges in most hacking scenarios.

A first-offense federal hacking charge under 18 U.S.C. 1030(a)(2) with no aggravating factors results in a misdemeanor with up to one year imprisonment and fines up to $100,000 under 18 U.S.C. 3571. When financial gain, damage, or repeat offenses are present, the same conduct becomes a felony with dramatically higher sentences.

Federal hacking convictions also trigger collateral consequences that extend well beyond the prison term. A federal felony conviction can result in loss of voting rights in some states, prohibition on firearm ownership under 18 U.S.C. 922(g)(1), ineligibility for federal employment and many professional licenses, and deportation or inadmissibility for non-US citizens.

Key Takeaway: Federal hacking charges are not just about prison time. A federal conviction for account hacking follows a person for life through background checks, professional licensing boards, immigration authorities, and firearm eligibility databases.

Don't miss this — Is It Illegal to Have a Crack in Your Windshield? 2026

State Hacking Laws by State

Every US state has its own computer crime statute that operates independently of the CFAA. State charges can be filed in addition to federal charges for the same act of account hacking, meaning a single unauthorized account access can result in prosecution in both federal court and state court simultaneously.

State laws vary in their specific definitions, penalty tiers, and the type of systems covered. Some states are more aggressive than federal law in certain areas.

Florida’s statute is notably strict. Under Florida Statute 815.06, unauthorized account access is a third-degree felony from the first offense, meaning it carries up to five years in state prison even without aggravating factors.

Is It Illegal to Hack Someone’s Email Account

Hacking someone’s email account is illegal under federal law, and email accounts receive specific protection under both the CFAA and the Stored Communications Act (18 U.S.C. 2701). Accessing another person’s email without permission is one of the most commonly prosecuted forms of account hacking.

Email accounts are explicitly protected as “electronic communication services” under the SCA. Unauthorized access to stored email content is a separate federal offense from the basic unauthorized computer access charge under the CFAA. A person who hacks an email account and reads stored messages can face both CFAA charges and SCA charges simultaneously.

The SCA violation for reading stored emails carries a penalty of up to five years in federal prison for a first offense and up to ten years for repeat offenses under 18 U.S.C. 2701(b). Courts have applied these provisions to cases involving email accounts accessed through password guessing, password reset exploits, and shared credentials used after revocation.

What makes email hacking particularly serious legally:

• SCA applies separately from the CFAA, doubling the criminal exposure
• Email often contains financial, medical, and personal information that creates identity theft liability
• Domestic violence and stalking statutes frequently apply when a partner hacks an email account
• Civil lawsuits under the SCA’s private right of action (18 U.S.C. 2707) allow victims to sue for damages
• Evidence obtained from a hacked email is inadmissible in civil proceedings the hacker initiates

Is It Illegal to Hack Someone’s Social Media Account

Hacking someone’s social media account is illegal under the CFAA regardless of which platform is involved, whether the account is public or private, and regardless of your relationship to the account holder. Social media platforms are protected computers under 18 U.S.C. 1030.

People frequently assume that accessing a public social media profile is different from accessing a private one. That distinction matters for viewing publicly available content. It does not matter for accessing the account itself. Logging into another person’s Instagram, Facebook, Twitter, TikTok, or any other platform account without permission is unauthorized access under the CFAA.

Social media account hacking cases are among the most frequently investigated by the FBI Cyber Division because of how common they are. Reported cases include ex-partners accessing former significant others’ accounts, employees hacking competitors’ business accounts, and individuals impersonating account holders to commit fraud.

Think of it like a house. The fact that you can see through the window from the street does not give you the right to pick the lock and walk inside. The public-facing content of a social media profile is the window. The account itself is the house.

Specific social media hacking scenarios that have resulted in federal charges:

• Accessing an ex-partner’s Instagram to monitor their activity
• Resetting a competitor’s Facebook page password to lock them out
• Logging into an influencer’s account to post unauthorized content
• Using a former employer’s social media credentials after termination
• Accessing a deceased person’s account without estate authorization

Is It Illegal to Hack Your Spouse’s Account

Hacking your spouse’s account is illegal under the CFAA and under state computer crime statutes. Marriage does not create a legal right to access a spouse’s private accounts, and federal courts have consistently rejected “spousal exception” arguments in account hacking cases.

This surprises many people who assume that marital property concepts or spousal access rights extend to digital accounts. They do not. Account ownership and account access rights belong to the individual account holder. A spouse who accesses their partner’s email, social media, or messaging accounts without permission commits the same federal offense as any other unauthorized user.

