What Is the Penalty for Withdrawing Money from Someone Else’s Account Using Their Online Password?

Legal Review of Unauthorized Electronic Access to Bank Accounts in Iran

Introduction

With the expansion of online banking and mobile apps in Iran, incidents involving unauthorized access to others’ bank accounts using internet banking passwords or OTPs have increased significantly. This act is considered financial cybercrime under Iranian law and can lead to imprisonment, fines, and restitution of the stolen funds.

In this article, we explain:

When unauthorized online withdrawal becomes a crime

Applicable laws and punishments

Whether the victim’s later consent removes liability

How to file a complaint and recover the money

What Is Unauthorized Online Withdrawal?

Any access to another person’s bank account via their internet password, OTP, dynamic password, or banking app without their permission is considered unauthorized withdrawal.

This remains a crime even if the offender is a close friend, spouse, or family member — without explicit consent, it is still illegal.

Relevant Legal Provisions

Article 13 of Iran’s Computer Crimes Law:

“Anyone who, without authorization, withdraws money or financial benefits through electronic or telecommunication systems for themselves or others shall be sentenced to 1 to 5 years of imprisonment, or a fine equal to the withdrawn amount, or both.”

In addition to punishment, the offender must return the stolen funds (restitution).

What If a Spouse or Family Member Made the Withdrawal?

Iranian law makes no exception — even close relatives can be prosecuted if the account owner did not give clear and specific consent.

Having access to the card, phone, or password does not equal legal permission.

Additional Penalties in Severe Cases

In more serious cases (large amounts or repeated offense), the court may also order: