What Happens If You Hack Someone’s Account in Singapore?

“Hacking” is a term commonly used to describe gaining access to another person’s online account or computer system without permission. In Singapore law, however, the relevant legal concept is unauthorised access to computer material, which is principally governed by the Computer Misuse Act 1993 (“CMA”).

Whether the account belongs to an individual, a business or a government agency, unauthorised access may constitute a criminal offence. Depending on the circumstances, an offender may also face additional charges where the access is carried out to facilitate fraud, identity theft or other criminal conduct.

This article explains when “hacking” becomes a criminal offence in Singapore and the penalties that may apply.

What Is Considered “Hacking” in Singapore?

The Computer Misuse Act does not define the term “hacking”. Instead, it criminalises various forms of unauthorised access to computers, computer systems and computer data.

Examples include:

• Logging into another person’s email account without authority.
• Accessing someone else’s social media account using their password without authorisation.
• Guessing or bypassing login credentials to gain access.
• Accessing a company’s internal network without authorisation.
• Installing malware or other software to obtain unauthorised access to a computer or online account.

The critical legal question is whether the person had authority to access the computer material, rather than whether they knew the password or whether the account owner later discovered the access.

Is It Illegal to Access Someone Else’s Account Without Permission?

Yes.

Section 3 of the Computer Misuse Act makes it an offence for a person to knowingly cause a computer to perform any function for the purpose of securing access without authority to any program or data held in any computer.

In other words, simply accessing another person’s account without authority may itself constitute an offence. The prosecution does not necessarily have to prove that the accused:

• stole any money;
• downloaded confidential files;
• changed any passwords; or
• deleted any information.

The unauthorised access itself may be sufficient if the statutory elements of the offence are established.

What If Someone Gave You Their Password?

Possessing another person’s password does not automatically mean that you have legal authority to access their account.

For example:

• permission may have been given only for a specific purpose;
• the authority may have been withdrawn;
• the password may have been shared for convenience rather than unrestricted access; or
• an employee may lose authority to access company systems after leaving employment.

Ultimately, the issue is whether the accused was authorised to access the computer material at the relevant time. This is often a fact-sensitive issue that depends on the surrounding circumstances.

Past Cases: Having Access Does Not Mean You Have Authority

A useful illustration is the High Court’s decision in Kong Wei Keong Marcus v Public Prosecutor [2023] SGHC 20.

The accused argued that he had authority to access the victim’s banking facilities because she had entrusted him with her mobile phone, ATM cards and credit cards, and he had previously helped her manage certain financial matters.

The High Court rejected this argument. Although the accused had physical access to the victim’s devices and banking credentials, the Court found that he did not have authority to make the unauthorised withdrawals and online transfers. The evidence showed that the transactions were carried out without the victim’s knowledge or consent.

The case illustrates that possession of another person’s password, device or banking credentials does not automatically confer legal authority to access or use their accounts. Whether access is authorised depends on the scope of the authority that was actually given and the facts of the particular case.

What If You Only Logged In but Did Not Change Anything?

Many people mistakenly believe that they have not committed an offence if they merely “looked around” without causing damage.

However, that is not necessarily correct.

The offence under section 3 focuses on the act of obtaining unauthorised access. It is not a requirement that the prosecution prove financial loss, theft of information or modification of data before liability can arise under that provision.

Nevertheless, whether an offence has been committed always depends on whether the prosecution can prove every element of the charge beyond a reasonable doubt.

What Are the Penalties for Unauthorised Access?

The penalties depend on the offence charged.

For a first conviction under section 3 (Unauthorised Access to Computer Material), a person is liable to:

• a fine of up to S$5,000;
• imprisonment for up to 2 years; or
• both.

For a second or subsequent conviction, higher penalties apply.

If damage is caused as a result of the offence, the maximum penalty increases to:

• a fine of up to S$50,000;
• imprisonment for up to 7 years; or
• both.

What If the Hacking Was Intended to Commit Another Crime?

Unauthorised access is often only one part of a larger criminal scheme.

Where a person accesses a computer with the intention of committing or facilitating another offence involving property, fraud, dishonesty or bodily harm, section 4 of the Computer Misuse Act may apply.

An offender convicted under section 4 may face:

• a fine of up to S$50,000;
• imprisonment for up to 10 years; or
• both.

For example, section 4 may be relevant where a person gains access to another person’s online banking account to transfer funds, or accesses confidential information in order to facilitate cheating or identity fraud.

Can More Serious Charges Be Brought?

Yes.

Depending on the facts, a person may also be investigated or charged for offences involving:

• unauthorised modification of computer material;
• unauthorised interception of computer services;
• unauthorised obstruction of the use of a computer;
• unauthorised disclosure of passwords or access codes; and
• obtaining or supplying personal information that was unlawfully obtained.

Where the offence involves a protected computer—such as certain systems relating to banking, national security, essential services or government functions—the penalties may be significantly higher. In some cases, offenders may face fines of up to S$100,000, imprisonment of up to 20 years, or both.

Does the Computer Have to Be in Singapore?

Not always.

The Computer Misuse Act has extraterritorial effect in certain circumstances. Depending on the statutory requirements, a person may be prosecuted even if part of the offending conduct occurred outside Singapore, such as where the relevant computer or data was located in Singapore or where the offence caused, or created a significant risk of causing, serious harm in Singapore.

What Should You Do If You Are Under Investigation?

If the Singapore Police Force has contacted you regarding an alleged offence under the Computer Misuse Act, it is generally advisable to seek legal advice as early as possible.

Cases involving alleged unauthorised access frequently involve disputed issues such as:

• whether the accused had authority to access the account;
• whether consent had been given or withdrawn;
• the scope of any authorisation;
• the accused’s knowledge and intention; and
• the electronic and forensic evidence relied upon by the prosecution.

Early legal advice may help you understand the allegations, protect your legal rights and make informed decisions throughout the investigation.

Conclusion

Unauthorised access to another person’s online account is treated seriously under Singapore law. Even where no money is stolen and no data is altered, a person may still commit an offence if they knowingly access computer material without authority.

The precise offence, available defences and potential penalties depend on the specific facts of each case. Where the alleged conduct involves fraud, identity theft, protected computer systems or other aggravating circumstances, substantially more severe penalties may apply.

If you are being investigated or have been charged with an offence under the Computer Misuse Act, obtaining legal advice at an early stage can be critical in assessing the evidence, understanding the applicable law and protecting your interests.