Identity theft carries anywhere from up to 1 year in jail for a low-level misdemeanor to 30 years in federal prison for the most serious offenses. The answer to how many years in prison for identity theft depends on three things: whether the case is charged in state or federal court, how much money was involved and how many people were affected, and whether prosecutors add a charge of aggravated identity theft, which tacks a mandatory 2 years onto whatever other sentence the court imposes.
Federal Prison Terms Under 18 U.S.C. § 1028
The main federal identity theft statute sets four tiers of maximum prison time based on what the defendant did and why.1Office of the Law Revision Counsel. 18 USC 1028 Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
- Up to 5 years for less serious conduct, such as possessing false identification documents.
- Up to 15 years for most offenses, including producing false IDs, transferring stolen documents, and using someone else’s personal information to commit fraud.
- Up to 20 years when the offense facilitates drug trafficking or a crime of violence, or when the defendant has a prior conviction under the statute.
- Up to 30 years when the offense facilitates domestic or international terrorism.
Each tier also carries a fine, which under general federal sentencing law can reach $250,000 for an individual convicted of a felony.2Office of the Law Revision Counsel. 18 US Code 3571 – Sentence of Fine
The Mandatory 2-Year Add-On for Aggravated Identity Theft
Federal prosecutors frequently stack a second charge, aggravated identity theft under 18 U.S.C. § 1028A, on top of the underlying crime. It carries a flat 2-year prison term that must run consecutively, meaning after the sentence for the underlying offense rather than at the same time. A judge cannot reduce it, run it concurrently, or substitute probation.3Office of the Law Revision Counsel. 18 USC 1028A Aggravated Identity Theft
If the underlying crime involves terrorism, the mandatory add-on jumps to 5 years.3Office of the Law Revision Counsel. 18 USC 1028A Aggravated Identity Theft
The add-on only attaches to specific predicate offenses listed in the statute. Those include:
- Mail, bank, and wire fraud
- Theft of public money and bank embezzlement
- Fraud and false statements, including tax fraud and false claims
- Immigration offenses such as passport fraud, visa fraud, and false citizenship claims
- Social Security fraud
- False statements to obtain a firearm
- Obtaining customer financial information through false pretenses under the Gramm-Leach-Bliley Act
The list is broad enough that most fraud schemes built on a stolen identity will qualify.4Office of the Law Revision Counsel. 18 US Code 1028A – Aggravated Identity Theft
What Determines the Actual Sentence
Statutory maximums only tell you the ceiling. The real number in a federal case comes out of the Federal Sentencing Guidelines, and for fraud and identity theft the controlling provision is USSG §2B1.1. The single biggest factor is the dollar loss, including intended loss when the defendant tried but failed to steal more.5United States Sentencing Commission. USSG 2B1.1 – Larceny, Embezzlement, and Other Forms of Theft
- $6,500 or less: no increase
- More than $6,500: +2 levels
- More than $40,000: +6 levels
- More than $150,000: +10 levels
- More than $1,500,000: +16 levels
- More than $9,500,000: +20 levels
- More than $65,000,000: +24 levels
Each 2-level increase roughly translates to 25 to 30 percent more prison time.
The guidelines then add further levels for the scope and nature of the scheme. Ten or more victims, or use of mass-marketing, adds 2 levels. Substantial financial hardship to 5 or more victims adds 4 levels; the same hardship to 25 or more adds 6. Targeting elderly or otherwise vulnerable victims, using sophisticated means such as hacking tools, and abusing a position of trust each push the number higher. A defendant’s prior record is handled separately through the criminal history category, and repeat offenders land in significantly higher ranges.5United States Sentencing Commission. USSG 2B1.1 – Larceny, Embezzlement, and Other Forms of Theft
State Prison Terms
Most identity theft cases are prosecuted in state court, and the sentence turns on where the case is filed. Every state criminalizes identity theft, but classification and penalty structures differ widely.
Low-dollar cases, or cases without proven financial loss, are usually misdemeanors carrying up to 1 year in local jail. States split misdemeanor from felony at different thresholds, with some drawing the line as low as $750 and others at $1,000 or $2,000. Once a case crosses into felony territory, state prison sentences generally run from 2 to 20 years, with fines that can exceed $10,000.
Four things typically push a state case toward the top of that range: the dollar amount involved, the number of victims, victim characteristics such as age, disability, or active-duty military status, and prior convictions for identity theft or fraud. The same conduct can be charged as a misdemeanor in one state and a felony in the next.
Supervised Release, Restitution, and Fines
A federal prison sentence does not end at the prison gate. The federal system abolished traditional parole for crimes committed after November 1, 1987,6U.S. Department of Justice. United States Parole Commission and in its place, defendants serve a period of supervised release after prison. The maximum length depends on how the felony is classified: up to 5 years for a Class A or B felony, up to 3 years for a Class C or D felony, and up to 1 year for a Class E felony or misdemeanor.7Office of the Law Revision Counsel. 18 USC 3583 – Inclusion of a Term of Supervised Release After Imprisonment Violating the conditions, such as reporting requirements or restrictions on new financial accounts, can send you back to prison for the remainder of the term.
Federal courts must also order restitution under the Mandatory Victims Restitution Act. Restitution covers victims’ actual losses, lost income, credit-repair costs, and expenses tied to the investigation or prosecution, and it does not expire.8Office of the Law Revision Counsel. 18 USC 3663A Mandatory Restitution to Victims of Certain Crimes Courts can additionally order forfeiture of property used in or gained from the scheme.9U.S. Department of Justice. Identity Theft and Identity Fraud
How Long Prosecutors Have to File Charges
Federal identity theft charges must generally be filed within 5 years of the offense.10Office of the Law Revision Counsel. 18 US Code 3282 – Offenses Not Capital The clock starts when the crime is committed, not when the victim finds out. In an ongoing scheme with multiple fraudulent transactions, each separate act can restart the clock, which extends the practical window. State limitations periods vary, running from about 3 years in some jurisdictions to 7 or more in others depending on severity.