Can You Go to Jail for Hacking Someone’s Account?

Yes, you can go to jail for hacking someone’s account. Under the federal Computer Fraud and Abuse Act, intentionally accessing an online account without permission is a crime that carries anywhere from up to one year in prison for a basic first offense to as much as 20 years for the most serious violations.¹ Every state has its own computer crime laws layered on top, so charges can come at the federal level, the state level, or both. And even when prosecutors pass on a case, the account holder can still sue you in civil court for damages.

What Actually Counts as Hacking

You do not have to write malware or break encryption to commit this crime. The legal concept behind almost every hacking prosecution is “unauthorized access”: entering a computer, network, or account without the owner’s permission.² Guessing a password counts. Using credentials someone left on a sticky note counts. Logging into an ex’s email because you still remember the password counts. The technique is irrelevant; what matters is that you were not authorized to be there.

A related theory is “exceeding authorized access,” which applies when you can legitimately use part of a system but poke into areas you were not cleared for. In 2021, the Supreme Court narrowed this considerably in Van Buren v. United States. The Court held that the CFAA targets people who reach into files or databases they were never allowed to open, not people who look at information they were allowed to see but used it for a forbidden reason.³ So misusing a database your employer gave you access to may violate company policy without automatically being a federal crime. The question is whether you entered a part of the computer you were never supposed to reach.

The statute also uses the phrase “protected computer,” which sounds narrow but reaches almost every internet-connected device, including personal laptops and phones.¹ If the account lives online, it is on a protected computer.

How Much Prison Time Is on the Table

The CFAA sets tiered maximums that turn on why you accessed the account, what you took, and whether you have done this before.¹

Simple unauthorized access to obtain information, with no financial motive and no prior conviction, carries up to one year. This is the tier that fits most one-off account intrusions where nothing is stolen.

The maximum jumps to five years on a first offense if the access was for commercial advantage or private financial gain, in furtherance of another crime, or if the value of the information obtained exceeded $5,000. Computer fraud and extortion charges also top out at five years for a first offense. Accessing classified national security information reaches ten years.

Repeat offenders face roughly doubled maximums across the board. A second simple-access conviction rises to ten years. Fraud and extortion move to ten. National security offenses reach 20.¹

These numbers are statutory ceilings, not automatic sentences. Judges typically sentence below the maximum, guided by the federal sentencing guidelines, the specifics of the offense, and the defendant’s record.

Other Charges Prosecutors Add

The CFAA rarely travels alone. Prosecutors routinely stack related counts when the facts support them.

Stored Communications Act

The Stored Communications Act specifically criminalizes unauthorized access to stored electronic communications: emails, direct messages, cloud files. A first offense carries up to one year, or up to five years if the access was for commercial advantage, malicious destruction, or private financial gain. Repeat offenders face up to ten.⁴ The conduct overlaps with the CFAA, and it is common to see charges filed under both.

Federal Identity Theft

Using someone else’s login credentials can also trigger the federal identity theft statute. The law defines “means of identification” broadly enough to cover usernames and passwords. A basic offense carries up to five years. Obtaining $1,000 or more in value pushes the maximum to 15 years. When the identity theft supports drug trafficking, a violent crime, or follows a prior identity theft conviction, the ceiling climbs to 20.⁵

State Charges for the Same Conduct

All 50 states, Puerto Rico, and the U.S. Virgin Islands have their own computer crime statutes, and some explicitly address hacking social media or other personal online accounts. State laws matter because federal agencies focus on large breaches, high-dollar fraud, and attacks on government systems. A single-account hack of an ex-partner’s Instagram is unlikely to draw federal attention, but a local prosecutor can still bring the case. You can be charged at the state level, the federal level, or both for the same conduct. Misdemeanor penalties typically run from a few hundred dollars in fines up to a year in jail; felonies carry multi-year prison terms and fines in the tens of thousands.

What Pushes a Sentence Up

Within these ranges, several factors drive where a sentence actually lands.

