The United States has expanded its visa restriction framework to specifically target foreign nationals linked to cybercrime under Section 212(a)(3) of the Immigration and Nationality Act. Starting July 23, 2026, the State Department can deny or cancel visas for individuals suspected of involvement in or benefitting from cybercrimes, including large-scale scams. This new authority applies across tourist, business, student, exchange and work visa categories, adding cybercrime to the list of explicit reasons a visa can be refused or revoked.
The policy is global in scope and is not limited to particular countries or nationalities, reflecting Washington’s intent to disrupt cross-border criminal networks. Consular officers may apply the restrictions based on suspicion of cybercrime involvement, and the policy extends to immediate family members of targeted individuals, even when those relatives are not accused of direct participation. While the standard application procedures remain unchanged, this expansion materially broadens the set of grounds on which a visa can be found ineligible.
Before this change, U.S. visa law already allowed refusals on criminal, fraud, or national security grounds, but there was no explicit mechanism dedicated to cybercrime connections. The new policy formally enlarges the use of Section 212(a)(3)(C), which empowers the Secretary of State to restrict visas when someone’s entry could seriously harm U.S. foreign policy. The announcement follows Executive Order 14390, signed earlier in 2026, which sought to strengthen the U.S. response to cyber fraud and organized online crime, signaling an integrated government strategy against digital scams and sextortion schemes.
This move fits into a wider trend of countries using immigration tools to tackle transnational crime, especially online fraud operations that target victims in multiple jurisdictions. By focusing on cybercrime-linked travel, the U.S. aims to make it harder for criminal actors to coordinate in person, attend meetings, or base operations from American territory. The inclusion of immediate family members is designed to prevent networks from using relatives as proxies for travel and access.
What this means for you
For typical travelers applying for tourist, business, student, exchange or work visas, the State Department stresses that the usual application process does not change. There are no new forms, no extra fees, and no additional screening requirements for applicants who have no ties to cybercrime, so most visitors should experience the same procedures at consulates and embassies as before. The new rule matters primarily for individuals and families who might be connected to cybercriminal activity, even indirectly.
Prospective travelers should ensure that any online business activity is clearly legitimate and that they can explain their professional background if asked in an interview. Those who suspect they may be at risk due to associations with questionable online enterprises or financial flows should seek qualified legal advice before applying, as visa denials based on Section 212(a)(3)(C) can be difficult to overcome. Because relatives of targeted individuals can also face refusals, families involved in complex digital businesses may need to review their risk exposure carefully.
Overall, the policy adds an extra layer of scrutiny for a narrow subset of applicants, while leaving routine travel largely untouched. International travelers without any cybercrime links can continue planning trips to the United States under existing rules, but all applicants should be aware that cyber-related conduct is now an explicit factor in visa eligibility. As cybercrime enforcement evolves, travelers engaged in digital finance, online marketing, or cross-border tech services should be prepared to document their activities clearly if consular officers raise questions.