Is Identity Theft a White Collar Crime? Federal Laws and Penalties

Yes, identity theft is a white collar crime. It belongs in that category because the offense is carried out through deception and fraud rather than physical force, and prosecutors handle it the same way they handle embezzlement, wire fraud, or securities fraud. Under federal law, convictions carry prison sentences ranging from 5 to 30 years depending on the conduct, plus a mandatory additional 2 years when the theft is tied to another federal felony. The Federal Trade Commission received over 1.1 million identity theft reports in 2024, making it one of the most common financial crimes in the country.¹

Why the White Collar Label Fits

White collar crime describes financially motivated offenses committed through deception rather than violence. The term originally covered fraud by business professionals, and it has stretched to include digital schemes that exploit personal data at scale. Identity theft lands squarely inside that definition. The perpetrator never confronts the victim in person. The harm is financial and administrative: damaged credit, drained accounts, loans opened in someone else’s name.

The classification is not just academic. It determines which investigators handle the case, which statutes apply, and how judges weigh severity at sentencing. Agents work from digital footprints, financial records, and paper trails. The playbook mirrors any other fraud investigation, which is why identity theft cases often appear alongside wire fraud, bank fraud, or mail fraud counts in the same indictment.

What Counts as Identity Theft

Financial identity theft is the most common form. Credit card fraud alone accounted for roughly 449,000 of the FTC’s 2024 reports, followed by fraudulent loans and bank account takeovers.¹ Thieves use stolen Social Security numbers, account credentials, or card details to open credit lines or empty existing accounts. Phishing emails, data breaches, and document forgery are the usual tools.

Medical identity theft is less common and often more damaging. When someone uses your insurance to receive care, the thief’s diagnoses, test results, and prescriptions get mixed into your medical records. A doctor relying on a contaminated chart during an emergency could make treatment decisions based on another person’s blood type or allergies. Correcting medical records is slow work and runs through hospital systems that were not designed for it.

Synthetic identity theft combines real and fabricated data to build a new persona. A thief might pair a stolen Social Security number with an invented name and birthdate, then build credit history over months before maxing out accounts and vanishing. Victims often do not discover the fraud until a creditor traces the Social Security number back to them, because none of the activity shows up on their own credit reports.

Federal Laws That Apply

Three federal statutes do most of the work in identity theft prosecutions. Prosecutors routinely stack them when a single scheme violates more than one.

Identity Theft and Assumption Deterrence Act (18 U.S.C. 1028)

This is the primary federal identity theft statute. It criminalizes using, transferring, or possessing someone else’s identifying information to commit any unlawful activity that violates federal law or qualifies as a felony under state law. Federal jurisdiction attaches when the crime crosses state lines, touches interstate commerce, or uses electronic communications, which captures almost any internet-based scheme.²

Prison exposure under 1028 scales with the conduct:

Up to 5 years for basic use or transfer of stolen identifying information.
Up to 15 years for producing or transferring forged IDs such as driver’s licenses or birth certificates, trafficking in five or more false IDs, or stealing identities that yield $1,000 or more in value within a year.
Up to 20 years when the theft facilitates drug trafficking or a violent crime, or when the defendant has a prior federal identity theft conviction.
Up to 30 years when the theft facilitates domestic or international terrorism.

Fines can reach $250,000 for individuals under the general federal fine statute,³ and courts can order forfeiture of any property used to commit the offense.²

Aggravated Identity Theft (18 U.S.C. 1028A)

Section 1028A adds a mandatory prison term on top of whatever punishment the underlying crime carries. If a defendant uses stolen identity information while committing another federal felony such as wire fraud, bank fraud, or mail fraud, the court must impose an additional 2 years. That sentence runs consecutively, so it stacks on the base sentence rather than overlapping with it. The add-on jumps to 5 years when the identity theft is tied to a terrorism offense.⁴

Courts cannot grant probation for an aggravated identity theft conviction.⁴ That is the clause that gives prosecutors leverage. A defendant facing an automatic 2 years with no probation option on top of the underlying sentence has strong reason to plead or cooperate.

