MVRA Scope
Section summaryThe MVRA covers Title 18 offenses against property, including offenses committed by fraud or deceit. Most CFAA convictions fall inside this scope.
MVRA-qualifying conduct under §3663A(c)(1):
- Crime of violence under §16.
- Offense against property under Title 18, including offenses committed by fraud or deceit.
- Offense relating to tampering with consumer products.
- Offense under §670 (theft of medical products).
CFAA fraud convictions under §1030(a)(4) and damage convictions under §1030(a)(5) typically qualify as offenses against property. Unauthorized-access convictions under §1030(a)(2) may qualify when the information obtained has property value. Counsel should evaluate MVRA applicability charge-by-charge.
Identifying Victims
Section summaryMVRA defines "victim" as a person directly and proximately harmed as a result of the offense. In CFAA cases the victim is usually the entity whose system was accessed, but downstream victims can also qualify.
Victim-identification framework:
- Direct and proximate harm from the offense conduct.
- Entity whose computer was accessed or damaged.
- Customers whose data was exfiltrated, when separately harmed.
- Third parties harmed by the use of stolen credentials.
The government bears the burden of identifying each victim and tracing harm to the offense. In a class-victim case — a data breach affecting thousands of consumers — counsel should test whether the government has proven individualized harm or is relying on aggregate-class theories.
Proving Loss at Sentencing
Section summaryRestitution must be proven by a preponderance of the evidence at sentencing under 18 U.S.C. §3664. The trial record is not the ceiling; the government may introduce new evidence.
Sentencing proof requirements:
- Preponderance of evidence standard.
- Probation prepares a restitution component of the presentence report.
- Victim affidavits and supporting documentation.
- Defendant may contest amount, causation, and victim identification.
- Court may resolve disputed amounts at a separate hearing.
Disputed restitution figures are commonly litigated in post-trial briefing. Defense counsel should request the government's restitution worksheets, all victim impact statements, and any vendor invoices supporting claimed loss.
Future Loss Limits
Section summaryMVRA restitution generally does not extend to speculative future loss. Recoverable amounts must be reasonably calculable and tied to the offense.
Future-loss boundaries:
- Lost future profits are generally not recoverable as MVRA restitution.
- Lost wages and benefits to date are recoverable for individual victims.
- Cost of ongoing credit monitoring tied to the offense may be recoverable when documented.
- Speculative business projections face heightened scrutiny.
The line between recoverable remediation cost and non-recoverable future loss is the most heavily litigated MVRA issue in technology-offense sentencings. Counsel should anchor the analysis to each specific cost category, not to the aggregate figure.
Restitution vs. Forfeiture
Section summaryRestitution compensates victims; forfeiture transfers the defendant's interest in property to the government. They are separate remedies and the court may order both in the same CFAA case.
Distinguishing features:
- Restitution under §3663A — paid to victims, compensatory in purpose.
- Forfeiture under §981 and §982 — paid to the government, transfers tainted property.
- CFAA-specific forfeiture authority at §1030(i) and §1030(j).
- Tainted-asset tracing analysis governs forfeiture scope.
- Restitution and forfeiture can both apply to the same dollars in some circuits.
Defense counsel must analyze each remedy independently. A successful challenge to a forfeiture allegation does not eliminate restitution exposure, and vice versa.
Payment & Collection
Section summaryRestitution orders are enforceable as civil judgments. Collection runs for up to twenty years past the later of judgment entry or release from imprisonment.
Payment-and-collection mechanics:
- Court may set a payment schedule based on defendant's financial circumstances.
- Inability to pay does not preclude entry of the order.
- Restitution survives bankruptcy and is enforceable as a civil judgment.
- Collection authority under 18 U.S.C. §3613.
- Twenty-year enforcement window post-judgment or post-release.
Long-tail restitution is a real consequence. A defendant released from custody at age 35 with a six-figure restitution order will be subject to collection through age 55 or longer, depending on the order's anchor date.
Need defense counsel?
L&L Law Group, PLLC handles Computer Crimes Defense cases throughout DFW. Initial consultations are free.
Call (972) 370-5060 →The restitution framework under the Mandatory Victims Restitution Act
Restitution in federal Computer Fraud and Abuse Act cases is governed primarily by the Mandatory Victims Restitution Act (MVRA) at 18 U.S.C. Section 3663A. The MVRA requires the court to order restitution for offenses against property, including CFAA offenses, in which there is an identifiable victim who has suffered a quantifiable loss. The restitution obligation is mandatory rather than discretionary, and the court has limited authority to depart from full restitution even in cases of defendant financial hardship.
The CFAA offenses listed in 18 U.S.C. Section 1030 frequently produce restitution exposure that exceeds the criminal sentencing exposure. A defendant convicted of unauthorized access to a protected computer can face a relatively modest term of imprisonment but a restitution obligation that includes the cost of incident response, the cost of system remediation, the cost of customer notification, the cost of credit monitoring services, and other expenses that the victim incurred as a direct result of the offense. The restitution obligation can extend well beyond the defendant ability to pay.
The loss calculation under the MVRA must be supported by competent evidence and must reflect actual losses rather than speculative or consequential damages. The government typically presents the loss calculation through victim affidavits, business records, and expert testimony from incident response specialists. The defense can challenge the loss calculation through cross-examination, through independent expert testimony, and through legal arguments about the proper scope of recoverable losses under the MVRA.
The loss categories and the recoverable damages
Recoverable losses under the MVRA in CFAA cases include incident response costs, system remediation costs, lost revenue from system downtime, customer notification costs, credit monitoring services for affected individuals, regulatory compliance costs associated with the incident, and other direct costs of responding to the unauthorized access. The categories are not exhaustive, and the specific recoverable losses depend on the facts of each case.
Incident response costs typically include the fees paid to outside cybersecurity firms for forensic investigation, the costs of internal staff time devoted to the response, and the costs of specialized tools and services. The fees of outside firms can be substantial, often $100,000 or more for significant incidents, and the defense should scrutinize the invoices to ensure that the work performed was actually directed at the incident the defendant caused rather than at unrelated security improvements.
System remediation costs can include both immediate fixes to address the specific vulnerability exploited by the defendant and broader security upgrades implemented in response to the incident. The MVRA does not authorize restitution for security upgrades that exceed the costs of remediating the specific vulnerability, and the defense should challenge any remediation costs that appear to be broader security improvements rather than direct remediation. The defense expert can substantially limit the recoverable remediation costs through technical analysis of what work was actually necessary to address the specific incident.
The aggregation of losses and the $5,000 jurisdictional threshold
CFAA cases involve a $5,000 loss threshold under 18 U.S.C. Section 1030(c)(4)(A)(i)(I) that affects both the criminal jurisdiction and the restitution calculation. The Supreme Court in Van Buren v. United States, 593 U.S. 374 (2021), and subsequent lower court decisions have clarified the loss calculation framework, including the aggregation of losses across multiple victims and the scope of recoverable losses for jurisdictional purposes.
The loss aggregation rules permit the government to combine losses across multiple incidents and multiple victims in some circumstances, which can produce substantial total losses even where individual incidents produced modest losses. The defense should examine the aggregation methodology carefully to identify any improper aggregation that inflates the total loss. The aggregation can affect both the criminal liability and the restitution calculation, and challenges to the aggregation can substantially reduce both the sentencing exposure and the restitution obligation.
The defense in cases involving large-scale aggregation should consider expert analysis of the underlying incidents and the methodology used to combine them. A defense expert can identify methodological problems with the aggregation, identify incidents that should not have been included, and provide a counter-analysis that supports a lower aggregate loss. The expert analysis can be persuasive at sentencing and can produce significant reductions in both the guideline range and the restitution award.
Enforcement of the restitution order and the long-term consequences
The restitution order is enforceable as a civil judgment under 18 U.S.C. Section 3613 and can be enforced through the federal Debt Collection Improvement Act framework. The judgment can survive bankruptcy under 11 U.S.C. Section 523(a)(7) and (a)(13) for criminal restitution, can be enforced through wage garnishment, can produce tax refund offsets under the Treasury Offset Program, and can affect federal benefits eligibility for the defendant.
The enforcement framework can produce decades of post-sentence consequences for defendants who cannot satisfy the restitution at the time of sentence. The defendant who is on supervised release is typically required to make payments toward the restitution as a condition of supervision, with the payment amount determined based on the defendant ability to pay. After supervision ends, the restitution obligation continues, with the government able to use the enforcement mechanisms to collect from any non-exempt income or assets.
The defense practice should consider the restitution enforcement framework at every stage of the case. Negotiated dispositions should specifically address the restitution amount, the payment schedule, and any reductions for offsets from forfeiture or other recoveries. The defense should also pursue any available offset opportunities including credits for amounts already paid to victims, credits for property returned in forfeiture proceedings, and credits for any insurance recoveries that the victim has received. The cumulative effect of these offsets can substantially reduce the long-term restitution exposure and the practical burden of the post-sentence obligation.
Frequently Asked Questions
Can the court order restitution above the statutory loss amount?
Are class-action settlements considered when calculating restitution?
What if I cannot pay the restitution amount?
Can restitution include attorneys fees paid by the victim?
Does restitution survive bankruptcy?
Read the full Texas Computer Crimes Defense Guide
This article is one section of our comprehensive Texas Computer Crimes Defense Guide. The pillar guide covers recent developments, official resources, and the complete framework with deeper analysis.
Read the Pillar Guide →Practical Checklist
- Document everything early. Communications, records, and witness contact information lose value as time passes. Preserve them at the start of the case.
- Identify all parallel proceedings. Criminal, administrative, civil, and regulatory tracks often run in parallel. A statement in one becomes evidence in another. Map the full picture before any disclosure.
- Calendar every deadline. Filing deadlines, response deadlines, discovery deadlines, and hearing dates all have consequences. Missing a deadline can foreclose defenses that the facts otherwise support.
- Build the mitigation package early. Witness letters, treatment records, employment verification, and character references take time to gather. Counsel should begin building the package at the first consultation, not as the hearing approaches.
- Coordinate counsel across forums. Where the matter implicates multiple proceedings, having coordinated counsel (whether one firm or multiple firms in close communication) avoids the strategic errors that inconsistent representation creates.
- Understand the public-record dimension. Many dispositions create searchable records that follow the licensee, defendant, or respondent for years. The decision to contest versus resolve must account for the public visibility of each path.
For a confidential evaluation of your matter, call L&L Law Group at (972) 370-5060 or email info@landllawgroup.com. Initial consultations are free.
Next Steps
If you are facing a situation described here, consult counsel promptly. Many issues in this area run on strict deadlines.
- Call (972) 370-5060
- Email info@landllawgroup.com
Cite this guide
Bluebook: Reggie London & Njeri London, Restitution in CFAA Cases & the MVRA, L&L Law Group (May 30, 2026), https://landllawgroup.com/insights/restitution-cfaa-cases/.
APA: London, R., & London, N. (2026, May 30). Restitution in CFAA Cases & the MVRA. L&L Law Group.