Table of Contents
The Federal Trade Commission logged roughly 1.04 million identity theft reports in 2023 — more complaints than any other consumer category that year. Behind each one sits a legal question with real teeth: which statute applies, who counts as the victim, and how much prison time the conduct actually carries. Identity theft laws are not a single rule. They are a patchwork of federal criminal provisions, state statutes that vary wildly in severity, and civil remedies that give victims tools the criminal system never will.
Here’s how the machinery fits together.
What Counts as Identity Theft Under Federal Law
Before 1998, a person who stole your Social Security number and opened a credit card in your name could be charged with fraud — but the bank was the victim. You were a witness. Congress closed that gap with the Identity Theft and Assumption Deterrence Act, which added § 1028(a)(7) to Title 18 of the U.S. Code and made the person whose identity was used a victim in their own right.
The offense has three moving parts: knowingly transferring, possessing, or using a means of identification belonging to another person, with the intent to commit, aid, or abet unlawful activity. Notice that possession alone is enough. Someone caught with a spreadsheet of stolen Social Security numbers can be charged before a single account is opened, because the statute targets intent rather than results.
“Means of identification” is broader than most people assume
Section 1028(d)(7) defines the term to include names, Social Security numbers, driver’s license numbers, dates of birth, biometric data, unique electronic identification numbers, routing codes, and telecommunications identifying information. Courts have pushed the edges further, treating fingerprints, account-reset email addresses, and in some circuits IP addresses as covered identifiers. A credit application that gets declined still supports a charge — the attempt is the crime, not the payout.
Aggravated Identity Theft and Its Mandatory Two-Year Add-On
The Identity Theft Penalty Enhancement Act of 2004 created 18 U.S.C. § 1028A, the provision that reshaped federal sentencing in this area. Aggravated identity theft requires a predicate felony — mail fraud, wire fraud, bank fraud, immigration offenses, and a long list of others — plus the knowing use of another person’s identification during that felony. The penalty is a mandatory two years, served consecutively to the sentence for the underlying crime. If the predicate is terrorism-related, the mandatory term jumps to five years.
That word “consecutive” matters. A defendant facing 18 months on a wire fraud count suddenly faces 42 months once the § 1028A count is stacked on top, and the judge has no discretion to run them together.
Flores-Figueroa changed how prosecutors prove knowledge
In Flores-Figueroa v. United States (2009), the Supreme Court reviewed the case of an undocumented worker who used false identification documents at an Iowa steel plant. The trial judge had not required the jury to find that he knew the numbers belonged to real people. The Court vacated the conviction, holding that § 1028A requires the government to prove the defendant knew the means of identification belonged to another actual person.
Since then, prosecutors build that knowledge element with circumstantial evidence: bulk purchases of identifiers, identifiers matched to fabricated credit files, patterns showing the defendant avoided numbers flagged as deceased, and testimony from co-conspirators about how the data was sourced. Defense attorneys attack exactly there, because losing that element can knock two years off the sentence in a single ruling.
State Identity Theft Statutes Diverge Sharply
Roughly two-thirds of states maintain a standalone identity theft or identity fraud statute. The rest fold the conduct into forgery, fraud, or theft by deception provisions, which affects charging decisions, plea options, and how a conviction reads on a background check.
California Penal Code § 530.5 is among the most heavily used, carrying up to three years in county jail or state prison depending on the facts, with enhancements for prior convictions and for victims who are elderly or dependent adults. Texas grades the offense under Penal Code § 32.51 by the value of the property or the harm caused, escalating from a misdemeanor to a first-degree felony as the numbers climb. Other states set thresholds so low that a single $400 fraudulent purchase lands as a misdemeanor with probation.
Many states also issue an Identity Theft Passport — a court or police document a victim can show to creditors and law enforcement to prove they are not the person on the paperwork.
How Identity Theft Cases Get Investigated and Charged
Prosecutors rarely start with a hunch. They start with a data trail: internet subscriber records tied to an IP address, device extractions from a traffic stop, bank account openings that used a shared mailing address, surveillance at a mailbox drop. Federal venue rules are generous here, letting the government file where the identifier was stolen, where it was used, or where the victim lives.
Most federal identity theft prosecutions fall under the five-year statute of limitations in 18 U.S.C. § 3282. Aggravated identity theft follows the limitations period of its predicate offense, which in fraud cases can run longer. Restitution is typically ordered under the Mandatory Victims Restitution Act, and the totals can climb into six figures across a single case with dozens of accounts.
What Victims Can Force Under Civil Law
Criminal statutes punish. Civil statutes give victims leverage, and most people never use it.
- Fraud alerts and freezes. Under FCRA § 605A, a victim with a police or FTC identity theft report can place a seven-year extended fraud alert. Since September 2018, credit freezes are free in every state.
- Records access. FCRA § 609(e) requires a business to hand over copies of applications and transaction records tied to the fraudulent account within 30 days of a written request and identity theft report.
- Damages. Willful violations of the Fair Credit Reporting Act allow actual damages or statutory damages of $100 to $1,000 per violation, plus punitive damages and attorney’s fees. Negligent violations allow actual damages.
- State consumer protection claims. Unfair or deceptive practice statutes, plus common law fraud or negligence claims, apply to companies that exposed the data in the first place.
- Tax relief. The IRS Identity Theft Affidavit, Form 14039, flags a compromised SSN so fraudulent returns get rejected rather than processed.
Where the Data Actually Leaks From
Identity theft prosecutions trace back to a handful of predictable sources. Institutional breaches top the list — the Canvas breach that disrupted nearly 9,000 schools put a large volume of student and staff account data into circulation. Phishing kits that clone a bank login page, SIM swaps at mobile carriers, mail theft targeting pre-approved credit offers, and plain insider theft at dealerships and medical offices all feed the same market.
Synthetic identity fraud sits at the messier end. A fraudster pairs a real Social Security number, often a child’s clean, unchecked number, with an invented name and birth date, then nurtures the credit file for years. Because no single existing person matches the file, the “another person” element in § 1028A can fail, and prosecutors sometimes have to fall back on bank fraud or false statement charges. As cybersecurity defenses adapt to AI-driven threats, voice cloning has joined the list — a few seconds of recorded audio is enough to impersonate a customer at a call center, and the FTC’s impersonation rule, effective April 2024, now covers government and business impersonation including AI-generated voices.
If You’re Facing an Identity Theft Charge
The defenses that actually work are narrow and specific. Consent is the strongest when the account holder gave permission and later regretted it. Lack of knowledge is the strongest under Flores-Figueroa when the identifiers came from a source that presented them as legitimate. Mistaken identity, withdrawal from the scheme before the identifiers were used, and duress appear regularly and rarely succeed without documentation.
Because § 1028A carries a mandatory consecutive term, plea negotiations are more constrained than in a typical fraud case. Prosecutors can dismiss the aggravated count in exchange for a plea on the predicate, and that single concession often matters more than anything else in the room. Anyone contacted by agents for a “quick conversation” about an account or a deposit should understand that the interview is the investigation. The gap between a five-year sentence and probation usually sits inside a definition — whether the defendant knew, whether the identifier belonged to a real person, whether the conduct crossed state lines. Those questions get answered by evidence gathered in the first seventy-two hours, long before anyone sees a courtroom.
