Table of Contents
A defendant in a wire fraud case out of the Eastern District of Virginia once watched his sentencing range jump by more than six years over a single figure: $1.5 million in intended loss. He had actually collected around $190,000. That gap — between what you took and what prosecutors say you tried to take — sits at the center of how internet crime penalties get calculated, and it catches nearly everyone off guard.
Most serious internet crime cases in the United States land in federal court, and federal sentencings are driven by a formula rather than a gut feeling. Understanding that formula is the difference between picturing a worst-case statutory headline and understanding the number a judge is actually likely to start from.
What Actually Gets Charged
A single online scheme rarely produces a single charge. Prosecutors commonly stack counts under several statutes at once: computer intrusion under 18 U.S.C. § 1030, wire fraud under § 1343, access device fraud under § 1029, aggravated identity theft under § 1028A, and money laundering under § 1956 if proceeds were moved through accounts or crypto.
What each of those statutes covers — and where the edges of the law get genuinely blurry — is worth reading in detail, because a lot of cases turn on whether a defendant “exceeded authorized access” rather than on whether they did something obviously wrong. Our breakdown of what cybercrime laws actually cover and where they break down walks through those definitional fights.
The stacking matters because sentences can run consecutively. Two five-year counts don’t merge into one five-year sentence unless the judge orders them to run concurrently.
The Guideline Math Behind Most Federal Sentences
Federal judges start with the U.S. Sentencing Guidelines, which assign an offense level built from a base number plus adjustments. For most internet fraud and computer crime cases, the operating guideline is § 2B1.1, and the base offense level is 7.
The loss table does most of the work
Loss is the single biggest driver. The table in § 2B1.1(b)(1) adds levels in brackets that start small and escalate fast. More than $6,500 in loss adds 2 levels. More than $95,000 adds 8. More than $550,000 adds 14. More than $1.5 million adds 16, and the top bracket — above $550 million — adds 30.
Two things about loss trip people up. First, “intended loss” counts, not just actual loss, so a scheme that was designed to extract millions but collapsed early can still be sentenced as if it had worked. Second, loss is aggregated across all victims and all relevant conduct, including conduct that was never charged.
Enhancements that stack
- Sophisticated means (+2): layered accounts, VPN chains, or offshore infrastructure are typical triggers.
- Use of a means of identification (+2): applies when stolen credentials, account numbers, or SSNs were used to pull off the scheme.
- Number of victims (+2 to +6): 10 or more victims adds 2, 50 or more adds 4, 250 or more adds 6.
- Organizer or leader (+2 to +4): higher end if five or more participants were involved.
- Obstruction (+2): wiping devices, coaching witnesses, or violating a court order during the investigation.
- Acceptance of responsibility (−2 or −3): the one reliable reduction, and it requires a timely guilty plea.
Run a realistic example. Base 7, plus 14 for loss between $550,000 and $1.5 million, plus 2 for sophisticated means, plus 2 for use of a means of identification, plus 2 for 10 or more victims, minus 3 for acceptance of responsibility. That lands at offense level 24, which corresponds to 51–63 months in the sentencing table. Nothing in that sequence is exotic — it’s an ordinary fraud case with ordinary facts.
Scale is what makes these cases brutal, and scale is cheap now. Automated credential stuffing lets one person touch hundreds of thousands of accounts in a weekend, which is why the more interesting angle is often how normal technology behaves once it’s applied at scale — the tooling is mundane, the victim count is not.
Statutory Maximums Are Not the Real Number
Headlines love the maximums: 20 years for wire fraud, 30 if the scheme exploited a declared disaster or emergency. Computer damage under § 1030(a)(5)(A) carries 10 years for a first offense and 20 for a second; intrusion aimed at critical infrastructure can reach 20 years, and life if someone dies. Access device fraud under § 1029 tops out at 10 years, or 15 if 15 or more counterfeit or unauthorized devices were involved.
Those ceilings almost never become the sentence. Judges sentence within the guideline range most of the time, and the guideline range for a mid-level internet fraud case is usually measured in months or low single-digit years, not decades. A defendant facing a 20-year maximum and a 41–51 month guideline range should be focused on the range.
Mandatory Minimums: The Two-Year Stack
The one genuinely unavoidable number in many cases is 18 U.S.C. § 1028A, aggravated identity theft. It carries a mandatory two-year sentence that must run consecutively to whatever sentence is imposed on the underlying offense. Courts have been clear that judges cannot go below it and cannot run it concurrently.
It applies when a defendant knowingly used another person’s means of identification during and in relation to a predicate offense. Holding a stolen card isn’t enough on its own; using it is. The statutory language and the case law interpreting it decide a lot of cases, which is why the specifics of identity theft statutes and their mandatory sentences matter so much during plea negotiations.
Restitution, Forfeiture, and Supervised Release
Prison is only part of the penalty. Restitution is mandatory for most property offenses under the Mandatory Victims Restitution Act, and it is generally ordered for the full loss amount — often far more than the defendant personally pocketed, and joint and several with co-defendants. Criminal forfeiture under § 982 can take proceeds and property traceable to them, including vehicles and real estate bought with proceeds.
Supervised release typically runs up to three years after prison for these offenses, and courts routinely impose computer and internet restrictions as a condition, along with substance testing, financial disclosure, and a prohibition on possessing other people’s identifying information.
State Prosecutions and Where They Differ
State penalties vary widely and are usually less structured than the federal guidelines. A state computer crime conviction might carry a one-to-five year range for a mid-level felony, with restitution set at a hearing rather than through a loss table. Identity theft statutes in many states have their own tiering based on the value of goods obtained or the number of victims.
State cases are also more likely to resolve through diversion or a reduced misdemeanor for first offenses involving small dollar amounts. The trade-off: state convictions often carry fewer post-release restrictions but can be harder to expunge.
What Judges Weigh Beyond the Guidelines
The guidelines are advisory, and the factors in 18 U.S.C. § 3553(a) give a judge room to move. In practice, the arguments that land are narrow and factual:
- Whether the conduct was a one-time lapse or a business operation with ledgers and repeat customers.
- Whether vulnerable victims were targeted — elderly account holders, small clinics, school districts.
- Whether the defendant has genuine ties to employment, family, and community, documented rather than asserted.
- Whether a cooperating defendant provided substantial assistance, which can trigger a § 5K1.1 motion from the government.
General pleas for mercy accomplish very little. Judges sentence on facts and on the record built before the hearing.
Where Sentences Get Contested
Most of the real fighting happens over loss, not over guilt. Defense counsel will argue for actual rather than intended loss, for excluding victims who suffered no measurable harm, and for excluding data that was recovered. A successful challenge that drops the loss bracket from $1.5 million to under $550,000 removes two offense levels and roughly 12 to 15 months from the range.
Vehicle and device forfeiture is another pressure point, as is the question of whether a co-defendant’s conduct should count as relevant conduct. For anyone trying to estimate exposure before charges are filed, the useful exercise is to build the number from the bottom: what was taken, how many people were touched, what tools were used, and whether a means of identification was involved. That bottom-up figure is much closer to the sentence a court will actually impose than anything printed on the indictment’s first page.
