Catfishing is illegal when the fake identity is used to commit another wrong: taking someone’s money, stealing their identity, harassing or stalking them, or extorting them. Inventing a persona online and wasting someone’s time is dishonest but usually not a crime by itself. Once the deception becomes the means of causing real harm, federal and state laws written for fraud, identity theft, stalking, and extortion apply, with penalties that run from misdemeanor jail time up to 20 years in federal prison.
The Line Between Lying Online and Breaking the Law
No federal statute makes it a crime to create a fake dating profile. Someone who invents a name, borrows a stock photo, and chats with strangers has behaved badly but probably hasn’t broken a law. The legal picture changes the moment that persona is used to get money from you, obtain your personal information, threaten you, or coerce intimate images.
Most catfishing prosecutions rely on laws written before catfishing had a name. Federal identity theft, wire fraud, cyberstalking, and extortion statutes all reach online deception when it produces a concrete harm. About a dozen states have added specific online impersonation laws, and a handful directly address catfishing; the rest use general fraud, harassment, and impersonation statutes.
Identity Theft
If a catfisher uses a real person’s name, photos, or other identifying details to build the fake profile, that alone can trigger federal identity theft charges. Knowingly using another person’s identifying information in connection with any illegal activity is punishable by up to 15 years in prison and fines.1Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information This is the classic scenario where a scammer downloads someone’s photos and biography and reassembles them into a convincing persona on social media.
When identity theft happens during another serious federal offense such as fraud, aggravated identity theft adds a mandatory two-year sentence that runs consecutively to whatever else is imposed.2Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft Prosecutors use this to stack time on catfishing cases involving financial loss.
The person whose identity was stolen is a victim in their own right and is entitled to restitution from the offender under federal law.
Wire Fraud in Romance Scams
The most financially devastating form of catfishing is the romance scam, where a fake persona builds an emotional relationship and then asks for money. Because the deception moves through email, dating apps, or social media, it qualifies as wire fraud. The standard penalty is up to 20 years in federal prison and fines. If a financial institution is affected or the fraud relates to a federally declared disaster, the maximum rises to 30 years and a $1 million fine.3Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
A wire fraud charge doesn’t require the catfisher to have actually gotten your money. Devising the scheme and using electronic communications to carry it out is enough. That matters when the victim recognizes the scam before sending anything: the crime is still complete.
Reported losses reflect how large this category has become. In 2024, consumers reported losing nearly $2.95 billion to imposter scams, and social media was the single costliest contact method, with roughly $1.86 billion in reported losses.4Federal Trade Commission. Consumer Sentinel Network Data Book 2024
Criminal Impersonation
Criminal impersonation is mostly a state offense, and it reaches further than identity theft. Identity theft requires the use of a real person’s information. Impersonation covers pretending to be someone else, including an entirely fictional person, when done with intent to deceive and gain a benefit or cause harm.
Basic criminal impersonation is usually a misdemeanor with up to a year in jail. It becomes a felony when it causes significant financial loss or is used to commit another crime. States with separate statutes for the two offenses consistently treat identity theft as the more serious one because it involves stealing a real person’s information.
Several states have added laws that specifically target online impersonation, recognizing that using another person’s name or likeness online without permission, and with intent to harm or defraud, is a distinct kind of harm. Elements and penalties differ by jurisdiction, but the core conduct is the same.
Cyberstalking and Harassment
Catfishing crosses into stalking when the contact becomes persistent, unwanted, and threatening. Federal law makes it a crime to use an electronic communication service with intent to harass or intimidate someone when the conduct places the victim in reasonable fear of serious injury or causes substantial emotional distress.5Office of the Law Revision Counsel. 18 USC 2261A – Stalking
Federal cyberstalking penalties are tiered by the harm caused:
- Up to 5 years in prison for stalking that causes fear or emotional distress without physical injury
- Up to 10 years if the victim suffers serious bodily injury or a dangerous weapon is used
- Up to 20 years if the victim suffers permanent disfigurement or life-threatening injury
- Life imprisonment if the victim dies as a result
- A one-year mandatory minimum if the stalking violates an existing restraining or no-contact order6Office of the Law Revision Counsel. 18 USC 2261 – Interstate Domestic Violence
Victims can also seek restraining or protective orders that legally bar further contact. Courts regularly grant these based on a documented pattern of unwanted online communication and messages that would make a reasonable person fear for their safety.
