California Identity Theft Laws Under Penal Code 530.5

California’s identity theft law, Penal Code 530.5, makes it a crime to willfully obtain another person’s personal identifying information and use it for any unlawful purpose. A conviction can be charged as a misdemeanor carrying up to a year in county jail or, for most subsections, as a felony carrying 16 months, two years, or three years. The same statutory scheme also gives victims specific tools to freeze their credit, pull records on fraudulent accounts, and sue for damages that can reach $30,000 on top of actual losses.

What PC 530.5 Makes Illegal

Subsection (a) is the core offense. Prosecutors must prove two things: that the defendant willfully obtained someone else’s personal identifying information, and that the defendant used it for an unlawful purpose such as obtaining credit, goods, services, real property, or medical information without the other person’s consent.¹ “Willfully” means intentionally, not by accident.

The scheme does not have to succeed. If someone uses a stolen Social Security number to apply for a credit card and the application is denied, the crime is complete. The statute punishes the use of stolen information for an unlawful purpose, not the outcome.

Subsection (b) protects victims separately. When a defendant uses stolen identifying information to commit another crime, the court records must reflect that the person whose identity was stolen did not commit that offense.¹ Without that notation, a victim can end up flagged in criminal databases for conduct they had nothing to do with.

What Counts as Personal Identifying Information

Penal Code 530.55 defines personal identifying information broadly.² The category includes:

Financial identifiers such as bank account numbers, credit card numbers, PINs, and passwords
Government-issued identifiers including Social Security numbers, taxpayer identification numbers, driver’s license numbers, passport numbers, and immigration service numbers
Biometric data such as fingerprints, facial scan identifiers, voiceprints, and retina or iris images
Electronic identifiers such as unique electronic identification numbers, routing codes, and telecommunications access devices
Employment and education records such as employee identification numbers, school identification numbers, and place of employment
Other personal records including a mother’s maiden name, health insurance numbers, and information from birth or death certificates

Using any of these data points to impersonate someone or gain unauthorized access can trigger PC 530.5.

Possession, Sale, and Mail Theft

The statute reaches conduct that precedes any completed fraud.

Under subsection (c)(1), holding someone else’s personal identifying information with intent to defraud is a misdemeanor punishable by up to one year in county jail. A first offense under this subsection is a straight misdemeanor, so the prosecutor cannot elevate it to a felony. Two situations change that. A prior conviction under any part of PC 530.5 makes the possession charge a wobbler eligible for felony treatment. Possession of the personal identifying information of ten or more people is also a wobbler, regardless of criminal history.¹

Subsection (d)(1) makes it a wobbler to sell, transfer, or convey someone’s personal identifying information with intent to defraud. Subsection (d)(2) applies when the seller knows the buyer plans to commit identity theft.¹

Subsection (e) reaches mail theft. Taking mail from a mailbox, a mail carrier, or a delivery vehicle is prosecutable under PC 530.5 because pre-approved credit offers, bank statements, and tax documents give a thief the raw material for identity theft.

Misdemeanor and Felony Penalties

Whether a violation is a wobbler depends on which subsection applies.

A first-time violation of subsection (c)(1), simple possession with intent to defraud, can only be filed as a misdemeanor. The maximum is one year in county jail, a fine up to $1,000, or both.¹

Subsections (a), (c)(2), (c)(3), and (d) are wobblers. As misdemeanors, the ceiling is one year in county jail. As felonies, the sentence is 16 months, two years, or three years under Penal Code 1170(h).¹ Under realignment, most felony identity theft sentences are served in county jail rather than state prison unless the defendant has prior convictions for serious or violent felonies.

Prosecutors typically weigh the financial loss, the number of victims, the sophistication of the scheme, and the defendant’s record when deciding how to charge. A single misuse of one stolen card looks very different from a bulk data operation.

Restitution

Restitution is mandatory. Under Penal Code 1202.4, the sentencing court must order the defendant to pay every determined economic loss the victim suffered because of the offense.³

For identity theft victims, the statute specifically includes the cost of monitoring and repairing credit for a reasonable period of time, plus attorney’s fees and other collection costs incurred by or on behalf of the victim. Interest accrues at 10 percent per year, running from the date of sentencing or the date of loss, whichever the court selects.³ The court cannot waive restitution because the defendant lacks assets. The obligation stays on the defendant until paid in full.

Collateral Consequences

Professional Licensing

Identity theft convictions can jeopardize California professional licenses. Under the Business and Professions Code, a conviction involving dishonesty or fraud is grounds for denying or revoking a license if the crime is substantially related to the profession’s duties. Identity theft generally meets that test for finance, healthcare, law, and real estate. California also provides paths back: certain less serious convictions are shielded from licensing denial once seven years have passed, and a certificate of rehabilitation can remove a felony conviction as a barrier. Each board sets its own rehabilitation criteria.

Immigration Consequences

For non-citizens, an identity theft conviction can trigger removal. Fraud and theft offenses generally qualify as crimes involving moral turpitude, and a single conviction of that type can make a non-citizen deportable, particularly when the offense carries a potential sentence exceeding one year. The felony version of PC 530.5 clears that threshold.

Common Defenses

Because PC 530.5 hinges on specific intent, most defenses attack that element.

No unlawful purpose. Subsection (a) requires the information to have been used for an unlawful purpose. Legitimate use, such as a family member handling authorized finances, undercuts the prosecution’s case. Most of these disputes are really about where authorization ended.

