Yes, you can sue someone for hacking your phone. Three federal statutes give you a civil cause of action — the Computer Fraud and Abuse Act, the federal Wiretap Act, and the Stored Communications Act — and most states let you add a common law privacy claim on top. Which combination fits depends on what the hacker did, what it cost you, and whether you can tie the intrusion to a specific person. You don’t need to know the hacker’s name to file.
The Laws You Can Sue Under
Each statute targets a different piece of the hack. Pairing claims is common, because the one with the best fit for the conduct isn’t always the one with the best damages.
Computer Fraud and Abuse Act
The CFAA, 18 U.S.C. § 1030, makes it illegal to intentionally access a computer or electronic device without authorization, and despite the name it applies to smartphones, tablets, and any internet-connected device. It gives private victims their own civil lawsuit alongside any criminal prosecution.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
The catch is a threshold. For most phone-hacking victims, the civil claim requires showing at least $5,000 in loss over any one-year period. The statute defines loss broadly: the cost of responding to the hack, assessing the damage, restoring data and systems, lost revenue, and consequential damages from an interruption of service all count.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers Forensic examination fees, credit monitoring, replacing compromised accounts, and time spent on cleanup add up faster than most victims expect.
If loss is your only qualifying factor, the CFAA limits you to economic damages. No emotional distress. No punitive damages. No attorney fees, though some courts have let plaintiffs count a portion of legal expenses toward the loss figure. You have two years to sue, running from the date of the hack or the date you discovered the damage, whichever is later.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
One boundary worth flagging: the Supreme Court held in Van Buren v. United States that “exceeds authorized access” applies only when someone reaches areas of a device that were entirely off-limits, not when someone with legitimate access uses it improperly.2Supreme Court of the United States. Van Buren v. United States A partner who already knew your passcode and read your messages is a harder CFAA case than a stranger who broke in remotely.
Federal Wiretap Act
The Wiretap Act covers real-time interception of electronic communications. If someone installed spyware or a monitoring app that captured your calls, texts, or data transmissions as they happened, that is an interception.3Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited
The damages picture is better than the CFAA’s. A successful plaintiff recovers the greater of actual damages plus any profits the hacker made, or statutory damages of $100 per day of violation or $10,000, whichever is greater. The court can also award punitive damages and must award reasonable attorney fees and litigation costs.4Office of the Law Revision Counsel. 18 USC 2520 – Recovery of Civil Damages Authorized The $10,000 statutory minimum is available even if you cannot prove a dollar of financial harm, which is why the Wiretap Act often carries a case built around private messages rather than money.
Stored Communications Act
The SCA reaches unauthorized access to communications already sitting in storage — email in your inbox, saved text messages, photos backed up to the cloud.5Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications A civil claim guarantees a minimum of $1,000 in damages even without proof of financial loss. Actual damages plus any profits the violator made are available if you can prove them, willful or intentional violations open the door to punitive damages, and prevailing plaintiffs recover reasonable attorney fees and litigation costs.6Office of the Law Revision Counsel. 18 USC 2707 – Civil Action
Fee-shifting under the Wiretap Act and SCA is the practical difference-maker. Phone-hacking cases need forensic analysis and technical expert testimony, and without the ability to recover those costs from the defendant, many victims cannot justify filing.
State Privacy Torts
Most states recognize intrusion upon seclusion, a common law tort that fits phone hacking well. You need to show four things: the defendant intentionally invaded your private matters without authorization, the invasion would offend a reasonable person, the matter was genuinely private, and the intrusion caused anguish or suffering. The intrusion itself is enough — the hacker does not have to have shared what they found.
State tort claims allow emotional distress damages that the CFAA does not, and they carry no $5,000 loss floor. The trade-off is the “offensive to a reasonable person” standard, which is subjective and harder to predict at trial.
Filing When You Don’t Know Who Hacked You
You can sue an unnamed defendant. A John Doe lawsuit uses the court’s subpoena power as the investigative tool: once the case is filed, you can subpoena online platforms, email providers, and cloud services for subscriber data tied to the suspicious activity, including email addresses, phone numbers, and IP addresses. The IP address is usually the most reliable lead, because platforms rarely verify other account information. From there, you subpoena the internet service provider for the subscriber’s name and address.
Timing is the constraint. Many ISPs retain IP logs for only 90 to 180 days, so waiting too long can mean the records are already gone. Some jurisdictions also require a motion showing a preliminary case for each claim before authorizing discovery subpoenas, which makes getting a lawyer involved early a practical necessity.
Cases involving someone the victim already knows — an ex-partner or business associate who installed spyware on a shared device — tend to be far more prosecutable than anonymous intrusions. Hackers operating through VPNs or overseas servers can be very difficult to trace even with forensic analysis and subpoenas, because those operations are built to prevent the trail from leading anywhere.
Preserving the Evidence
Digital evidence is fragile, and how you handle the phone in the first hours after you suspect a hack often decides whether a case is viable. Stop using the phone for anything nonessential. Change passwords from a separate device. Turn on two-factor authentication on your accounts. Do not factory-reset the compromised phone; wiping it destroys the forensic trail.
A certified digital forensic examiner should make a complete image of the phone at a fixed point in time. Investigators look for logs of unauthorized access, timestamps showing when files were opened or copied, IP addresses that connected to the device, and any installed spyware or remote-access tools. File metadata often reveals the origin and scope of the intrusion.
Chain of custody matters. Every person who handles the phone or its image needs to be documented, along with what they did and when, because a defendant who can argue tampering may get the evidence excluded. Save the peripheral material too: screenshots of unauthorized transactions, notifications of password changes you didn’t make, alerts from services about logins from unfamiliar devices, and any communications that suggest who did it or why.
Reporting to Law Enforcement Alongside a Civil Suit
A civil lawsuit and a criminal report are not mutually exclusive, and a parallel investigation can strengthen your case. The FBI’s Internet Crime Complaint Center accepts complaints about phone hacking; analysts review submissions and forward relevant information to law enforcement agencies. The IC3 does not run its own investigations and cannot give you status updates, so contact local law enforcement directly if the situation is time-sensitive.7Internet Crime Complaint Center. FAQ
A criminal conviction helps a civil plaintiff in two ways. First, federal law requires the sentencing court to order restitution to the victim, covering the value of damaged or stolen property, lost income, costs of necessary professional services related to the offense, and reasonable expenses you incurred participating in the investigation or prosecution, including transportation and lost wages for court appearances.8Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes Restitution is mandatory, though collecting on the order can be slow if the defendant has no assets. Second, if the hacker is convicted of the same conduct you are suing over, you do not have to re-prove that the hacking happened; the conviction does that work, and you focus on damages.
Whether Suing Is Worth It
The right to sue and a worthwhile judgment are different things. Digital forensic analysis of a compromised phone typically runs several thousand dollars before any court filings. State court filing fees for civil lawsuits range from roughly $30 to $500 depending on the jurisdiction and claim amount. Expert witness testimony at trial adds more. Under the CFAA, you pay these costs out of pocket even if you win. Under the Wiretap Act or SCA, a winning plaintiff recovers attorney fees, which is what makes moderate-damage cases financially viable.
The hardest part is usually not the legal theory but identifying the defendant and proving the connection. A John Doe suit only works if the digital trail leads somewhere. And even when it does, evidence degrades quickly: ISP logs disappear within months, phone data gets overwritten, and memories of the small suspicious events fade. The two-year CFAA clock runs from discovery, but moving fast after you notice a breach does far more for your case than the statute of limitations suggests.