You don't usually have to report money you spend, at least if you're an individual. You only have to report money you make. If you're a victim you don't make an

You don't usually have to report money you spend, at least if you're an individual. You only have to report money you make. If you're a victim you don't make any money. I doubt the attacker is reporting the income for tax purposes, so the attacker is breaking tax law most likely.