Understanding Identity Theft: Crimes, Penalties, and Your Rights
Learn how identity theft happens, how the law treats it, and what you can do if your personal information is misused.
Identity theft is more than an inconvenience or a billing error. In modern criminal law, it is a serious offense that involves using another person’s identifying information without permission to commit fraud or other crimes. When prosecutors bring an identity theft case, they often charge it alongside related fraud offenses, which can greatly increase potential prison time and fines.
What Counts as Identity Theft?
At its core, identity theft involves the unauthorized use of another person’s identifying information to commit, aid, or further a crime, usually a fraud offense. Under federal law, this is typically framed as knowingly transferring, possessing, or using a “means of identification” of another person with criminal intent.
Examples of “Means of Identification”
Federal statutes treat many different data points as a legally protected “means of identification.” Common examples include:
- Full name combined with date of birth
- Social Security number
- Driver’s license or state ID number
- Credit or debit card numbers
- Bank account and routing numbers
- Electronic serial numbers tied to cell phones or devices
- Login credentials used to access financial or online accounts
Even a single data point, if it can uniquely identify a specific person or be used with other data to do so, can fall within the legal definition.
Key Legal Elements
While specific language varies by statute and jurisdiction, identity theft laws generally require proof of:
- Use or possession of another person’s identifying data (not your own);
- Lack of authorization from the person whose identity is used;
- Knowledge and intent – the defendant knew the information belonged to someone else and used it with intent to commit, aid, or further a crime; and
- Connection to an underlying offense, typically a federal or state felony such as fraud, financial crimes, or computer offenses.
The Future of AI: Preventing a Big Tech Monopoly >
Common Identity Theft Schemes
Identity theft can occur in many ways, ranging from low-tech theft of mail to sophisticated data breaches. Typical patterns described in enforcement guidance include:
- False credit applications using another person’s information to obtain credit cards, loans, or retail accounts;
- Unauthorized bank transactions, such as withdrawals or electronic transfers from a victim’s account;
- Online account takeovers involving hacked email, payment, or social media profiles used to reroute funds or trick contacts; and
- Benefit or service fraud, where someone uses stolen data to obtain government benefits, health care, utilities, or other services.
Criminals may acquire information through phishing emails, malicious software, data breaches, dumpster diving, skimming devices, or insider access at businesses that handle sensitive data.
Federal Identity Theft Laws and Penalties
Identity theft is prosecuted at both the federal and state levels. At the national level, Congress has created specific offenses and penalty enhancements that prosecutors can use when identity theft is tied to other crimes.
Identity Theft and Assumption Deterrence Act
The Identity Theft and Assumption Deterrence Act is a key federal law targeting identity theft conduct, codified mainly in 18 U.S.C. § 1028 and related provisions. It makes it a federal offense to knowingly use another person’s identifying information without authority in connection with specified unlawful activities that violate federal law or constitute a felony under state or local law.
Key features include:
- Coverage of a broad range of identifying information;
- Application when the identity theft is connected to another crime (for example, mail fraud or bank fraud); and
- Authorization of criminal forfeiture of property used in or obtained through the offense.
Aggravated Identity Theft
Congress also enacted a specific offense known as aggravated identity theft, codified in 18 U.S.C. § 1028A. This law imposes a mandatory extra prison term when a defendant uses another person’s identity during and in relation to certain serious underlying felony crimes, such as bank fraud or immigration offenses.
Features of aggravated identity theft include:
- A mandatory minimum two-year term of imprisonment, in addition to the sentence for the underlying felony;
- Requirement that the sentence for the aggravated identity theft count run consecutively to the sentence for the related crime;
- Frequent use in conjunction with other federal fraud statutes, leading to significantly longer total sentences.
