Inspired by this question: https://security.stackexchange.com/q/210045/43940

Someone, person A, created an account using the email of someone else, person B. Person B noticed, logged in and reset the password, essentially taking ownership of the account. There are several comments saying that this violates some laws.

BTW, what you did was knowingly locking someone out of their account and accessing their info, which may get you heavy fines or jail time. The probability of that is of course small, but remember that lady who shared a handful of songs on e-mule, then was asked to pay $10'000 per song: I bet she didn't expect it either.

The intention of person A is unknown but its speculated that they were taking advantage of free trials. I dont know if the intention matters. However, I would think this would almost be similar to domain squatting or taking a user name on a social media site in order to extort money from another user that would want to use that identity.

Is there any law related to the prevention of someone using an online identity in this way?

  • 1
    Isn't there a legal issue regarding Person A creating an account for which he has not authority to create?
    – fred_dot_u
    May 13, 2019 at 15:31
  • @fred_dot_u I guess that's the thing. Also, the service in question doesn't verify ownership of the email before creating the service account. This almost comes off as a really soft DOS vector since the email owner can now use another email to create their account, but they would not be able to use their main email.
    – zero298
    May 13, 2019 at 17:26

2 Answers 2


It has nothing to do with the email being sent to you, but you can't steal someone's account in general whether the email came to you or anyone.

Taking something someone paid for is theft.

  • In the original scenario "A" had not paid for the account. May 13, 2019 at 13:41
  • Yeah, but you input your credit card for the free trial. It would start being billed after a month.
    – Putvi
    May 13, 2019 at 13:43
  • Oh you are saying he only took the email account? I took it to mean he was taking over the Netflix account based on the question in security.
    – Putvi
    May 13, 2019 at 15:30

The relevant law, in the US, is (starts at) 18 USC 2701. It is a crime if one "intentionally accesses without authorization a facility through which an electronic communication service is provided". This law applies to any unauthorized access, be it to an email account or an online forum. Although the initial act was a crime, that does not excuse a subsequent violation – duo iniuria ius non efficiunt. This answer on a somewhat related question reminds us that one is not allowed to commit another crime to get retribution for a law-breaker. You can however file a complaint with the authorities.

The punishment for the email account owner would probably be more severe than it for the initial criminal: 5 years vs. 1 year. The distinction resides in the purpose of the crime. On the assumption (not guaranteed from the hypothetical) that the use of email was simply to avoid being traced, there is no commercial advantage to avoiding being detected, no malicious destruction, creating an account is not a crime of tortious action, so the trigger condition for the higher sentence is not met.

if the offense is committed for purposes of commercial advantage, malicious destruction or damage, or private commercial gain, or in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or any State

Locking a person out of their email account is malicious and creates damage (loss of access to the account).

  • I think you misread the question. The account logged into was Netflix, not the email account.
    – Putvi
    May 13, 2019 at 15:55
  • Netflix is not storing messages is what I meant.
    – Putvi
    May 13, 2019 at 18:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .