| Jurisdiction | Relevant Laws | Penalties | |--------------|----------------|------------| | United States | CFAA (Computer Fraud and Abuse Act), 18 U.S.C. § 1029 (Access Device Fraud) | Up to 15 years imprisonment, fines | | European Union | Directive 2013/40/EU (attacks against information systems), national fraud acts | 2-5 years minimum imprisonment | | Latin America (e.g., Mexico, Colombia, Argentina) | Federal Criminal Codes (Fraud, Identity Theft, Unauthorized Access) | 2 to 10 years imprisonment |

| Legitimate Scenario | How It Differs | |---------------------|------------------| | Payment gateway testing | Uses test card numbers provided by Visa/Mastercard (e.g., 4111 1111 1111 1111) with explicit authorization. | | Security research | Conducted in isolated labs with bank permission, not public tools. | | Educational demonstrations | Clearly labeled as “Luhn generator – not real cards,” with disclaimers and no live BINs. |