In domestic contexts, account hacking charges often accompany civil protective orders, divorce proceedings, and in some cases, cyberstalking charges under 18 U.S.C. 2261A. Courts in divorce cases have also found that evidence obtained through unauthorized spousal account access is inadmissible in the divorce proceedings, and the accessing spouse may face sanctions.

Key Takeaway: Marriage is not a password. Accessing a spouse’s online accounts without explicit permission is a federal crime, a state crime, and grounds for evidentiary sanctions in divorce court. No court has recognized a spousal exception to the CFAA.

Is It Illegal for Employers to Hack Employee Accounts

Employers can legally monitor activity on company-owned devices and company accounts, but accessing an employee’s personal accounts without permission is illegal under the CFAA and the Stored Communications Act. The distinction between company accounts and personal accounts is the critical legal line.

When an employee uses a company email account or a company computer, the employer generally has legal authority to access that data. Employers typically establish this through acceptable use policies and employment agreements that employees acknowledge at hire. Under the ECPA’s business use exception, monitoring of company-owned systems is generally permissible when employees have been notified.

Accessing an employee’s personal Gmail, personal social media, or personal messaging applications without that employee’s explicit consent is unauthorized access regardless of whether the employee used a company device to log in. The CFAA applies to the account, not the device. A company that accesses an employee’s personal accounts faces the same federal charges as any other unauthorized user.

Is It Illegal to Log Into Someone’s Account if You Know the Password

Logging into someone’s account without their current permission is illegal even if you know the password, and federal courts have consistently ruled that knowledge of a password does not constitute authorization. Authorization is granted by the account holder, not derived from knowing credentials.

This is one of the most commonly misunderstood aspects of account hacking law. People believe that if they know someone’s password, whether because it was shared with them, because they observed the person typing it, or because they guessed it, using that password to access the account is acceptable. Federal courts disagree.

The key legal principle is that authorization to access an account can be revoked. A former romantic partner who was once given a password no longer has authorization once the relationship ends and the account owner has not reaffirmed the access. Using old credentials after revocation is unauthorized access under the CFAA.

Several federal circuit courts have addressed this directly. The Ninth Circuit ruled in United States v. Nosal (2016) that using another person’s credentials after the account owner revoked access constitutes unauthorized access under the CFAA even when the credentials themselves were legitimately obtained.

Password knowledge does not equal authorization when:

• The account owner changed the password after a relationship ended
• You learned the password by observing someone type it
• The password was shared for a limited purpose that has now ended
• The account owner has explicitly told you not to access the account
• You are using credentials from a previous employment after termination

Is It Illegal to Access Someone’s Account Without Permission

Accessing someone’s account without permission is illegal under federal law and under the computer crime statutes of every US state. There is no threshold of harm that must be crossed for the conduct to be criminal. The unauthorized access itself is the offense.

Under 18 U.S.C. 1030(a)(2), the government only needs to prove three elements: that you intentionally accessed a computer, that you did so without authorization or exceeding authorized access, and that you obtained information from a protected computer. Damage to the victim is not a required element for the basic CFAA charge.

Before you go further, consider reading Is It Illegal to Borrow Money for a Down Payment? 2026

This means that reading someone’s emails without deleting anything, browsing someone’s social media direct messages without posting anything, or checking someone’s account balance without transferring any funds are all illegal acts under the CFAA. The absence of harm to the victim does not create a legal defense.

Elements the government must prove for a basic CFAA violation:

• Intentional access (not accidental)
• Without authorization or exceeding authorized access
• Obtained information from a protected computer

Elements the government does NOT need to prove:

• Damage to the victim
• Financial gain by the hacker
• Sophisticated technical methods used
• Large volume of data accessed
• Victim awareness of the intrusion

Hacking Defenses and Legal Exceptions

Legal defenses to hacking charges are narrow, and the most commonly raised defenses in court have a mixed record of success. The strongest defenses challenge whether the access was truly “unauthorized” rather than arguing that the conduct was acceptable regardless of authorization status.

The most viable defenses in CFAA account hacking cases include:

Authorization defense: The defendant had actual permission from the account holder at the time of access. This requires proof of explicit authorization, not just past sharing of credentials.

Lack of intent: The CFAA requires intentional access. An accidental login due to saved credentials autofilling is theoretically defensible, though courts scrutinize claimed accidents carefully.

