Federal identity theft law makes it a crime to knowingly use another person’s identifying information to commit or assist a federal offense or a state felony. The main statute, 18 U.S.C. § 1028, carries prison terms of up to 15 years for standard offenses and up to 30 years when the conduct supports terrorism. A companion provision, 18 U.S.C. § 1028A, adds a mandatory two-year sentence on top of certain underlying felonies, running consecutively, and raises that add-on to five years for terrorism offenses. Alongside the criminal statutes, several consumer protection laws limit how much money you can lose and give you specific tools to clear fraudulent accounts off your record.
What Counts as Identity Theft Under Federal Law
Section 1028 criminalizes producing, transferring, possessing, or using someone else’s identifying information without authorization. The statute uses the phrase “means of identification,” defined broadly to cover any name, number, or data point tied to a specific person.1Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
That reaches well past the obvious items. Social Security numbers, dates of birth, and driver’s license numbers qualify, as do electronic identification numbers, bank routing codes, and login credentials tied to financial accounts. Biometric data such as fingerprints and voiceprints count. So do telecommunications identifiers like the Electronic Serial Numbers assigned to mobile devices.1Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
Separate provisions address false identification documents. That matters for synthetic identity theft, where a criminal combines a real Social Security number with a fabricated name and date of birth to build a new identity. Federal law reaches this conduct through the false-document provisions, even when a document mixes real and fictional data.2United States Department of Justice. Criminal Resource Manual 1512 – Prohibited Acts 18 USC 1028
What Prosecutors Have to Prove
A federal identity theft conviction requires proof beyond a reasonable doubt that the defendant knowingly transferred, possessed, or used a means of identification without lawful authority. Accidentally receiving someone else’s mail, or holding a document you didn’t know was stolen, doesn’t satisfy that standard.1Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
The identification generally must belong to a real person. If a fabricated Social Security number happens to match nobody, the “another person” element may not be met for certain charges. When the number does trace back to a real individual, prosecutors have a clearer path.
The government also must prove specific intent. The defendant must have acted to commit, aid, or abet a federal violation or a state felony. Using someone else’s name casually isn’t federal identity theft. The intent to facilitate a separate crime is what makes the conduct criminal.1Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
The Knowledge Requirement After Flores-Figueroa
For aggravated identity theft under § 1028A, the Supreme Court narrowed what prosecutors must show in Flores-Figueroa v. United States (2009). The defendant had used counterfeit Social Security and immigration documents containing numbers that belonged to real people, but the government couldn’t prove he knew that. The Court held that prosecutors must show the defendant knew the identification belonged to an actual person, not simply that he used information that turned out to be someone’s.3Justia. Flores-Figueroa v. United States, 556 U.S. 646 (2009)
That ruling matters most in immigration and document fraud cases, where defendants often buy forged papers from third parties. It offers no cover for someone who takes a coworker’s Social Security number from a personnel file and uses it to open credit accounts.
Prison Time and Fines
Penalties under § 1028 scale with the offense. The maximum is up to 15 years in prison for baseline offenses, including producing or transferring false identification documents such as birth certificates or driver’s licenses, possessing document-making tools, or using stolen identifying information to obtain $1,000 or more in value over a one-year period. The maximum rises to 20 years when the identity theft facilitates drug trafficking, involves a crime of violence, or follows a prior conviction under the same statute. It reaches 30 years when the offense facilitates domestic or international terrorism. Fines apply at every tier.4Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
Aggravated identity theft under § 1028A sits on top of other charges. When someone uses another person’s identity while committing certain serious felonies — theft of government property, bank fraud, wire fraud, mail fraud, immigration offenses, false statements to buy firearms, Social Security fraud, and others on an extensive list — the court must impose a mandatory two-year prison sentence in addition to the sentence for the underlying felony. That sentence runs consecutively, so a defendant convicted of wire fraud and aggravated identity theft serves the wire fraud term and then begins the two years. Judges have no discretion to let the sentences overlap. For a terrorism-related underlying offense, the mandatory add-on is five years.5Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
How Long Prosecutors Have to File Charges
Federal prosecutors generally have five years from the date of the offense to bring identity theft charges, under the default limitations period for non-capital federal offenses in 18 U.S.C. § 3282.6Office of the Law Revision Counsel. 18 USC 3282 – Offenses Not Capital The clock starts when the offense is committed, not when the victim discovers it. Identity theft often goes undetected for months or years, so by the time fraudulent accounts surface on a credit report, part of the window may already be gone.
