When asked if phishing is illegal, the answer is usually yes. Since stealing a person’s personal information is aimed at committing identity theft, it could be punishable by law.