Identity Deception Charges: Federal Tiers, State Law, and Restitution

Identity deception charges can land a defendant anywhere from a year in county jail to 30 years in federal prison, and most states classify the offense as a felony. The federal statute, 18 U.S.C. § 1028, scales penalties to what the stolen information was used for, what documents were involved, and whether the scheme touched other serious crimes. A separate federal provision adds a mandatory two-year prison sentence on top of the sentence for certain underlying felonies, and courts in every case can order forfeiture of property, restitution to victims, and fines that run into tens of thousands of dollars.

What the Government Has to Prove

Federal prosecutors charging identity fraud under 18 U.S.C. § 1028 have to establish that the defendant knowingly transferred, possessed, or used another person’s identifying information, without lawful authority, and with intent to commit any federal crime or any state or local felony.¹ The statute covers eight categories of prohibited conduct in total, including producing false identification documents, possessing document-making equipment, and trafficking in stolen authentication features.

Two elements matter most to anyone looking at a charge. The first is intent. The government has to show the defendant acted knowingly and with intent to defraud or commit an unlawful act. Mistakenly putting the wrong Social Security number on a form is not this crime. But the flip side is harsher than people expect: prosecutors do not need to prove the fraud actually succeeded. Attempting or conspiring to commit any offense under the statute carries the same penalties as the completed crime.¹

The second is the phrase “without lawful authority.” If the defendant had genuine permission to use the information for the purpose it was used, the offense has not been committed. Defense attorneys routinely challenge this element by arguing the defendant believed they were authorized. Courts assess the specific facts to decide whether that belief was reasonable.

State statutes work from the same frame but use different names, from “identity deception” to “identity theft” to “identity fraud.” Most require intent to defraud or harm. A smaller number criminalize mere possession of stolen identifying information, even without proof of intent to use it.

Federal Penalty Tiers Under 18 U.S.C. § 1028

The federal statute lays out a tiered maximum sentence structure. Which tier applies depends on the type of document, the dollar value obtained, and whether the identity fraud connects to other categories of crime.¹

Up to one year. A catch-all for conduct that does not meet any of the higher categories.
Up to five years. The baseline for most identity fraud offenses, including transferring or using someone else’s identifying information or producing false documents not covered by a higher tier.
Up to 15 years. Applies when the offense involves government-issued identification such as birth certificates, driver’s licenses, or passports; when the defendant produces or transfers more than five false documents; when the defendant possesses document-making equipment; or when the defendant obtains $1,000 or more in value during any one-year period through stolen identifiers.
Up to 20 years. Triggered when identity fraud facilitates drug trafficking, is committed in connection with a violent crime, or the defendant has a prior federal identity fraud conviction.
Up to 30 years. Reserved for identity fraud committed to facilitate domestic or international terrorism.

Every tier carries potential fines in addition to the prison term. Courts must also order forfeiture of any personal property used or intended to be used in the offense, along with destruction of any false documents or document-making equipment seized during the case.¹

The Mandatory Add-On for Aggravated Identity Theft

The provision that most often turns a manageable federal case into a long sentence is 18 U.S.C. § 1028A. Anyone who uses another person’s identifying information during and in relation to certain listed felonies faces a mandatory two-year prison sentence that runs on top of whatever sentence they receive for the underlying crime.² If the underlying felony involves terrorism, the add-on jumps to five years.

“Mandatory” is not a loose word here. Courts cannot place a defendant convicted under § 1028A on probation. The two years cannot run concurrently with the sentence for the underlying felony. And judges are prohibited from shortening the sentence for the underlying crime to offset the add-on.² A defendant convicted of wire fraud who also used stolen identification gets the wire fraud sentence, then two more years on top of it.

