5 Online Mistakes That Can Lead to Cybercrime or Identity Theft Allegations

By Robert Southwell, Criminal Defense Attorney, Southwell Law, LLC | Salem, Oregon | November 2026

Most people never imagine they could be accused of a cybercrime. Yet everyday online habits, such as sharing a password, logging into an old account, or using a family member’s card, can look very different to an investigator. Cybercrime investigations often start quietly, with a subpoena to an internet provider or a social media platform. The first sign many people see is a knock at the door and a request for their phone or laptop. Understanding which habits create risk can help you avoid an allegation in the first place.

The Short Answer

In Oregon, the line between a careless habit and a crime usually comes down to two questions: did you have permission, and what did you intend? Unauthorized computer access is a misdemeanor under ORS 164.377, identity theft is a felony under ORS 165.800, and threatening electronic messages can be charged as harassment under ORS 166.065. Clear permission, separate accounts, and restraint online prevent most of the problems below.

1. Logging Into Accounts After Your Permission Has Ended

An old work login that still works, an ex-partner’s email, or a shared streaming or banking account can all become a problem. Unauthorized computer access is one of the most common cyber crime allegations, and what felt like harmless access can be framed as hacking.

Under ORS 164.377(4), knowingly accessing or using a computer, network, or its data “without authorization” is a Class A misdemeanor, punishable by up to 364 days in jail and a fine of up to $6,250 (ORS 161.615 and 161.635). If the access is part of a scheme to defraud, or to take money, property, or data, the charge can rise to a Class C felony under ORS 164.377(2).

The wording of the statute matters. In State v. Nascimento, 360 Or 28 (2016), the Oregon Supreme Court held that a store clerk who was allowed to use a lottery terminal did not use it “without authorization” just because she used it for a purpose her employer prohibited. The U.S. Supreme Court narrowed the federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030, similarly in Van Buren v. United States (2021). Neither case helps much when permission has been revoked altogether. A former employee whose access was cut off on paper but whose password still works, or someone signing into an ex’s email, is in a much weaker position.

The safest rule is simple: if your permission has ended, stop using the account. If you need something from it, such as old files or pay records, ask for it in writing.

2. Using a Family Member’s Card, Number, or Login “Informally”

Using a relative’s card, Social Security number, or account details, even with what you believed was permission, can lead to an identity theft allegation. Oregon’s definition is broader than many people expect. Under ORS 165.800, a person commits identity theft if, with the intent to deceive or defraud, they obtain, possess, transfer, create, utter, or convert to their own use another person’s personal identification.

“Personal identification” covers far more than card numbers. The statute lists a name, date of birth, signature, photograph, PIN, and an email name, address, or account, among others. The law does not require that anyone actually lost money. Identity theft is a Class C felony, carrying up to five years in prison and a fine of up to $125,000 (ORS 161.605 and 161.625). Aggravated identity theft under ORS 165.803 is a Class B felony.

Intent is often where these cases are fought. A parent who opens a utility account in an adult child’s name, or a sibling who keeps using a shared card after a falling-out, may honestly believe they had permission. The trouble is that “we agreed verbally” is hard to prove once a relationship sours and the other person files a report. The statute’s definition of “another person” also includes someone who has died. Family members handling a deceased parent’s finances should work through the probate process or the named personal representative rather than simply logging in to the parent’s accounts.

Get permission clearly, ideally in a text or email you can point to later. Keep financial accounts in the right names, and add authorized users through the bank instead of passing a card around.

3. Sharing Passwords, Devices, and Wi-Fi

When several people use the same device, login, or home network, their activity can be traced back to you. Investigators analyze IP addresses, metadata, and communications, but an IP address identifies a connection or an account, not the person sitting at the keyboard. That gap can help a defense, but it also means you may be the first person investigators call.

Shared devices carry one more risk that few people know about. Oregon’s harassment statute makes it a crime to knowingly allow a phone or other electronic device under your control to be used to harass someone (ORS 166.065(2)(a)). If you know a roommate or partner is using your phone or account to send threats, letting it continue can put you in the case too.

Use separate profiles and logins where you can, change passwords when someone moves out, and secure your home Wi-Fi with a password that only household members know.

4. Letting a Heated Online Exchange Escalate

Online harassment and cyberstalking are both criminal allegations. A string of angry messages, repeated contact after someone has asked you to stop, or posts aimed at a specific person can be presented as harassment.

