The fraud in this case would be to Facebook, because she is pretending to be the other user. I'd be surprised in this case if Facebook took legal action against her, but they might ban her from the platform.

Is there any case law on this? In particular, I wonder what establishes ownership of an account. For example, I know people who share email accounts. How does the law distinguish the two cases?

If Alice were to go after Bob for logging in with credentials to an account she created, things seem pretty simple. But it seems difficult for Facebook to determine whether Alice and Bob are ok with a shared account or not. And even more so for the government to determine if it's ok for Bob to use those credentials.

Facebook doesn't have to determine whether Bob and Alice are okay sharing an account because doing so is already expressly prohibited by their terms of service[0]:

> "You will not share your password (or in the case of developers, your secret key), let anyone else access your account, or do anything else that might jeopardize the security of your account."

[0]: https://www.facebook.com/terms.php

Well, sure, but fraud is a criminal charge, not a ToS violation.

Ok but that's pretty far from a federal offense.

If they can prove that she caused damage or obtained anything of value, it is. https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#C...