The list of predicate felonies is long. It includes theft of public money, bank fraud, mail fraud, wire fraud, passport fraud, immigration offenses, false statements to obtain firearms, violations of the Gramm-Leach-Bliley Act involving customer information, and Social Security fraud.² The 2008 Identity Theft Enforcement and Restitution Act expanded that list to include conspiracy to commit a qualifying felony, counterfeiting securities, mail theft, and tax fraud.³

Skimmers and Device-Making Equipment

A defendant does not need to have actually stolen anyone’s identity to face serious federal charges. Under 18 U.S.C. § 1029, knowingly possessing device-making equipment, scanning receivers, or software configured to capture telecommunications identifiers with intent to defraud carries up to 15 years in prison for a first offense.⁴ That ceiling is higher than many of the penalties for actually using a stolen identity. A second conviction under the same statute raises the maximum to 20 years.

“Device-making equipment” covers anything designed or primarily used for producing access devices or counterfeits of them. “Scanning receiver” means equipment capable of intercepting electronic communications or capturing electronic serial numbers and mobile identification numbers. Credit card skimmers, cloned RFID readers, and similar hardware fall inside this framework.⁴

State Identity Deception Charges

Every state criminalizes identity theft or identity deception, but the label, classification, and penalty range vary from one jurisdiction to the next. Most states treat it as a felony. The severity tier typically turns on the dollar amount involved, the number of victims, and the victim’s age or vulnerability. A handful of states allow misdemeanor charges for lower-value offenses.

Some states classify the base offense as a mid-level felony carrying several years in prison. Others reserve their harshest penalties for cases involving elderly or disabled victims, large financial losses, or organized schemes targeting many people. Fines at the state level commonly reach $10,000 or more for a single count, and some jurisdictions scale fines to twice the value of the fraud. Nearly every state enhances penalties when the victim is a minor, a senior citizen, or an active-duty military member.

Because state statutes differ so much, the specific exposure in any given case depends on the law of the state where the conduct took place.

Restitution on Top of Prison and Fines

A federal identity fraud conviction almost always comes with a restitution order. Under 18 U.S.C. § 3663, courts can order a convicted defendant to reimburse the victim for lost income, necessary child care, transportation, and other expenses tied to participating in the investigation or prosecution.⁵ For identity theft specifically, the statute also requires restitution covering the value of time the victim reasonably spent trying to undo the damage.

The 2008 Identity Theft Enforcement and Restitution Act strengthened these protections. It explicitly authorized restitution for time spent remediating harm, expanded coverage to include offenses against organizations rather than only individuals, and eliminated the requirement that computer-related damage exceed $5,000 before federal prosecution could proceed.³ Restitution is separate from any fine paid to the government. A defendant can owe both, and restitution orders survive bankruptcy in most cases.

When Federal Prosecutors Take the Case

Identity deception can be charged at the state level, the federal level, or sometimes both. Federal agencies tend to get involved when the scheme crosses state lines, uses federal systems like the mail or interstate electronic communications, involves federal documents such as passports or immigration papers, or causes losses large enough to justify federal resources. Smaller, localized cases typically stay with state prosecutors.

Nothing in law prevents both levels of government from charging the same conduct, though for routine identity theft cases that is uncommon. The more usual pattern is a handoff: local investigators work the case, and if interstate activity or a large-scale scheme turns up, federal authorities take over. The 2008 Identity Theft Enforcement and Restitution Act specifically removed the requirement that computer fraud offenses involve an interstate communication before federal prosecution could proceed, broadening federal reach over identity crimes committed entirely online inside a single state.³

1
Office of the Law Revision Counsel. 18 U.S. Code 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
2
Office of the Law Revision Counsel. 18 U.S. Code 1028A – Aggravated Identity Theft
3
Congress.gov. Identity Theft Enforcement and Restitution Act of 2008
4
Office of the Law Revision Counsel. 18 U.S. Code 1029 – Fraud and Related Activity in Connection With Access Devices
5
Office of the Law Revision Counsel. 18 U.S. Code 3663 – Order of Restitution