Intent. Hacking for money or to cause harm hits the higher penalty tiers. Accessing an account out of curiosity, without stealing anything, sits in a different world than draining a bank account.
Type of information. Government secrets, financial records, and trade secrets are treated more seriously than personal photos or casual messages.
Dollar amount of loss. This is where cases get expensive. Under the federal sentencing guidelines, total financial loss adds offense levels on a sliding scale: nothing below $6,500, twelve additional levels above $250,000, with each level translating into months or years of extra prison time.⁶
Prior convictions. A second CFAA conviction roughly doubles the statutory maximum across most categories.
Number of victims. Breaching one account is treated differently than compromising thousands.

The “loss” figure that drives sentencing is broader than most defendants expect. For computer crimes, it includes the victim’s costs to investigate the breach, restore systems to their pre-offense condition, and any revenue lost from service interruptions, in addition to money actually stolen.⁶ A hack that forces a business to hire a cybersecurity firm, notify customers, and rebuild infrastructure can push losses well past $100,000 even if nothing was taken.

Beyond Prison: Restitution, Supervision, and Civil Suits

Federal courts routinely order restitution on top of any prison sentence, requiring the defendant to reimburse the victim for the full financial loss. Inability to pay does not excuse the debt; unpaid restitution often gets enforced through wage garnishment for years.

Probation or supervised release usually follows prison. Conditions frequently restrict computer and internet use, which can be devastating for anyone whose work depends on technology. Violating those conditions can send you back inside.

Then there is civil liability. The CFAA gives the account holder a private right of action against anyone who caused them damage or loss through unauthorized access, with a two-year window to sue running from either the access or the discovery of the damage.¹ A successful plaintiff can recover compensatory damages, including money stolen, repair costs, lost revenue, and in some cases compensation for reputational harm or emotional distress. The victim can also obtain a court order requiring the hacker to stop. This civil deadline is separate from the criminal timeline and can apply even when no criminal charges are ever filed.

Hacking a Spouse, Partner, or Ex

The most common real-world version of this question involves someone close to the account holder, and the answer surprises many people: logging into a spouse’s, partner’s, or ex’s email, social media, or bank account without permission is illegal under both federal and state law. The relationship creates no exception. If you were never given the password, or if the password was shared during the relationship but access has since been revoked, using it is unauthorized access.

Federal prosecutors rarely take these cases because they involve one account and modest financial harm. State prosecutors are more willing, particularly when the access is tied to stalking, financial theft, or leverage in a custody fight. Even without criminal charges, the intrusion can badly damage your position in divorce or custody proceedings. Family courts notice, and it rarely helps the person who did the hacking.

Defenses That Actually Work

Not every accusation ends in a conviction. A few defenses come up regularly, though success depends heavily on the facts.

You Had Authorization

The most common defense is that the access was actually permitted. The password was shared voluntarily. The employer never revoked credentials after separation. After Van Buren, the question is whether the defendant was allowed to reach the particular area of the computer, not whether the access served an approved purpose.³

No Intent

The CFAA requires intentional access. Stumbling into a system through a software glitch, a misconfigured permission, or a bad link is not the same as deliberately breaking in. Fraud-based CFAA counts add a higher bar: the government must prove the defendant acted knowingly and with intent to defraud.

Terms of Service Violations Alone

Before Van Buren, some courts treated breaking a website’s terms of service as unauthorized access. The Supreme Court rejected that theory, warning it would “criminalize everything from embellishing an online-dating profile to using a pseudonym on Facebook.”³ Violating a site’s policies is far less likely to support criminal hacking charges today.

None of this means every account intrusion ends in prison. Plenty resolve with probation, fines, and restitution, especially for first offenses with limited harm. But the exposure is real, the statutory ceilings are high, and the civil consequences follow you even when the prosecutor does not.

1
Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers
2
United States Department of Justice. 9-48.000 – Computer Fraud and Abuse Act
3
Supreme Court of the United States. Van Buren v. United States, 593 U.S. 374 (2021)
4
Office of the Law Revision Counsel. 18 U.S. Code 2701 – Unlawful Access to Stored Communications
5
Office of the Law Revision Counsel. 18 U.S. Code 1028 – Fraud and Related Activity in Connection With Identification Documents
6
United States Sentencing Commission. 2B1.1 – Larceny, Embezzlement, and Other Forms of Theft