Scope of authorization: Post-Van Buren (2021), defendants can argue that their access stayed within the boundaries of what they were authorized to access, even if their purpose was improper. This defense is more applicable to employer-employee contexts than to complete strangers accessing accounts.

Ownership of the account: A person who owns a joint account or has been explicitly added as an authorized user has a strong authorization defense.

What does not work as a defense:

• “I only looked; I didn’t change anything”
• “I knew the password”
• “We were in a relationship”
• “I was just checking on them”
• “No harm was done”
• “I hired someone else to do it” (this makes you liable too)

Is It Illegal to Hire Someone to Hack an Account

Hiring someone to hack an account is illegal under the CFAA’s conspiracy provisions and potentially under additional federal statutes including 18 U.S.C. 371 (conspiracy to commit federal offense) and 18 U.S.C. 1030(b) (attempt and conspiracy to violate the CFAA). The person who hires the hacker faces the same criminal exposure as the hacker who carries out the act.

Under federal conspiracy law, a person who agrees with another to commit a CFAA violation and takes any step toward carrying out that plan is guilty of conspiracy regardless of whether the hack succeeds. Payment alone, combined with the agreement and intent, is sufficient for a federal conspiracy conviction.

The DOJ has prosecuted cases involving hired hackers, including individuals who paid for “hack-for-hire” services they found online. These prosecutions have resulted in federal felony convictions for the individuals who commissioned the hacking even when those individuals never touched a keyboard in relation to the crime.

Legal exposure for hiring a hacker:

• CFAA conspiracy under 18 U.S.C. 1030(b): Same maximum sentence as the underlying offense
• Federal conspiracy under 18 U.S.C. 371: Up to 5 years in federal prison
• Aiding and abetting under 18 U.S.C. 2: Treated as a principal to the crime
• Wire fraud under 18 U.S.C. 1343 if financial gain is involved: Up to 20 years
• State-level conspiracy charges on top of federal charges

Paying for a hack-for-hire service, even through an intermediary or anonymously, creates traceable digital evidence. Federal investigators have successfully traced cryptocurrency payments, encrypted communications, and dark web transactions in hack-for-hire prosecutions.

Frequently Asked Questions

Is it illegal to hack someone’s account in the United States?

Yes, hacking someone’s account is a federal crime under the Computer Fraud and Abuse Act at 18 U.S.C. 1030.
All 50 states have separate computer crime laws that can also apply.
Penalties range from a misdemeanor with up to one year in prison for basic unauthorized access to felonies carrying 10 to 20 years for serious offenses.

Can you go to jail for hacking someone’s social media account?

Yes, hacking a social media account can result in federal prison time under the CFAA.
A first-offense with no financial gain or damage carries up to one year; aggravating factors can push the sentence to five years or more.
State charges can stack additional penalties on top of any federal sentence.

Is it illegal to log into your spouse’s email without permission?

Yes, logging into a spouse’s email without their permission is illegal under the CFAA and the Stored Communications Act.
Marriage does not create a legal right to access a spouse’s personal accounts.
Federal courts have rejected spousal exception arguments in CFAA prosecutions, and evidence obtained this way can be excluded from civil proceedings including divorce cases.

What is the penalty for hacking someone’s account under the CFAA?

The penalty for basic unauthorized account access under 18 U.S.C. 1030(a)(2)(C) is up to one year in prison for a first offense.
Repeat offenses or cases involving financial gain, government systems, or damage carry felony penalties of 5 to 20 years in federal prison.
Civil liability under the CFAA’s private right of action allows victims to sue for compensatory and punitive damages separately from criminal prosecution.

Is it illegal to hire someone to hack an account even if you don’t do it yourself?

Yes, hiring someone to hack an account is a federal crime under CFAA conspiracy provisions at 18 U.S.C. 1030(b).
The person who hires the hacker faces the same criminal penalties as the person who executes the hack.
Federal prosecutors have successfully convicted individuals for commissioning hacks even when those individuals never directly accessed any computer system themselves.

Account hacking law in 2026 is clear, actively enforced, and far broader than most people assume. Whether it is a stranger’s bank account or an ex-partner’s Instagram, unauthorized access is a federal crime with real prison time attached.

Bookmark this page as a reference for what the law actually says, and share it with anyone who is curious about where the legal lines are in digital privacy and computer crime.

You may want to read Is It Illegal to Walk Around Without ID? 2026 Laws