Exactly.  Phishing someone&#x27;s password and not using it might be a T&amp;C violation, but shouldn&#x27;t necessarily be illegal (you might, for instance, be doing a study on user gullibility, or be part of a red team checking the security policies of a partner or supplier).  Actually <i>using</i> that password, on the other hand...