Access Device Fraud (18 U.S.C. 1029)

When the theft involves stolen credit card numbers, debit cards, account passwords, or other access devices, prosecutors can also charge under 1029. Maximum penalties reach 10 or 15 years depending on the specific conduct, and a second conviction under this section pushes the ceiling to 20 years.⁵ Large data breach cases often feature this charge alongside 1028 counts.

How Judges Calculate the Actual Sentence

Statutory maximums set the ceiling. The number that drives a real sentence comes from the U.S. Sentencing Guidelines, which raise the offense level based on how much money the scheme involved:

Loss of $6,500 or less: no increase.
Loss over $95,000: 8-level increase.
Loss over $550,000: 14-level increase.
Loss over $9.5 million: 20-level increase.
Loss over $250 million: 28-level increase.

Each jump translates into meaningfully longer recommended prison time. The guidelines add further enhancements for the number of victims. Schemes affecting 10 or more victims add 2 levels; schemes causing substantial financial hardship to 25 or more victims add 6 levels. A separate 2-level bump applies when the offense involved unauthorized use of someone’s identity to obtain other identification, or when the defendant possessed five or more stolen means of identification.⁶ A scheme stealing hundreds of Social Security numbers produces a much higher sentence than a single-victim fraud, even before any 1028A add-on.

How Long Prosecutors Have to File Charges

Federal identity theft charges generally must be brought within five years of the offense, the standard federal limitations period for non-capital crimes under 18 U.S.C. 3282.⁷ The clock usually starts when the act occurs, not when the victim discovers it. Many victims take months or years to realize what happened, and by then the window may be closing. If prosecutors also charge wire fraud, mail fraud, or bank fraud alongside the identity theft counts, those charges can carry their own, longer limitations periods depending on the statute.

When States Prosecute Instead

Every state has its own identity theft statute, and state prosecutors handle most cases, particularly those involving local victims and regional fraud. Penalties vary widely. Some states treat small-dollar identity theft as a misdemeanor, while others classify any identity theft as a felony regardless of amount. Many use tiered penalty structures that scale with the number of victims or the total loss.

Federal prosecutors usually step in when a case crosses state lines, involves organized crime, or stems from a large-scale data breach. The same conduct could land in either court depending on scope. Federal penalties tend to be harsher, especially once the 1028A mandatory add-on is in play.

What Victims Can Do

Criminal prosecution punishes the thief; it does not automatically repair the victim’s credit or refund the losses. Federal law gives victims separate tools for that. A fraud alert placed with one credit bureau requires creditors to take reasonable steps to verify identity on new applications and must be shared with the other two bureaus, with an extended seven-year version available to anyone who files an identity theft report. A credit freeze goes further, blocking creditor access to the report entirely, and bureaus must place and remove freezes free of charge.⁸ Filing a report at IdentityTheft.gov generates the official FTC Identity Theft Report that unlocks most of these rights.⁹

If prosecutors do secure a conviction, courts can order restitution covering actual losses, including lost income, property damage, and counseling costs tied to the crime.¹⁰ Identity theft cases get an additional category: restitution equal to the value of time the victim spent cleaning up the damage, such as hours on the phone with banks, filing disputes, and correcting credit reports.¹¹ Restitution depends on catching and convicting the thief, and in the many cases where that never happens, recovery runs through banks, insurers, or civil litigation.

1
Federal Trade Commission. Consumer Sentinel Network Data Book 2024
2
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
3
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
4
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
5
Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices
6
United States Sentencing Commission. USSG 2B1.1 – Larceny, Embezzlement, and Other Forms of Theft
7
Office of the Law Revision Counsel. 18 USC 3282 – Offenses Not Capital
8
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
9
Federal Trade Commission. IdentityTheft.gov
10
Department of Justice. Restitution Process
11
Office of the Law Revision Counsel. 18 USC 3663 – Order of Restitution