Aggravated Identity Theft vs Identity Theft: Sentences, Dubin Limit, Pleas

Aggravated identity theft and standard identity theft are two distinct federal charges with very different consequences. Standard identity theft under 18 U.S.C. § 1028 carries a flexible range of possible sentences, from probation up to 30 years in extreme cases. Aggravated identity theft under 18 U.S.C. § 1028A is narrower: it applies only when a stolen identity is used during one of a specific list of felonies, and a conviction triggers a mandatory two-year prison term that must run after whatever sentence the underlying crime draws.

What Standard Federal Identity Theft Covers

Federal law treats identity theft as knowingly using another person’s identifying information, without permission, to carry out any illegal activity. The statute reaches a broad range of data: names, Social Security numbers, dates of birth, driver’s license numbers, biometric data like fingerprints, and electronic identifiers such as routing numbers or account credentials.¹

To secure a conviction, prosecutors must prove the defendant acted knowingly and intended to commit or help commit an unlawful activity. That underlying activity can be a federal crime or a state or local felony.¹ Typical examples include opening credit accounts with stolen information, filing fraudulent tax returns, draining someone else’s bank account, and taking out loans in another person’s name.²

Sentencing Range for the Standard Charge

The maximum sentence depends on what the defendant did and who was harmed. Federal law sets four tiers:

Up to 5 years for most cases that don’t meet a higher threshold.
Up to 15 years when the offense involves producing or transferring fake government IDs, birth certificates, or driver’s licenses; five or more identification documents; or at least $1,000 in value gained within a single year.
Up to 20 years when the identity theft is connected to drug trafficking or a violent crime, or when the defendant has a prior identity theft conviction.
Up to 30 years when the identity theft facilitates an act of terrorism.

Each tier also carries potential fines.¹ These are ceilings, not floors. A judge keeps discretion to impose a lighter sentence, and in some cases probation is on the table. The Justice Department also prosecutes identity theft under other federal statutes, some of which independently carry penalties as high as 30 years.²

What Makes a Case “Aggravated”

Aggravated identity theft is not a separate way of punishing identity theft more harshly on its own. It is a stacking charge that attaches to a specific set of other federal crimes. The qualifying felonies listed in the statute include theft of government property, bank fraud, mail fraud, wire fraud, embezzlement from employee benefit plans, false statements to buy a firearm, false claims of citizenship, and various immigration and passport offenses.³

The use of someone else’s identity must occur “during and in relation to” one of those felonies. A defendant who happens to possess another person’s personal information while committing an unrelated crime cannot be charged under this statute. The identity theft has to be part of the felony itself.

The Dubin Limit

Federal prosecutors long read the aggravated statute broadly, applying it whenever a stolen identity “facilitated” a qualifying felony in any way. The Supreme Court cut that reading back in 2023. In Dubin v. United States, a manager at a psychological services company had been convicted of healthcare fraud for overbilling Medicaid, with an aggravated identity theft count added because billing forms contained a patient’s Medicaid number. The Court held that the use of someone’s identity must be “at the crux of what makes the conduct criminal.”⁴

In practical terms, misrepresenting who received a service qualifies, because the stolen identity is central to the fraud. Misrepresenting how or when a service was performed does not, even if a real person’s name sits on the paperwork.⁴

Why the Aggravated Sentence Hits Harder

The penalty structure for aggravated identity theft is deliberately rigid. A conviction carries a flat two-year prison sentence. If the underlying felony involves terrorism, the mandatory term is five years.³

Three features in the statute make that sentence unusually punishing. Probation is off the table: the court cannot substitute community service or any alternative for the prison time. The sentence runs consecutively, not concurrently, which means it is added onto whatever the underlying felony draws. And the judge cannot shorten the sentence for the underlying felony to offset the extra two years.³ An eight-year wire fraud sentence paired with an aggravated identity theft conviction becomes ten years total.

The federal sentencing guidelines for this offense mirror the statute. The only realistic path below the mandatory minimum is a prosecution motion certifying that the defendant provided substantial assistance to law enforcement.⁵ One narrow exception sits inside the statute itself: when a defendant is convicted of multiple aggravated identity theft counts in the same case, the judge may let some of those counts run alongside each other, but at least one two-year term must still run consecutively to the underlying felony sentence.³

How the Difference Plays Out in Plea Deals

The mandatory consecutive sentence gives prosecutors heavy leverage. Once an aggravated identity theft conviction is entered, the judge has almost no room to show leniency on that portion of the sentence. A defendant facing both wire fraud and an aggravated identity theft count knows that losing at trial means at least two guaranteed extra years.

That math pushes many cases toward settlement. Prosecutors sometimes agree to drop the aggravated charge in exchange for a guilty plea on the underlying felony. Defendants with information to offer may cooperate to earn a substantial-assistance motion. The Sentencing Commission has noted that charging and plea decisions shape how identity theft mandatory minimums actually land in practice.⁵

Restitution Applies to Both

Whichever charge is pursued, federal courts must order the defendant to pay restitution. Identity theft is an offense committed by fraud or deceit against property, which makes restitution mandatory rather than discretionary.⁶

Covered losses include stolen or destroyed property, lost income, the cost of professional services needed to repair the damage, and expenses the victim incurred while helping with the investigation or prosecution. That last category reaches transportation, childcare, and time missed from work for court appearances or dealings with law enforcement.⁶ A restitution order and actual payment are different things, though, and collection can be difficult when a defendant lacks assets. Victims also retain the option of a separate civil suit for compensatory and punitive damages.

If You Are the Victim

If someone has used your personal information without permission, IdentityTheft.gov, run by the Federal Trade Commission, is the government’s central reporting and recovery resource. The site builds a personalized recovery plan, generates pre-filled letters to send to creditors, and tracks your progress through each step.⁷

Federal law gives you several specific tools. You can place a 90-day fraud alert by contacting any one of the three major credit reporting companies, which must then notify the other two. Filing an identity theft report lets you extend that alert to seven years, requiring creditors to reach you directly before opening new accounts. You can also demand that credit reporting companies block fraudulent information from your report, and you can put a credit freeze in place to stop new creditors from accessing your file at all.⁸ For tax-related identity theft, the IRS recommends filing Form 14039, the Identity Theft Affidavit, to invalidate any fraudulent return filed in your name.⁹

1
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
2
Department of Justice. Identity Theft and Identity Fraud
3
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
4
Supreme Court of the United States. Dubin v. United States
5
United States Sentencing Commission. Mandatory Minimum Penalties for Identity Theft Offenses
6
Office of the Law Revision Counsel. 18 U.S. Code 3663A – Mandatory Restitution to Victims of Certain Crimes
7
Federal Trade Commission. Report Identity Theft
8
Office for Victims of Crime. Statement of Rights for Identity Theft Victims
9
USAGov. Identity Theft