Other Federal Crimes Frequently Charged With Identity Theft
Identity theft rarely appears alone in an indictment. Common companion charges include:
- Identification document fraud (18 U.S.C. § 1028)
- Access device or credit card fraud (18 U.S.C. § 1029)
- Computer fraud and abuse (18 U.S.C. § 1030)
- Mail fraud (18 U.S.C. § 1341)
- Wire fraud (18 U.S.C. § 1343)
- Financial institution fraud (18 U.S.C. § 1344)
Each of these offenses is typically a felony and can carry substantial prison terms, in some cases up to 30 years, plus fines and forfeiture of assets involved in the crime.
Typical Federal Penalty Range
| Type of Federal Offense | Illustrative Penalties |
|---|---|
| Basic identity theft offense | Up to 15 years in prison, fines, and forfeiture of property used in or derived from the crime. |
| Aggravated identity theft (18 U.S.C. § 1028A) | Mandatory additional two-year term, consecutive to the sentence for the underlying felony. |
| Related fraud offenses (e.g., bank fraud) | Felony penalties that can reach up to 30 years in prison, depending on the statute and case facts. |
State Identity Theft Laws
All U.S. states and many territories also have their own identity theft or misuse of personal information statutes. These laws often mirror federal definitions but can differ in how they classify offenses and structure penalties.
Common state-level features include:
- Separate crimes for identity fraud, misuse of identifying information, or criminal use of personal ID;
- Penalty schemes that range from misdemeanors for low-level conduct up to serious felonies when the loss is large, many victims are involved, or vulnerable people are targeted;
- Restitution provisions requiring offenders to repay financial losses and sometimes reimburse the cost of correcting credit records; and
- Additional enhancements when the victim is an elderly person, a minor, or a member of a protected class.
The precise classification (misdemeanor vs. felony), maximum sentence, and restitution rules depend on the state statute applied in a particular case.
How Identity Theft Cases Are Investigated and Prosecuted
Because identity theft often crosses city, state, and even national borders, multiple agencies may become involved. At the federal level, investigations may include the Federal Bureau of Investigation (FBI), the United States Secret Service, the U.S. Postal Inspection Service, and inspectors general for agencies affected by benefit fraud.
Key investigative steps can involve:
- Tracing financial transactions and IP addresses;
- Analyzing communications such as emails, texts, and messages related to fraudulent accounts;
- Interviewing banks, merchants, and other institutions where fraudulent activity occurred; and
- Coordinating with state and local police where physical devices, mail theft, or in-person transactions were involved.
Consequences Beyond Criminal Penalties
For defendants, a conviction can have serious long-term effects in addition to incarceration and fines. These may include difficulty obtaining employment, housing, professional licenses, or immigration relief due to the fraud-related nature of the offense.
Victims can also experience extended disruption, such as:
- Damaged credit scores and higher borrowing costs;
- Collection efforts on accounts opened or used by the thief;
- Loss of access to funds while fraud claims are investigated; and
- Considerable time and stress spent correcting records and disputing accounts.
Steps to Take if You Suspect Identity Theft
If you believe you are a victim, acting quickly can reduce harm and improve your ability to document losses. Government agencies recommend several key steps:
1. Contact Financial Institutions Immediately
- Call the fraud department of banks, credit card issuers, and any company where unauthorized activity appeared.
- Ask them to freeze or close compromised accounts and issue new account numbers and cards.
- Change all associated PINs, passwords, and security questions.
2. Place a Fraud Alert or Credit Freeze
In the United States, major credit reporting agencies allow you to place a fraud alert, signaling that lenders should take extra steps to verify identity before opening new accounts. You may also consider a temporary or long-term credit freeze to block most new credit in your name.
3. Document Everything
- Keep copies of statements showing unauthorized charges or accounts.
- Maintain a log of all phone calls, including dates, times, names, and outcomes.
- Save letters and emails from creditors, credit bureaus, and law enforcement.
4. Report to Law Enforcement and Relevant Agencies
Depending on the nature of the theft, you may:
- File a report with local or state police and request a copy for your records;
- Submit complaints to consumer protection agencies or specialized federal reporting portals; and
- Notify benefit agencies if government payments, health care, or tax refunds are affected.
