united-states fraud
Is it illegal to use my friend&#39;s employee discount login to save some money?
<p>I'm in the market for a new Desktop, I met an online friend and he happens to be an Employee with a computer company that I want to buy from. He gets an employee's discount, he gives me his login and says go ahead and purchase on his account.</p>
<p>Obviously I want to do it, it's more than half off. Is it illegal though? Will I get in trouble?</p>

<p><strong>Is it illegal to use my friend's employee discount login to save some money?</strong></p>
<p>SHORT ANSWER: <strong>Probably</strong> but it might depend on the terms under which the employer issued the login code to the employee</p>
<p>LONG ANSWER: Based on the OP's profile, I assume that <a href="/questions/tagged/pennsylvania" class="post-tag" title="show questions tagged &#39;pennsylvania&#39;" rel="tag">pennsylvania</a> law applies. I also assume, as is common, when the employer issues a login code they require an employee to acknowledge certain terms and conditions that include (a) prohibiting its use by anyone else, and (b) stipulating the code remains the property of the employer / issuer at all times.</p>
<p>If my assumptions are correct, it is likely that both the OP <strong>and</strong> the friend/employee may fall foul of <a href="https://www.legis.state.pa.us/cfdocs/legis/LI/consCheck.cfm?txtType=HTM&amp;ttl=18&amp;div=0&amp;chpt=41&amp;mobile_choice=suppress" rel="nofollow noreferrer">Title18, Chapter 41, § 4106</a>: Access Device Fraud:</p>
<blockquote>
<p>(a) A person commits an offense if he:</p>
<p>(1)  uses an access device to obtain or in an attempt to obtain property ... with knowledge that:</p>
<p>...</p>
<ul>
<li>(iv) ... his use of the access device is unauthorized by the issuer ... or</li>
</ul>
<p>(2)  ... gives, or otherwise transfers to another, or offers or advertises, ... an access device knowing that the access device ... for any reason is unauthorized by the issuer ... or</p>
<p>(3)  possesses an access device knowing that it ... belongs to another person who has not authorized its possession.</p>
<p><strong>(d) Definitions</strong></p>
<p>...</p>
<p>&quot;Access device.&quot;  Any ... code, account number, personal identification number or other means of account access ... to obtain ... goods  ...</p>
</blockquote>

<p>The case of <a href="https://cdn.ca9.uscourts.gov/datastore/opinions/2016/07/05/14-10037.pdf" rel="nofollow noreferrer">US v. Nosal</a> suggests that you could get in serious legal trouble. In additional to state statutes prohibiting &quot;unauthorized access&quot;, there is a federal law making such an action a crime. The broad question is whether people who share passwords (e.g. Netflix, HBO, Amazon) are subject to prosecution. Us v. Nosal suggests that this is possible, though that case is distinct from what you describe, so it's not guaranteed.</p>
<p>The essence of this case (in the 9th circuit) is that the defendant had a password <em>which was revoked</em>: as the court ruled,</p>
<blockquote>
<p>[A] person uses a computer ‘without authorization’ under [the CFAA]...
when the employer has rescinded permission to access the computer
and the defendant uses the computer anyway.</p>
</blockquote>
<p>(quoted from an earlier ruling in LVRC Holdings LLC v. Brekka). As the court says, password-sharing was not on trial, what was on trial was accessing a computer &quot;when the front door had been firmly closed&quot;. A person with a password cannot override the shutting of the door, but the door has not been firmly shut in the typical password-sharing case.</p>
<p>The courts have yet to hold that password sharing <em>sans</em> revocation of authorization constitutes access without authorization. In <a href="https://casetext.com/case/united-states-v-valle-29" rel="nofollow noreferrer">US v. Valle</a>, 807 F.3d 508 the court finds  in a different fashion that because the</p>
<blockquote>
<p>text, statutory history, and purpose of the CFAA permit both
interpretations, we are required to apply the rule of lenity and adopt
the latter construction</p>
</blockquote>
<p>where the interpretations are &quot;with an improper purpose, accessing a computer otherwise authorized to access&quot; <em>or</em> &quot;accesses information without authorization for any purpose but located on a computer that he is authorized to access&quot;. <a href="https://casetext.com/case/wec-carolina-energy-solutions-llc-v-miller" rel="nofollow noreferrer">WEC Carolina Energy Sols. LLC v. Miller</a> also does not follow the Nosal court's line of thinking, and has a narrower definition of &quot;unauthorized access&quot;. So the question of criminal liability for the conduct you describe under this statute is not yet settled law w.r.t. the federal statute.</p>

<p>It is probably illegal to use your friends account in any way.  He has been given access to that part of the network, you haven’t, and your friend doesn’t have the authority to give you such access.</p>
<p>The Computer Fraud and Abuse Act (CFAA) was enacted in 1986, and it makes “having knowingly accessed a computer without authorization or exceeding authorized access” a federal crime.</p>
<p>Assuming you trust your friend with it, you could give out your credit card number and ask your friend to buy you whatever you want, applying the employee discount to the purchase.  This is possibly against the employers policy, but is unlikely to land you in jail, although it may get your friend fired.</p>

<p>Logging into someone's company account by guessing their username / password, or by hacking, or by spying on them to find the username / password would be illegal because it is unauthorised access to the company's computer.</p>
<p>While your &quot;friend&quot; is (most likely) authorised to use the computer, he probably doesn't have the legal permission to authorise you. So you are still not authorised and computer hacking laws still apply.</p>
<p>Should you be authorised to log in (for example someone in HR whose job it is to authorize new employees might be able to legally authorise you), then you still are most likely not authorised to buy a computer with an employee discount.</p>
