Is Identity Theft a Federal Crime? Penalties Under 18 U.S.C. 1028

Yes, identity theft is a federal crime. It is prosecuted primarily under 18 U.S.C. 1028 and the aggravated identity theft statute at 18 U.S.C. 1028A, with maximum prison sentences that run from five years for the baseline offense up to 30 years when the conduct supports an act of terrorism.¹ Every state also has its own identity theft law, so the same conduct can produce charges in both systems.

When the Case Becomes Federal

18 U.S.C. 1028 makes it a felony to use, transfer, or possess another person’s identifying information without authority, so long as the person intends to commit or help commit a federal crime or a felony under state or local law. “Identifying information” is defined broadly to cover any name, number, or data point that can identify a specific person: Social Security numbers, dates of birth, driver’s license numbers, biometric data, and electronic account credentials all qualify.¹

The federal hook is interstate or foreign commerce, and that includes any electronic transfer of information. In practice, almost any identity theft committed through the internet, email, or an interstate phone call satisfies the jurisdictional requirement. Certain categories also pull a case into federal court almost automatically because they target federal systems or federally regulated institutions:

Tax refund fraud, where someone files a false return using your personal information to steal the refund. The Department of Justice treats stolen identity refund fraud as a top enforcement priority.²
Social Security fraud, including working under someone else’s SSN, filing claims using another person’s number, and buying or selling Social Security cards.³
Passport and immigration document fraud, which carries its own penalties of up to 10 years for a first offense, 20 years when it facilitates drug trafficking, and 25 years when it facilitates international terrorism.⁴
Synthetic identity schemes, where a real Social Security number is combined with a fabricated name and date of birth to open accounts at federally insured banks and credit unions. Children’s SSNs are a frequent target because their credit files are empty.⁵

Aggravated Identity Theft and the Mandatory Add-On

A separate statute, 18 U.S.C. 1028A, creates the offense of aggravated identity theft. It applies when someone uses another person’s identifying information during and in connection with certain specified felonies, including fraud, immigration violations, and theft of government property. A conviction carries a mandatory two-year prison sentence that must run consecutively to any sentence for the underlying felony. The court cannot substitute probation for that time.⁶

If the underlying felony is a terrorism offense, the mandatory add-on rises to five years. Federal prosecutors frequently stack a 1028A count on top of other fraud charges precisely because it guarantees extra prison time, no matter how short the sentence on the main offense turns out to be.

Prison Time Under 18 U.S.C. 1028

The core identity theft statute uses a tiered maximum based on what was done and how much was taken:

Up to 5 years for basic identity theft where the financial gain is under $1,000 in a one-year period, or where the defendant possesses five or more stolen identification documents.¹
Up to 15 years for producing or transferring fake U.S. government IDs, birth certificates, or driver’s licenses; producing five or more false identification documents; possessing document-making equipment with intent to produce fakes; or any identity theft that yields $1,000 or more in a one-year period.
Up to 20 years when the offense is connected to drug trafficking or a violent crime, or when the defendant has a prior federal identity theft conviction.
Up to 30 years when the offense is committed to facilitate an act of domestic or international terrorism.

These are maximum sentences, not mandatory minimums. The actual sentence in any given case depends on the Federal Sentencing Guidelines, loss amount, criminal history, and other factors the judge weighs. The one piece that is not discretionary is the 1028A add-on when it applies.

Fines, Restitution, and Supervised Release

A felony identity theft conviction can carry a fine of up to $250,000 per count.⁷ The court also orders forfeiture of any personal property used to commit the offense.

Restitution is mandatory. Because identity theft is a crime of fraud or deceit, it falls under the Mandatory Victims Restitution Act, which requires the court to order repayment of the victim’s financial losses regardless of the defendant’s ability to pay.⁸ Restitution can cover the value of property taken, lost income, and expenses the victim incurred during the investigation and prosecution, such as travel to court or time spent with law enforcement.

Prison is not the end of the sentence either. Most identity theft offenses are Class C or Class D felonies, which carry up to three years of supervised release once the defendant is out.⁹ During that period the defendant has to avoid any new crimes, keep up with restitution, and comply with conditions a court may add, such as restrictions on computer use or financial accounts. A violation can send the defendant back to prison.

The Other Charges That Usually Get Stacked On

Identity theft cases rarely come with a single count. Prosecutors typically pair 1028 or 1028A with other federal statutes that each carry significant penalties of their own:

Wire fraud under 18 U.S.C. 1343, covering any scheme to defraud that uses electronic communications. One count carries up to 20 years, or up to 30 years if the fraud targets a financial institution.
Mail fraud under 18 U.S.C. 1341, applying when any part of the scheme uses the postal service or a private carrier. The penalties mirror wire fraud.
Computer fraud under 18 U.S.C. 1030, the Computer Fraud and Abuse Act, which reaches unauthorized access to computers to obtain financial records, consumer reporting agency files, or information from government systems. Penalties range from one year for a first offense involving simple unauthorized access to five years or more for repeat offenses or larger losses.¹⁰

Each count is sentenced separately. A defendant charged with identity theft plus multiple counts of wire fraud can be exposed to decades in prison before the mandatory 1028A add-on is even applied.

How Long Prosecutors Have To File Charges

The general federal statute of limitations for non-capital offenses is five years from the date the crime was committed, and that window applies to charges under 18 U.S.C. 1028 and 1028A.¹¹ Because identity theft often involves related offenses that span multiple years, prosecutors may be able to bring charges based on the most recent fraudulent act in an ongoing scheme, which can effectively extend how far back the conduct reaches.

1
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
2
U.S. Department of Justice. Stolen Identity Refund Fraud
3
Social Security Administration. Fraud Prevention and Reporting
4
Office of the Law Revision Counsel. 18 USC 1542 – False Statement in Application and Use of Passport
5
U.S. Immigration and Customs Enforcement. HSI Investigates Synthetic Identities Scheme That Defrauded Banks Nearly $2M
6
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
7
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
8
Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes
9
Office of the Law Revision Counsel. 18 US Code 3583 – Inclusion of a Term of Supervised Release After Imprisonment
10
Office of the Law Revision Counsel. 18 US Code 1030 – Fraud and Related Activity in Connection With Computers
11
Office of the Law Revision Counsel. 18 US Code 3282 – Offenses Not Capital