Phishing – a social engineering scheme carried out through emails – has existed for decades. Many phishing emails in the past sound like obvious grifts, such as emails claiming to be from a Nigerian prince or banks who are asking for way too much information from recipients.
But while many have wizened up and know what to look out for, phishing remains very relevant to this day, and many people still fall for the schemes.
According to a report, 2022 was a record year for phishing, with the number of attacks recorded for the period hitting more than 4.7 million. Phishing attacks have also intensified over the recent years, with the same report saying that the number of incidents increased by over 150% per year since 2019.
You might think that sending a phishing email to a co-worker or some other person would be a great way to enact some petty revenge. However, you could be charged with a crime under federal law and face severe penalties.
Federal law on phishing
There’s no specific federal statute for phishing, but anyone caught sending or attempting to send a phishing email can face federal charges for similar offenses.
Phishing can count as wire fraud under federal law. Wire fraud is a catch-all term for any scheme that utilizes electronic communications (in this case, email) to perpetrate fraud. If an individual is convicted of wire fraud, they face up to 20 years imprisonment and a maximum $250,000 fine. These penalties can also apply per count. For instance, if you send three phishing emails, you could face up to thrice the number of prison years and fines on conviction.
Officials can also charge you with identity theft for attempting phishing. A conviction for this charge leads to up to 15 years in prison.
You can also face charges for aggravated identity theft for your phishing attempt. Aggravated identity theft occurs when a person knowingly transfers or uses the stolen identification details of another. You can face an additional two years of prison if you’re convicted of aggravated identity theft.
Phishing never pays
The federal government takes cybercrimes like phishing very seriously. Even a joke email asking for sensitive credentials and bank information can be evidence against the sender. Anyone facing federal charges for a phishing attempt should remember that they face decades in prison and heavy fines if they can’t defend themselves in court.
By Foley & Wilson | Posted on September 7, 2023
FAQs
Phishing can count as wire fraud under federal law. Wire fraud is a catch-all term for any scheme that utilizes electronic communications (in this case, email) to perpetrate fraud.
Is it illegal to send phishing emails? ›
Like other forms of identity theft, phishing does not rely upon a successful attempt. In other words, you can be convicted of phishing if you send out an e-mail simply in an attempt to persuade others to provide you with the desired information.
What is the federal law for phishing? ›
Imposes a fine or imprisonment for up to five years, or both, for a person who knowingly and with the intent to engage in activity constituting fraud or identity theft under Federal or State law sends an electronic mail message that: (1) falsely represents itself as being sent by a legitimate online business; (2) ...
Where do I report phishing emails? ›
Forward phishing emails to reportphishing@apwg.org (an address used by the Anti-Phishing Working Group, which includes ISPs, security vendors, financial institutions, and law enforcement agencies).
Is this a phishing email or is it legitimate? ›
If you get an email or a text message that asks you to click on a link or open an attachment, answer this question: Do I have an account with the company or know the person who contacted me? If the answer is “No,” it could be a phishing scam.
Does reporting phishing emails block the sender? ›
Report a message as phishing in Outlook.com
the sender is reported but is not blocked from sending you additional messages.
Can phishing email be traced? ›
Which begs the question: can a fake email be traced by the police? Yes, especially if the sender uses a regular email service. IP addresses, browser information, and other metadata can still be obtained from the email provider, which can help law enforcement identify the person behind the email.
Who investigates phishing emails? ›
Report all suspicious contacts to the Federal Trade Commission (FTC), or by calling (877) IDTHEFT. Contact your local law enforcement or Federal Bureau of Investigation (FBI) Office. Report internet phishing to the Anti-Phishing Working Group.
Is it worth reporting phishing emails? ›
By reporting phishing attempts, you can: reduce the amount of scam communications you receive. make yourself a harder target for scammers. protect others from cyber crime online.
Which email is most likely phishing? ›
Requests for personal information: Legitimate companies won't ask for sensitive information like passwords or Social Security numbers through email. If an email tells you to verify your account by clicking a link and entering your login details, it's likely a phishing attempt.
Display name spoofing is when a hacker creates an email account using a first and last name (display name) that will appear familiar to the recipient. Email attacks like CEO Fraud, Spear-Phishing and Whaling utilize this tactic and it is especially effective when email is viewed on mobile devices.
What are 3 signs that a suspicious email may be a phishing email? ›
Be aware of the common signs of phishing scams:
- Suspicious sender address. Check the sender's address carefully and make sure it's really coming from who it says it's coming from.
- Spoofed web links. ...
- Spelling, grammar, and layout. ...
- Suspicious attachments. ...
- Threats or a false sense of urgency. ...
- Generic salutation.
Yes, you can get hacked by replying to an email, especially a phishing email. In most cases, it's not the response that causes the breach but the subsequent actions that follow. When you respond, you confirm that your email account is active, making you a target for further attacks.
Is it illegal to send emails without permission? ›
Most country's email marketing laws stipulate that people need to give you permission to email them in order for you to send them campaigns. The definition of permission varies between each country's laws, but there are generally two types of permission: implied permission and express permission.
Is it illegal to spam someone's email? ›
The CAN-SPAM Act, a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have you stop emailing them, and spells out tough penalties for violations. The FTC enforces the CAN-SPAM Act and the accompanying CAN-SPAM Rule.
Is email spoofing a crime? ›
Is Email and Website Spoofing Illegal? Yes, spoofing can be illegal even when it doesn't connect to a phishing scheme. Legitimate businesses can't spoof other people or companies. Doing so would generally violate deceptive marketing laws.
What to do if you get caught by phishing emails? ›
You should change the passwords on any of your accounts which use the same password. Tell your bank and report it as a crime to Action Fraud (for England, Wales and Northern Ireland) or Police Scotland (for Scotland).