What You Can Recover as a Victim
Federal law requires courts to order restitution when a defendant is convicted of identity theft. Under the Mandatory Victims Restitution Act, restitution covers the return of stolen property or its monetary equivalent, plus lost income and expenses such as child care and transportation incurred while participating in the investigation or prosecution.7Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes One gap: the statute doesn’t explicitly compensate victims for the hours spent on phone calls, paperwork, and credit disputes to clean up the damage. Reimbursable expenses are tied to participating in the criminal case, not the broader remediation effort.
How Federal Law Caps Your Financial Losses
Criminal statutes punish identity thieves. Separate consumer protection laws determine how much money you can actually lose when your information is misused. The protections differ sharply depending on the type of account.
Credit Cards
Under the Truth in Lending Act, your liability for unauthorized credit card charges cannot exceed $50, and that cap applies only to charges made before you notify the card issuer. After notification, your liability for further unauthorized charges is zero.8Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Most major issuers voluntarily waive even the $50, though the law doesn’t require them to.
Debit Cards
Debit card protection is tiered under the Electronic Fund Transfer Act, and the amount you can lose depends on how fast you report the theft:
- Report within two business days of learning about the theft, and your liability is capped at $50.
- Report after two business days but within 60 days of your statement, and your liability can reach $500.
- Report after 60 days, and you can face unlimited liability for unauthorized transfers that occur after that 60-day window.9Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
A thief who drains a checking account through unauthorized debit transactions can leave you short on rent while the bank investigates. Credit card fraud typically doesn’t touch your cash at all.
Blocking Fraudulent Credit Report Entries
The Fair Credit Reporting Act gives identity theft victims the right to have fraudulent information blocked from their credit reports. Once you submit proof of identity, a copy of an identity theft report, and a statement identifying the fraudulent entries, each credit bureau must block that information within four business days.10Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting From Identity Theft A block is stronger than a dispute, because it prevents the information from reappearing.
What to Do If Your Identity Is Stolen
The order of these steps affects how much damage you absorb.
File an FTC Report and Freeze Your Credit
Start at IdentityTheft.gov, the Federal Trade Commission’s reporting site. The system generates an Identity Theft Report, a formal document with legal weight. Because the FTC is a federal law enforcement agency, that report carries the same practical authority as a police report for most purposes, including exercising your right to block fraudulent credit information and dispute unauthorized accounts.11Military Consumer. Most ID Theft Victims Don’t Need a Police Report A separate police report is still worth filing if you know who stole your identity, if the thief used your name during an encounter with police, or if a creditor specifically demands one.
Next, place a credit freeze with all three major credit bureaus. A freeze is free under federal law and stays in place until you lift it. While it is active, no one can open new credit accounts in your name because lenders can’t pull your report.12Federal Trade Commission. Credit Freezes and Fraud Alerts A fraud alert is a lighter alternative that lasts one year and requires lenders to verify your identity before extending credit. Extended fraud alerts last seven years but require an identity theft report to set up. For most victims, a freeze offers better protection.
If Someone Files a Tax Return in Your Name
If a thief files a fraudulent return using your Social Security number, the IRS will reject your legitimate return when you try to e-file. When that happens, submit IRS Form 14039 (Identity Theft Affidavit) attached to a paper copy of your return, and mail it to the IRS location where you normally file.13Internal Revenue Service. Identity Theft Affidavit (Form 14039) Processing takes longer than a standard return because the IRS has to investigate the duplicate filing.
Once your case is resolved, the IRS automatically enrolls you in its Identity Protection PIN program. Each January you receive a six-digit PIN that must appear on future returns. Without it, no return using your Social Security number will be accepted, which blocks repeat fraud.14Internal Revenue Service. FAQs About the Identity Protection Personal Identification Number (IP PIN) You can opt into the IP PIN program voluntarily even if you’ve never been a tax identity theft victim.