Yes, phishing is illegal and perpetrators can face severe penalties, including fines and imprisonment, under various cybercrime laws.