State Identity Theft Laws Explained

Understanding How States Treat Identity Theft

Identity theft is one of the most common financial crimes because it depends on misusing information that people share every day. State laws generally make it illegal to take, use, or possess another person’s identifying information without permission for an unlawful purpose. In practice, these laws are designed to stop conduct such as opening accounts, making purchases, obtaining benefits, or committing fraud in another person’s name.

Although the exact wording changes from state to state, the core idea is the same: a person cannot use someone else’s identifying data to deceive a business, a government agency, or another person. Many state statutes also punish attempts, conspiracies, and repeated offenses, which means liability may arise even if the fraud is interrupted before the victim suffers the full financial loss.

What Counts as Identifying Information

State laws typically define identifying information broadly so that the law reaches more than just a name or Social Security number. Official guidance commonly treats items such as account numbers, access credentials, government-issued identifiers, and other data that can link a record to a specific person as protected information.

• Names and Social Security numbers
• Financial account and credit card information
• Driver’s license or government ID numbers
• Electronic serial numbers or device identifiers
• Other data that can be used alone or with other details to identify a person

The broad definition matters because identity thieves often rely on partial information. A single piece of data may be enough to unlock a credit account, impersonate a consumer, or create a false profile that helps the fraud continue.

Typical Actions That Can Trigger Criminal Charges

State identity theft statutes usually cover a range of behavior rather than one narrow act. A person may face charges for using another individual’s information without consent, for possessing stolen data with fraudulent intent, or for creating fake records that are tied to a real or invented identity for unlawful use.

Common examples include:

• Opening a bank or credit account in another person’s name
• Making purchases using stolen account information
• Using a deceased person’s identifying information fraudulently
• Creating counterfeit records to support another crime
• Attempting to obtain benefits, goods, or services through false identity use

Many statutes focus not only on successful fraud but also on the intent behind the conduct. If prosecutors can show that the defendant knowingly used identifying information to further illegal activity, the crime may be complete even when the financial loss is limited or the scheme is discovered early.

How State Penalties Are Usually Structured

Penalties vary widely by jurisdiction, but many states grade identity theft based on the amount of loss, the type of victim, the number of prior offenses, or whether the crime was connected to a larger scheme. Some states treat lower-value conduct as a misdemeanor and larger or repeated conduct as a felony.[10]

Some states impose fines, probation, restitution, and prison time, while others add additional penalties for conduct involving vulnerable victims, public benefits, or official records. Georgia, for example, classifies identity fraud as a felony and increases punishment for subsequent offenses; Pennsylvania grades the offense based in part on value and other aggravating factors.

Federal and State Law Can Overlap

Identity theft can violate both state law and federal law. Federal statutes punish unauthorized transfer, possession, or use of another person’s means of identification, and some aggravated cases can carry substantial prison exposure. State prosecutors usually handle conduct that occurs within the state, but federal authorities may become involved when the offense crosses state lines, involves federal programs, or is connected to larger fraud schemes.

This overlap matters because the same behavior can be investigated in multiple ways. A defendant may face one or more state offenses along with federal charges if the facts support both systems. The practical result is that identity theft cases often require careful review of where the conduct occurred, what information was used, and which agencies or victims were affected.

What Victims Should Do After Identity Theft

Fast action can reduce the damage caused by identity theft. The Department of Justice and the Office for Victims of Crime recommend several immediate steps, including contacting creditors, placing fraud alerts, checking credit reports, and filing reports with the proper authorities.

• Contact the fraud department for each affected account
• Request that compromised accounts be closed or frozen
• Change passwords, logins, PINs, and security questions
• Place a fraud alert with one of the major credit bureaus
• Order free credit reports and review them carefully
• File an Identity Theft Report with the Federal Trade Commission
• Make a police report and keep a copy for future disputes

Federal guidance also explains that consumers can obtain credit reports from the major bureaus and use those reports to identify unfamiliar accounts or transactions. That documentation is often useful when disputing charges, proving the theft, or showing that a fraudulent account was opened without consent.

