The cybercrime definition is simple at its core: any illegal act in which a computer or network is the tool of the offense, the target of the offense, or both. That single idea now covers a sprawling range of conduct — unauthorized access to systems, ransomware, wire fraud, identity theft, cyberstalking, and the newer wave of AI-generated deepfake abuse. The FBI’s Internet Crime Complaint Center received more than 859,000 complaints in 2024, with reported losses above $16.6 billion.1Federal Bureau of Investigation. 2024 IC3 Annual Report
What ties these offenses together legally is not the technology, but the pairing of unauthorized conduct with criminal intent. A user who clicks a wrong link is not a cybercriminal. A person who deliberately breaks into a system, sends a deceptive email to steal money, or uses stolen data to impersonate someone else is.
The Main Federal Statute: The Computer Fraud and Abuse Act
Most federal cybercrime prosecution runs through the Computer Fraud and Abuse Act, codified at 18 U.S.C. § 1030. The statute makes it a crime to access a computer without authorization or to exceed the access a person was given.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers The reach is intentionally wide. A “protected computer” is any device used in interstate commerce or communication, which today means almost anything connected to the internet.3Office of the Law Revision Counsel. 18 US Code 1030 – Fraud and Related Activity in Connection with Computers
Intent is what separates a violation from an accident. Courts look for evidence that the person meant to enter a system they had no right to access, or that they knowingly went beyond permitted use. Stumbling into restricted data does not qualify; using stolen credentials or probing for weaknesses does.
Penalties depend on what was accessed and why. Simple unauthorized access to obtain information carries up to one year for a first offense. Taking data from a government system or reaching national security information can bring up to ten years. Repeat offenders face up to twenty.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers Fines for any federal felony can reach $250,000 under the general sentencing statute.4Office of the Law Revision Counsel. 18 US Code 3571 – Sentence of Fine
Attacks on Systems and Data
The oldest form of cybercrime targets digital infrastructure directly. Hacking means exploiting technical weaknesses to seize control of a network or its data. Once inside, an attacker can install ransomware that encrypts every file until the victim pays, or destroy data outright. Hospitals, school districts, and businesses have been shut down for days or weeks by these attacks.
Distributed denial of service attacks take a different route, drowning a server in junk traffic so it cannot serve real users. The target effectively goes offline. Under 18 U.S.C. § 1030, intentionally transmitting a program or command that damages a protected computer carries up to ten years for a first offense.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers When damage is reckless rather than intentional, enhanced penalties apply once aggregate losses cross $5,000 in a one-year period.3Office of the Law Revision Counsel. 18 US Code 1030 – Fraud and Related Activity in Connection with Computers
Courts can also order restitution covering the cost of restoring the compromised systems. The statute defines “loss” broadly to include damage assessments, data restoration, and revenue lost during service interruptions.3Office of the Law Revision Counsel. 18 US Code 1030 – Fraud and Related Activity in Connection with Computers For a hospital hit by ransomware or a retailer knocked offline for a week, that number often dwarfs any ransom paid.
Online Fraud and Identity Theft
The largest slice of reported cybercrime is fraud carried out through digital channels. Phishing, the deceptive message dressed up to look like it came from a bank, employer, or agency, remains the most common way in. The point is to trick someone into handing over passwords, account numbers, or a Social Security number. More sophisticated schemes use cloned websites and spoofed email addresses that are nearly indistinguishable from the real thing.
Federal prosecutors typically charge these cases under the wire fraud statute, 18 U.S.C. § 1343, which criminalizes using electronic communications to carry out a scheme to defraud someone of money or property. The maximum is twenty years per count, and cases involving financial institutions can bring up to thirty years and a $1,000,000 fine.5Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television Wire fraud is the workhorse charge because almost every modern scheme touches electronic communications somewhere.
