I agree, I don't think it can always be code-only. If you socially engineer someone into giving you an account, I really think that should be fraud. I've thou

I agree, I don't think it can always be code-only. If you socially engineer someone into giving you an account, I really think that should be fraud. I've thought about this for some years now and looked at various different cases tried under the CFAA or otherwise claimed to be unauthorized access. I personally believe it should turn on whether or not you used deception as the means to gain access. That is, but for your deception, would you have gained access? This, in my mind, proves they were up to no good (mens rea) and acts to make it clearer whether or not you were authorized. It also connects to the idea that the law is mean to counteract a type of fraud in general. I mean, how can anyone say they had authorized access if they had to lie to gain access?