Why Police Reports and Identity Theft Reports Matter

Victims often need more than a phone call to a bank. Official reports help create a paper trail that can support credit disputes, account closures, and criminal investigations. The FTC report and police report can also help demonstrate that the consumer is not responsible for fraudulent activity tied to the stolen identity.

In many recovery situations, the victim must provide a government ID, proof of address, and evidence of the theft. Police departments may ask for bills, IRS notices, or account statements showing suspicious activity. Although the specific paperwork depends on the agency, a complete file can make it easier to challenge fraudulent debts and restore accurate records.

Defenses and Proof Issues in Criminal Cases

Identity theft cases often turn on intent, authorization, and knowledge. Prosecutors generally must show that the accused knowingly used another person’s identifying information and did so without permission. If the defense can show consent, mistaken identity, lack of intent, or insufficient proof tying the accused to the data, the charge may be harder to prove.

Digital evidence is especially important because these cases often involve online access, stored credentials, or electronic records. Investigators may examine device logs, account histories, mailing addresses, and transaction records to determine whether the defendant actually controlled the account or benefited from the fraud. Because the conduct can be technical, the quality of the evidence often shapes the case outcome more than the raw amount of loss.

Why Restitution Is a Major Part of These Cases

Even when a court imposes jail time or a fine, identity theft cases often end with a restitution order. Restitution is meant to reimburse the victim for losses caused by the crime, including expenses related to fixing damaged accounts and restoring records.

Victims may spend many hours contacting banks, closing accounts, disputing charges, and correcting credit files. Federal law discussed by the Office for Victims of Crime recognizes that remediation time can be part of the harm caused by identity theft and aggravated identity theft. State courts similarly often require defendants to compensate victims for measurable losses tied to the offense.

How State Laws Protect People Beyond Financial Loss

Identity theft does more than create short-term financial loss. It can interfere with housing, employment, tax filings, medical billing, and access to benefits. Because of those broader consequences, state laws often aim to prevent both direct theft and downstream harm from false records, impersonation, and fraudulent use of personal information.

That wider focus helps explain why many statutes are written to cover attempts, facilitation, and possession of stolen identifiers. The law is not limited to cases where money changes hands immediately. It also reaches conduct that creates a serious risk of future harm, such as holding personal data for later fraud or using it to build a counterfeit identity.

Practical Tips for Reducing Risk

Preventing identity theft is not always possible, but a few habits can reduce exposure. Consumers should monitor account activity, use strong passwords, avoid sharing sensitive information unnecessarily, and review credit reports periodically. When a breach or suspicious charge appears, reporting it quickly often limits the damage.

• Use unique passwords for financial and email accounts
• Enable multi-factor authentication where available
• Review bank and credit statements regularly
• Shred documents that contain sensitive information
• Respond quickly to unusual account alerts

Because identity theft laws can vary by state, victims and accused individuals should look closely at the local statute, the value of the alleged loss, and whether prosecutors are alleging an attempt, a completed offense, or a broader fraud scheme.[10]

Frequently Asked Questions

Is identity theft always a felony?

No. Many states divide identity theft offenses by value, repetition, or aggravating facts. Lower-level conduct may be charged as a misdemeanor in some jurisdictions, while larger or repeated schemes may be felonies.[10]

Can someone be charged if the fraud did not succeed?

Yes. Several state laws punish attempts or conspiracies to commit identity theft, and federal law also reaches attempted or aided conduct in some situations.

What information is usually protected?

Protected information commonly includes names, Social Security numbers, account numbers, government identifiers, and other data that can identify a specific person when used alone or with other information.

What is the first step after discovering identity theft?

Victims are generally advised to contact the affected financial institutions, protect the accounts, place fraud alerts, review credit reports, and file official reports with the FTC and police.

Can a victim recover money spent fixing the problem?

Yes. Courts often order restitution, and federal guidance recognizes that remediation time and related losses may be part of the harm caused by identity theft.