When stolen data is used to impersonate a real person, identity theft charges under 18 U.S.C. § 1028 apply. Penalties run from five years for basic offenses to fifteen years for producing or trafficking in fraudulent identification documents, and up to twenty years when the theft is tied to drug trafficking or violent crime.6Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information If the stolen identity is used during any of dozens of enumerated felonies, aggravated identity theft under 18 U.S.C. § 1028A adds a mandatory two years on top of the underlying sentence, and that time cannot run concurrently.7Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
AI-Generated Fraud and Deepfakes
Artificial intelligence has opened a new front. Voice-cloning tools can replicate someone’s speech from a few seconds of audio, and deepfake video is now cheap enough for amateurs to produce convincingly. Criminals have used cloned voices to impersonate executives and authorize fraudulent wire transfers, and deepfake video has appeared in romance scams and extortion. These acts are generally prosecuted under existing wire fraud and computer fraud statutes, because the underlying conduct — using deception to take money or data — fits laws that predate the technology.
Congress has begun addressing deepfakes directly as well. The TAKE IT DOWN Act, enacted as Public Law 119-12, criminalizes publishing non-consensual intimate images, including AI-generated ones, and requires covered platforms to remove such content within 48 hours of a takedown notice. The FTC enforces the notice-and-removal process.8Federal Trade Commission. TAKE IT DOWN Act A separate proposal, the DEFIANCE Act, would create a federal civil right of action letting victims sue for damages and court-ordered removal. As of mid-2026, it has passed the Senate and is awaiting a House vote.9Congress.gov. S 1837 – DEFIANCE Act of 2025
Cyberstalking and Digital Harassment
Federal law treats stalking done through digital tools as a serious crime, not just online bad behavior. Under 18 U.S.C. § 2261A, it is illegal to use electronic communications in a course of conduct that places someone in reasonable fear of death or serious bodily injury, or that causes substantial emotional distress.10Office of the Law Revision Counsel. 18 US Code 2261A – Stalking The statute reaches threats sent through social media, email, messaging apps, or any other digital channel, and it extends to the victim’s family members and pets.
Penalties are set by 18 U.S.C. § 2261(b): up to five years when the conduct does not cause serious physical injury, up to ten years if the victim suffers serious bodily harm, and up to life if the stalking results in death.11Office of the Law Revision Counsel. 18 USC 2261 – Interstate Domestic Violence Stalking someone in violation of an existing protective order carries a mandatory minimum of one year.
A related offense involves logging into someone else’s accounts without permission. Using a former partner’s password to read their email or social media messages can qualify as unauthorized access under the CFAA, even when the password was originally shared willingly. Once permission is revoked, further access moves from personal dispute into federal criminal territory.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
Who Investigates and How to Report
Cybercrime investigation is divided across agencies. The FBI is the lead federal agency for cyberattacks and intrusions, especially those hitting critical infrastructure, involving state-sponsored actors, or producing large-scale breaches.12Federal Bureau of Investigation. Cyber The U.S. Secret Service focuses on financially motivated cybercrime and the transnational networks that target payment systems.13United States Secret Service. Cyber Investigations Offenses below federal thresholds are handled by state and local law enforcement under their own codes.
If you are the victim of a cybercrime, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. The form asks for the type of crime, any financial transactions involved, and information about the suspect if you have it. If money was lost, you will need transaction details such as account and routing numbers or cryptocurrency wallet addresses. Do not put your Social Security number or date of birth on the form.14Internet Crime Complaint Center (IC3). Complaint Form
For identity theft specifically, IdentityTheft.gov generates a personalized recovery plan. The FTC recommends four immediate steps: contact the fraud departments at companies where the theft occurred, place a free fraud alert with one of the three major credit bureaus (which then must notify the other two), review your credit reports for unauthorized accounts, and file your FTC report to create a paper trail.15Federal Trade Commission. How to Recover from Identity Theft A credit freeze, which is free, blocks new accounts from being opened in your name until you lift it.
Speed matters. Banks can sometimes reverse fraudulent transactions if they are flagged quickly, and IC3 operates a Recovery Asset Team that works with financial institutions to freeze wire transfers before the money is gone.