Sextortion
Some of the most harmful catfishing schemes involve sextortion, where the fake persona is used to obtain intimate images and then threaten to distribute them unless the victim pays. Transmitting threats with intent to extort is a serious federal crime. Threatening injury to a person unless they pay carries up to 20 years in prison, while threatening to damage reputation or expose embarrassing information carries up to two years.7Office of the Law Revision Counsel. 18 USC 875 – Interstate Communications
The FBI reported nearly 55,000 sextortion-related complaints in 2024, a 59 percent increase over the year before, with $33.5 million in financial losses. AI-generated deepfakes, where a victim’s face is inserted into fabricated explicit material, appear in a growing share of these cases. Payments are increasingly demanded in cryptocurrency or prepaid cards.8Financial Crimes Enforcement Network. FinCEN Issues Notice on Financially Motivated Sextortion
The TAKE IT DOWN Act, signed into federal law in May 2025, criminalizes publishing intimate images of minors, including AI-generated deepfakes, and requires U.S.-based online platforms to remove such content within 48 hours of receiving a valid takedown request from a victim or their representative.
Suing a Catfisher in Civil Court
Even when no criminal charges are filed, a victim can sue a catfisher directly. Civil cases use a lower standard of proof than criminal prosecutions: you need to show it’s more likely than not that the catfisher caused you harm. Filing fees generally run from $25 to $400 depending on the court and the amount claimed.
Invasion of Privacy
If the catfisher used your photos, personal details, or likeness without permission, you may have an invasion of privacy claim. The strongest version, appropriation of likeness, covers someone taking control of your image for their own benefit. You’ll need to show the use was highly offensive and violated your reasonable expectation of privacy. Many states limit this claim to commercial use, which can make it harder to apply when the catfisher’s motive is personal.
Defamation
When a catfisher spreads false information about you while operating under a fake identity, that can support a defamation claim. The statements must be false, communicated to at least one other person, and actually damaging to your reputation. If the catfisher knew the statements were false or acted with reckless disregard for the truth, punitive damages may be available on top of compensation for actual harm.
Intentional Infliction of Emotional Distress
Victims sometimes suffer severe anxiety, depression, or lasting difficulty trusting others. A claim for intentional infliction of emotional distress requires showing that the catfisher’s conduct was extreme and outrageous and that it caused serious psychological harm. Courts set a high bar. Damages can include therapy costs, lost wages, and compensation for the distress itself.
How to Report a Catfisher
Two federal agencies handle catfishing reports, and where you file depends on what happened.
FBI Internet Crime Complaint Center
The IC3 is the main federal intake point for internet fraud, including romance scams and sextortion. A complaint requires your contact information, details of any financial loss with account numbers and transaction dates, whatever identifying information you have about the perpetrator, and a written description of what happened. Email headers and other digital evidence can be pasted directly into the form. The IC3 does not accept attachments, so keep the originals stored securely.9Internet Crime Complaint Center (IC3). Frequently Asked Questions After you submit, print or save the confirmation page immediately; the IC3 will not email you a copy. If you’re in immediate danger, call 911 or your local police, because the IC3 referral process takes time.
IdentityTheft.gov
If a catfisher used your personal information to open accounts or commit fraud in your name, the FTC’s IdentityTheft.gov is the federal resource for recovery. You can file online or call 1-877-438-4338. The site generates an official Identity Theft Report you can give to businesses and creditors and builds a personalized recovery plan with step-by-step instructions.10Federal Trade Commission. Identity Theft Recovery Steps Print your report before you leave the page if you don’t create an account, since you’ll lose access once you exit.