5. Consider Legal Advice
If the theft is extensive, involves criminal records, or leads to lawsuits or collection actions in your name, consulting a lawyer may help you:
- Respond to court notices and debt collection lawsuits;
- Request correction of public records where your identity was used in an arrest or citation; and
- Seek restitution in criminal proceedings or pursue civil remedies, where available under state law.
Preventing Identity Theft
No set of precautions can eliminate risk, but practical steps can reduce your exposure:
- Use unique, strong passwords and consider multi-factor authentication for important accounts;
- Review bank and credit card statements regularly for unfamiliar charges;
- Be cautious about sharing information on social media that could help answer security questions;
- Shred documents containing sensitive data before discarding; and
- Use secure networks and updated software to reduce vulnerability to hacking and malware.
When to Speak With a Criminal Defense Lawyer
If you are under investigation or have been charged with identity theft or associated fraud offenses, prompt legal advice is essential. A defense lawyer can:
- Explain the specific statutes and potential sentencing ranges that apply to your case;
- Evaluate whether evidence linking you to particular transactions or devices was lawfully obtained;
- Negotiate with prosecutors regarding charges, plea agreements, or cooperation; and
- Present mitigating circumstances at sentencing, such as lack of prior record or limited role in a broader scheme.
Because identity theft cases often involve complex digital evidence and financial records, experienced counsel can be critical in challenging technical or circumstantial proof.
Identity Theft: Frequently Asked Questions
Q: Is identity theft always a felony?
A: Under federal law, most identity theft and related fraud statutes are felonies with potentially lengthy sentences. At the state level, some jurisdictions allow misdemeanor charges for lower-level conduct, but larger schemes, repeat offenses, or aggravated circumstances are typically treated as felonies.
Q: What is the difference between identity theft and identity fraud?
A: The terms are sometimes used interchangeably. In many laws, “identity theft” focuses on the unauthorized acquisition or use of another person’s identifying information, while “identity fraud” addresses how that information is used to obtain money, goods, services, or other benefits. The same conduct may violate both theft and fraud statutes.
Q: Who investigates identity theft cases?
A: Investigations can involve local police, state law enforcement, and federal agencies. At the national level, the FBI, U.S. Secret Service, and U.S. Postal Inspection Service all investigate identity theft and related fraud offenses, often in coordination with prosecutors from the U.S. Department of Justice.
Q: Can I be held responsible for debts from accounts opened in my name by an identity thief?
A: Consumer protection laws and credit card agreements generally limit liability when unauthorized transactions are reported promptly, but you may need to actively dispute accounts, provide documentation, and work with creditors and credit bureaus. In complex cases, legal assistance may be helpful to navigate disputes or defend against collection actions.
Q: What should I keep for my records after an identity theft incident?
A: Keep copies of police reports, letters from creditors and credit bureaus, account statements showing fraudulent activity, and a detailed log of all calls and communications. These records can assist in clearing your name, disputing charges, and supporting any restitution request if a criminal case is filed.
References
- Identity Theft and Identity Fraud — U.S. Department of Justice, Criminal Division. 2023-05-01. https://www.justice.gov/criminal/criminal-fraud/identity-theft/identity-theft-and-identity-fraud
- Federal ID Theft Law — Florida Attorney General (My Florida Legal). 2022-02-10. http://www.myfloridalegal.com/identity-theft/federal-id-theft-law
- Mandatory Minimum Penalties for Federal Identity Theft Offenses — U.S. Sentencing Commission. 2018-09-01. https://www.ussc.gov/research/research-reports/mandatory-minimum-penalties-federal-identity-theft-offenses
- State Identity Theft Statutes and Criminal Use of Personal ID — National Conference of State Legislatures. 2023-01-05. https://www.ncsl.org/financial-services/identity-theft
- Privacy & Personal Information: Identity Theft — Texas State Law Library. 2023-06-15. https://guides.sll.texas.gov/privacy-and-personal-information/identity-theft
Similar Articles
Read full bio of Sneha Tete