No intent to defraud. Subsections (c) and (d) both require intent to defraud. Coming into possession of someone else’s identifying information through a shared mailbox, a workplace database, or a misdirected document is not a crime absent proof of intent to misuse it, and that burden falls on the prosecution.

Unwitting participation. In cases with multiple actors, a defendant who served as a middleman without understanding the scheme, receiving and forwarding packages obtained through identity theft, for example, may lack the mental state the statute requires.

Mistake of fact. A defendant who genuinely believed they had permission, or who did not realize the information belonged to someone else, can negate the intent element. Because identity theft is a specific intent crime, even an unreasonable mistake can support the defense if it truly shows the defendant lacked criminal intent.

Statute of Limitations

Felony PC 530.5 filings generally must be brought within three years of the offense. Misdemeanors carry a one-year window. Identity theft often stays hidden for months or years, and the discovery rule can push the start of the clock to when the victim or law enforcement discovers the crime. A viable limitations issue can result in outright dismissal, so it is worth raising early.

What to Do If You Are a Victim

California pairs the criminal statute with victim rights that most people never hear about. Filing the right reports early is what activates them.

File a Police Report

Under Penal Code 530.6, you can report identity theft to your local police department. That report, or an FTC identity theft report, is the prerequisite for nearly every other remedy: credit freezes, records requests, and civil claims all depend on it.

Request Records on Fraudulent Accounts

Under PC 530.8, once you present a copy of your police report or a signed FTC identity theft report along with proof of identity, any business where a fraudulent account was opened must give you copies of the application and all transaction records within 10 business days, free of charge. If the business refuses, you can sue for $100 per day of noncompliance, plus attorney’s fees.⁴

Place a Credit Freeze

California Civil Code sections 1785.11.2 through 1785.11.6 let you place a security freeze on your files at all three major credit bureaus. Identity theft victims with a police report pay nothing for the freeze.⁵ A freeze blocks new creditors from pulling your report, which stops the thief from opening additional accounts. You can lift it temporarily when you need legitimate credit.

Register With the DOJ Identity Theft Database

California’s Department of Justice maintains a statewide identity theft database under PC 530.7. Registration requires a court order, fingerprints, and other information the department specifies. Once registered, you and authorized law enforcement can verify your victim status through a toll-free number. It helps in situations where your identity has been confused with a criminal’s in law enforcement records.

File an FTC Report

An identity theft report through IdentityTheft.gov creates a federally recognized record and can substitute for a police report in some California procedures. The FTC process also generates a personalized recovery plan that walks you through disputing charges, placing fraud alerts, and notifying businesses.

Civil Remedies Under Civil Code 1798.93

California Civil Code 1798.93 lets identity theft victims sue in civil court, and the remedies are unusually strong.⁶ A court that finds identity theft can declare the victim owes nothing on the fraudulent claim, void any security interest the claimant obtained through the fraud, enjoin further collection, and dismiss a lawsuit the claimant filed based on the fraudulent account.

Victims can also recover actual damages, attorney’s fees, costs, and any equitable relief the court considers appropriate. To qualify for damages and fees, you must send the claimant written notice at least 30 days before filing suit, attaching a police report or FTC identity theft report and alerting the claimant to the possible identity theft.⁶

The provision with the most bite is the civil penalty. If clear and convincing evidence shows that you gave written notice, the claimant failed to investigate diligently, and the claimant kept pursuing the fraudulent debt anyway, the court can add up to $30,000 to your award.⁶ The penalty exists to punish creditors and collectors that ignore identity theft claims. Document your written notice carefully, because it is the gateway to this remedy.

When Federal Charges May Also Apply

Identity theft that crosses state lines, involves the internet, or targets federal institutions can draw federal charges alongside or instead of state ones. Under 18 U.S.C. 1028, the base penalty for identity fraud is up to five years in prison, rising to 15 years when the scheme involves large numbers of identification documents or generates $1,000 or more in value within a one-year period. Identity theft tied to drug trafficking or a violent crime carries up to 20 years, and terrorism-linked schemes up to 30 years.⁷

Federal prosecutors often add aggravated identity theft under 18 U.S.C. 1028A, which carries a mandatory two-year prison term that runs consecutively to the underlying felony sentence. The court cannot reduce the other sentence to offset it, substitute probation, or run the terms concurrently. Terrorism-related aggravated identity theft adds five years.⁸ When stolen data came from computer intrusion, 18 U.S.C. 1030 can also apply.⁹ Federal charges also carry mandatory forfeiture of property used in the offense.

On the victim side, the Fair Credit Reporting Act adds federal rights that work alongside California’s, including fraud alerts, dispute rights, and required correction or deletion of unverifiable information, typically within 30 days.¹⁰

1
California Legislative Information. California Penal Code 530.5
2
California Legislative Information. California Penal Code 530.55
3
California Legislative Information. California Penal Code 1202.4
4
California Legislative Information. California Penal Code 530.8
5
California Department of Justice. How to Freeze Your Credit Files
6
California Legislative Information. California Civil Code 1798.93
7
Office of the Law Revision Counsel. 18 U.S. Code 1028
8
Office of the Law Revision Counsel. 18 U.S. Code 1028A
9
Office of the Law Revision Counsel. 18 U.S. Code 1030
10
Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act