Yes. Identity theft is illegal under federal law and under the laws of every state. The main federal statute, 18 U.S.C. § 1028, makes it a felony to knowingly use, transfer, or possess someone else’s identifying information to commit a crime, with prison sentences running from 5 years for a basic offense up to 30 years when the theft is tied to terrorism. Fines reach $250,000 for an individual, and courts can order the offender to pay victims back on top of that. The Federal Trade Commission received more than 1.1 million identity theft reports in 2024.1Federal Trade Commission. New FTC Data Show a Big Jump in Reported Losses to Fraud
What Federal Law Treats as Identity Theft
Under 18 U.S.C. § 1028, the crime has two parts. A person has to use, transfer, or possess another person’s identifying information without legal authority, and they have to do it intending to commit a federal crime or a state felony.2Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information The intent element is what separates a criminal act from a clerical mistake.
The statute’s definition of “means of identification” is wide. It covers the obvious — name, Social Security number, date of birth, driver’s license number — and it also reaches biometric data such as fingerprints and retinal scans, electronic identification numbers, routing codes, and telecommunications access devices.2Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information Any data point that can identify a specific person, alone or in combination, counts.
Common examples that satisfy the statute include using a relative’s credit card without permission, applying for a loan using a child’s Social Security number, and opening an account with someone else’s driver’s license information. Building a synthetic identity by blending a real Social Security number with made-up details is also covered. Possessing tools built to steal identities, such as card skimmers or credential-harvesting software, can be charged on its own, before any victim loses money.
Federal jurisdiction kicks in when the offense touches interstate or foreign commerce, which includes essentially any online transaction, or when stolen information moves through the mail.3Federal Trade Commission. Identity Theft and Assumption Deterrence Act That reach means most modern identity theft cases can be prosecuted federally. In practice, the FBI and the Department of Justice’s Fraud Section take the larger multi-state schemes, and smaller cases go to state and local prosecutors.
Federal Prison Time and Fines
Sentencing under § 1028 is tiered. The maximum depends on what the defendant did with the stolen information and whether other serious crimes were in the mix.
- Up to 5 years in prison for a basic offense using someone else’s identifying information to commit a federal crime or state felony.4Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
- Up to 15 years when the offender obtains anything of value totaling $1,000 or more during any one-year period.4Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
- Up to 20 years when the theft furthers drug trafficking, is connected to a violent crime, or follows a prior identity fraud conviction.2Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
- Up to 30 years when the offense facilitates domestic or international terrorism.2Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
Fines for an individual defendant can reach $250,000, and courts impose them in addition to prison time rather than instead of it.5Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine A judge can also order forfeiture of property used to commit the offense.
The Extra Two Years for Aggravated Identity Theft
A separate statute, 18 U.S.C. § 1028A, applies when identity theft happens during the commission of certain other federal felonies, including mail fraud, wire fraud, bank fraud, and immigration offenses. A conviction adds a mandatory two years in prison on top of whatever sentence the court imposes for the underlying crime. The add-on rises to five years if the identity theft was committed during a terrorism-related felony.6Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
Three features make this charge especially punishing. The additional time runs consecutively, so it is served after the sentence for the underlying felony, not alongside it. The court cannot grant probation. And it cannot trim the underlying sentence to offset the add-on.6Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft A defendant facing a seven-year bank fraud sentence plus aggravated identity theft serves at least nine years.
Related Federal Charges That Often Come With It
Social Security Number Misuse
Misusing a Social Security number is a separate felony under 42 U.S.C. § 408. The statute covers falsely representing a number as a valid SSN, using a number obtained through false information, and counterfeiting or selling Social Security cards. The maximum is five years in prison, rising to ten years when the offender holds a position of trust such as a Social Security Administration employee, a benefits representative, or a health care provider submitting medical evidence.7Office of the Law Revision Counsel. 42 USC 408 – Penalties
Computer Intrusion
When identity thieves get the data by hacking, prosecutors can add charges under 18 U.S.C. § 1030, the Computer Fraud and Abuse Act. The law prohibits intentionally accessing a computer without authorization to obtain financial records, consumer reporting agency files, or information from any federal agency, and it targets anyone who accesses a protected computer with intent to defraud and obtains anything of value.8Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers This charge frequently rides alongside identity theft counts in data breach cases.
Paying Victims Back
Because identity theft is an offense against property committed by fraud, mandatory restitution provisions apply.9GovInfo. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes Courts can order the defendant to repay the value of property lost or damaged, the cost of professional services needed for recovery, and related expenses such as lost income. The Identity Theft Enforcement and Restitution Act of 2008 expanded restitution to include the value of the time the victim spent cleaning up the damage, including hours spent disputing fraudulent accounts, correcting credit reports, and dealing with debt collectors. Restitution runs to the victim and is separate from any fine paid to the government.
How Long Prosecutors Have to Charge
Federal prosecutors generally have five years from the date of the offense to bring identity theft charges, which is the standard federal limitations period for most non-capital crimes.10United States Department of Justice. Criminal Resource Manual 650 – Length of Limitations Period Identity theft often rides inside a larger scheme such as mail or bank fraud, and some of those related offenses carry longer windows, so a case discovered years late can sometimes still be charged under a related statute.
State Identity Theft Laws
Every state has its own identity theft statute, and state prosecutors can bring charges on their own without waiting for federal action. The same conduct can expose a defendant to both state and federal prosecution, though as a practical matter smaller cases stay local and large or multi-state schemes draw federal attention.
State laws usually tier the offense by the dollar amount stolen. Felony thresholds vary: some states treat any identity theft as a felony, others set the line at a few hundred dollars of loss. Penalties range from misdemeanor fines and probation at the low end to multi-year state prison sentences for large-scale fraud. The specific charges depend on where the crime happened.
If You Are the Victim
Federal law gives identity theft victims specific rights, independent of whether a prosecutor ever charges the offender. Under the Fair Credit Reporting Act, you can place an initial fraud alert on your credit file for at least one year based on a good-faith suspicion, and the credit bureau you contact must notify the other two. Filing a formal identity theft report lets you request an extended alert that lasts seven years.11Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
You also have the right to a free security freeze, which blocks credit bureaus from releasing your credit report to anyone you have not authorized. Bureaus must place the freeze within one business day for phone or online requests and within three business days for mail requests.12Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts The FCRA additionally lets you demand that credit bureaus block fraudulent accounts and debts from your report once you provide proof of identity and an identity theft report; after a block, the creditor cannot transfer the fraudulent debt to collections.
The federal reporting hub is IdentityTheft.gov, run by the FTC. The site generates a personalized recovery plan and produces an Identity Theft Report you can use to assert your rights with creditors and credit bureaus.13IdentityTheft.gov. What To Do Right Away Filing a police report alongside the FTC report is often useful because some creditors and insurers require one.