Module 3 · Lesson 1

Cybercrime Statutes & Identity Theft Defense

Federal cybercrime legislation provides the statutory teeth for prosecuting attackers and sets baseline legal duties for financial institutions handling customer credentials.

Apex Bank Scenario 3.1

The Credential Stuffing Wave

A syndicated criminal group acquires 10 million leaked username/password combos from third-party fitness app breaches. Using distributed botnets, they automate credential stuffing against Apex Bank’s mobile API, taking over 3,400 accounts and initiating fraudulent ACH transfers.

1. Major US Computer Crime Statutes

Computer Fraud and Abuse Act (CFAA - 18 U.S.C. § 1030): The foundational federal statute criminalizing intentional unauthorized access or exceeding authorized access to "protected computers" (which includes all financial institution systems).
National Information Infrastructure Protection Act (NIIPA - 1996): Amended CFAA to extend protection across all computers connected to interstate or foreign commerce.
Computer Security Act of 1987: Required federal agencies to establish baseline security plans and mandated NIST standards for sensitive systems.
USA PATRIOT Act (2001): Expanded surveillance capabilities (wiretaps, pen registers) for investigating cyber-terrorism and raised penalties for attacks targeting critical banking infrastructure.

2. Identity Theft (18 U.S.C. § 1028) & Data Aggregation

Identity theft occurs when an attacker knowingly transfers or uses a means of identification of another person with intent to commit unlawful activity.

Phase 1: Exfiltration & Aggregation

Non-sensitive pieces of PII (names, dates of birth, addresses from public voter registries) are aggregated with hashed passwords leaked from third-party services.

Phase 2: Dark Web Monetization

Syndicates package validated banking logins into "Fullz" (complete personal profiles) sold for cryptocurrency on illicit marketplaces.

Phase 3: Fraud Execution against Apex Bank

Fraud rings bypass SMS 2FA via SIM swaps, change billing addresses, and drain funds via automated wire gateways.

Phase 4: Forensics & Law Enforcement Handoff

Apex Bank Incident Response preserves volatile memory, generates chain-of-custody artifacts, and files a formal Suspicious Activity Report (SAR) with FinCEN and the FBI Cyber Division.

3. Knowledge Check

Checkpoint Quiz: Statutory Jurisdiction

An ex-contractor for Apex Bank uses their old SSH keys (which the bank forgot to revoke) to log into a production payments cluster and download proprietary clearing software. Which statute was directly violated?