Under ORS 166.065(1)(c), sending an electronic threat to seriously injure someone, or to commit a felony against them, their family, or their property, can be charged as harassment when the threat would reasonably cause alarm. The statute defines “electronic threat” to include email, the internet, and text messages. The base offense is a Class B misdemeanor, but it rises to a Class A misdemeanor in certain situations, including when the recipient is protected by a restraining order or stalking order. Repeated, unwanted contact that alarms or coerces someone can also support a stalking charge under ORS 163.732, and the definition of “contact” in ORS 163.730 includes sending electronic communications in any form.

Deleting posts afterward rarely solves the problem. The other person may already have screenshots, and destroying records once a case is underway can raise separate questions under Oregon’s tampering-with-evidence statute, ORS 162.295. Prosecutors increasingly rely on this kind of material, as this look at how social media can be used against you in a criminal case explains. When a conversation turns hostile, step away, mute or block, and resist sending “one last message.”

5. Talking to Investigators Before Talking to a Lawyer

The most damaging mistake often comes after an investigation starts. Continuing to talk to agents, consenting to device searches, or answering questions without asserting your right to a lawyer can hand the prosecution evidence it would not otherwise have.

Police generally need a warrant to search the digital contents of a phone, even after an arrest (Riley v. California, 573 U.S. 373 (2014)). Consent removes that requirement, which is why officers often ask for it. You can decline politely. Oregon’s Constitution adds its own protections against unreasonable searches and compelled self-incrimination in Article I, sections 9 and 12.

It also helps to know what Miranda warnings do and don’t cover. Under Miranda v. Arizona, warnings are required for custodial interrogation. A “quick chat” on your doorstep or a phone call from a detective usually isn’t custodial, so what you say can be used without any warnings at all.

Workplace investigations are a separate trap. Miranda does not apply to an interview with a private employer’s HR team, and what you say there can end up with police. Refusing to cooperate may carry consequences for your job, so the better move is usually to speak with a defense lawyer before the interview, rather than either stonewalling or explaining everything on the spot.

If Investigators Have Already Contacted You

Contact a defense attorney as soon as you learn that investigators are asking about your online activity. In the meantime, don’t wipe, reset, or get rid of devices. Write down who has had access to the accounts and devices in question, and save any texts or emails that show permission was given.

A careful defense review looks at where digital evidence tends to break down. That includes how IP logs, timestamps, and metadata were collected, whether the chain of custody holds up, and whether searches went beyond the scope of the warrant. Independent forensic experts can test the government’s claims about unauthorized access and intent. As this overview of why a thorough criminal defense investigation matters notes, the facts the defense develops on its own often shape both negotiations and trial.

Because ORS 165.800 requires intent to deceive or defraud, the defense in many of these cases centers on what the person actually knew and believed. Common issues in identity theft charges in Oregon include mistaken identity, a genuine belief that permission existed, weak evidence linking the person to the account or device, and searches that exceeded the warrant. Depending on the facts and the county, outcomes can range from dismissal to reduced charges or, in some cases, an alternative resolution that limits the impact on a person’s record.

A Forgery Charge Built on One Witness’s Word

Digital cases often share a weak point with traditional fraud cases: an assumption about who actually did it. In one matter handled by Southwell Law, a client was charged as a co-defendant in a check forgery case. The State’s case rested on a single witness, who had prior theft and fraud convictions. Rather than accept the charging decision at face value, the defense ran its own investigation, which pointed to a different suspect and undercut the witness’s account. The State dismissed the case before trial, as described in the firm’s case result summary.

The same principle applies to an IP address or a shared login. It shows where activity came from, not necessarily who was behind it.

Past results do not guarantee a similar outcome. Every case depends on its own facts.

Common Questions

Is it a crime to log into my ex’s account if I still know the password?

It can be. Knowing a password is not the same as having permission. Accessing an account without authorization can be charged as a Class A misdemeanor under ORS 164.377(4), and more serious charges are possible if the access is used to take money or data, or to harass someone.

Can I be charged with identity theft if no one lost money?

Yes. ORS 165.800 focuses on whether you used someone’s personal identification with the intent to deceive or defraud. Financial loss can affect sentencing and restitution, but it is not required for the charge.

Do police need a warrant to look through my phone?

Generally, yes. Riley v. California requires a warrant to search a phone’s digital contents, unless you consent or a narrow exception applies, such as a genuine emergency.

Protecting Yourself From the Start

Most of these allegations grow out of ordinary situations: a family arrangement, a shared device, a breakup, or a job change. Clear permission, separate accounts, and restraint online prevent many of them. If investigators have already reached out, the decisions made in those first conversations often shape the case, so getting legal advice before answering questions is the safest course.

Disclaimer

This article provides general information about Oregon law as of November 2026 and is not legal advice. Reading it does not create an attorney-client relationship. Laws change, and outcomes depend on the facts of each case. If you are under investigation or facing charges, consult a licensed Oregon attorney about your situation.