The President signed an executive order on March 6, 2026, directing several Cabinet officials to review the government’s response to cybercrime, fraud, and predatory schemes and to submit an action plan. The order was published in the Federal Register on March 11, 2026. It is Executive Order 14390.
The order says these activities are draining families of savings, taking the benefits of years of work, and destroying the lives of young people. It lists ransomware and malware, phishing, financial fraud, sextortion and other extortion, and impersonation. It says the activity is often coordinated by transnational criminal organizations and that, in many cases, foreign regimes provide willing or tacit support.
The order states a policy of protecting Americans and hardening financial and digital systems against the threats. It says the United States shall answer attacks with a response that includes law enforcement, diplomacy, and potential offensive actions. It also states a policy of supporting victims, expanding public alerts, and giving priority to those most at risk.
The order directs the Secretary of State, the Secretary of the Treasury, the Secretary of War, the Attorney General, and the Secretary of Homeland Security to carry out the work. They must consult the Office of the National Cyber Director and coordinate with the Assistant to the President and Homeland Security Advisor.
Within 60 days of the order, those officials must review operational, technical, diplomatic, and regulatory frameworks and decide how each can be improved against organizations engaged in cyber-enabled crime and similar schemes. Within 120 days, they must send the President an action plan through the homeland security adviser. The order says the plan must identify organizations responsible for scam centers and cybercrime and propose ways to prevent, disrupt, investigate, and dismantle them.
The plan must provide for an operational cell inside the National Coordination Center established under an earlier executive order of Jan. 20, 2025, titled Protecting the American People Against Invasion. The cell is to coordinate federal efforts to detect, disrupt, dismantle, and deter cyber-enabled crime by foreign organizations and related networks aimed at people of the United States, companies, essential systems, or government services. The order says the private sector may be involved as appropriate.
The order requires the plan to describe how the Attorney General and the Secretary of Homeland Security, supported by the Secretary of War, will use technical capabilities, threat intelligence, and insights from commercial cybersecurity firms and other non-federal entities. The plan and the cell must improve information sharing, operational coordination, and rapid response, and must align with existing law enforcement frameworks for threats from foreign jurisdictions.
The order directs the Attorney General to keep prioritizing prosecutions of cyber-enabled fraud, including scam centers and sextortion schemes, and to pursue the most serious provable offenses, consistent with principles of federal prosecution.
The Secretary of Homeland Security, acting through the director of the Cybersecurity and Infrastructure Security Agency, must partner with the coordination center to the maximum extent the law allows. The order says that work is to provide training, technical assistance, and help building resilience for state, local, tribal, and territorial governments, including sharing threat intelligence and hardening critical infrastructure.
Within 90 days, the Attorney General must recommend to the President, through the homeland security adviser, on establishing a Victims Restoration Program. The order says the program would be designed to provide restoration or remission to victims of cyber-enabled fraud from funds clawed back, forfeited, or seized from the organizations behind the schemes, to the extent the law allows.
The order directs the Secretary of State, coordinating with the National Coordination Center, to press foreign governments for enforcement against organizations operating inside their borders and for greater cooperation with United States law enforcement. It directs the secretary to take steps so nations that tolerate the activity face consequences consistent with United States law and policy, such as limits on foreign assistance, targeted sanctions, visa restrictions, trade penalties, and, where appropriate, immediate expulsion of complicit foreign officials and diplomats. The secretary must also coordinate those steps with allies and partners.
The order says it does not reduce legal authority already given to departments or the budget role of the director of the Office of Management and Budget. It is to be carried out consistent with applicable law and available appropriations, and it does not create a right anyone can enforce in court. The Department of Homeland Security is to pay the costs of publishing it. The order does not revoke an earlier order.