Is Identity Theft Over State Lines a Federal Crime?

Yes. When identity theft crosses state lines, it is a federal crime under 18 U.S.C. 1028, and federal agencies like the FBI and the Secret Service have authority to investigate the whole scheme rather than leaving two states to coordinate on their own.¹ That doesn’t take state prosecution off the table; both systems can charge the same conduct. What it does mean is that you report the crime through a specific federal pipeline, and the steps below are the ones that actually move your case and protect your credit.

Why Interstate Identity Theft Is Federal

Every state has its own identity theft statute, but state laws run out of reach when the thief is in one state and the victim is in another. Federal law fills that gap. Section 1028 applies whenever the offense is “in or affects interstate or foreign commerce, including the transfer of a document by electronic means.”¹ In practice, almost any online identity theft meets that test, because the internet itself crosses state lines. Using a stolen Social Security number from one state to open a credit card processed in another, or running a phishing scheme through email servers in a third, both satisfy the threshold.

Federal involvement tends to follow the money. Cases with large losses, multiple victims, or ties to organized networks are the ones that draw agent time. Smaller single-victim cases often don’t get individual investigation even when federal jurisdiction clearly exists, but filing a federal complaint still matters because the data feeds pattern analysis that eventually catches larger operations.

What the Thief Faces Under Federal Law

Penalties under 18 U.S.C. 1028 scale with the conduct:

Up to 5 years for general identity fraud offenses not covered by a higher tier.
Up to 15 years for producing or transferring fake government IDs, birth certificates, or driver’s licenses; producing or transferring more than five fraudulent documents; or using stolen identifying information to obtain $1,000 or more in value during any one-year period.
Up to 20 years when the identity theft facilitates drug trafficking or a violent crime, or where the defendant has a prior conviction under the statute.
Up to 30 years when the identity theft facilitates domestic or international terrorism.

All tiers also carry potential fines.¹

A separate statute, 18 U.S.C. 1028A, adds mandatory consecutive prison time when stolen identity information is used during certain federal felonies: two extra years for most qualifying offenses, five extra years for terrorism-related crimes. The judge cannot run that time concurrently with the underlying sentence or shorten the underlying sentence to offset it.² The qualifying felonies list is long and covers mail fraud, wire fraud, bank fraud, theft of government funds, and many others.

Who Investigates

The FBI is the lead federal agency for cyber-enabled identity theft, and its Internet Crime Complaint Center (IC3) is the central intake point. Complaints filed there are routed to FBI field offices and partner agencies nationwide.³ The U.S. Secret Service has its own authority over access device fraud, which covers credit and debit card fraud, and broader identity theft investigations.⁴ Larger cases often draw both, working alongside state and local police.

How to Report It

The order of reporting matters, because each step produces a document the next step uses.

Start at IdentityTheft.gov

The FTC’s portal at IdentityTheft.gov walks you through questions about the theft, generates a personalized recovery plan, and produces an official FTC Identity Theft Report.⁵ That report functions as a sworn statement you can hand to creditors, banks, and credit bureaus to prove the theft occurred. Save it somewhere accessible. You will use it repeatedly.

File a Local Police Report

Local police rarely investigate interstate cases themselves, but a police report creates an official record that creditors and insurers often require before they will remove fraudulent accounts or charges. Bring your FTC Identity Theft Report, photo ID, proof of address, and any evidence you have: fraudulent account statements, collection notices, or similar documents.

File a Complaint With IC3

For any identity theft that touched the internet, file at ic3.gov. The FBI won’t respond to every submission individually, but the data drives pattern work and in some cases allows agents to freeze stolen funds.³

Report SSN Misuse to the SSA

If your Social Security number was compromised, report it to the Social Security Administration’s Office of the Inspector General through their online fraud portal.⁶ The OIG investigates SSN and benefits misuse. You can submit anonymously, though full details help the investigation.

Lock Down Your Credit

Reporting is half the job. The other half is making it hard for the thief to keep opening accounts in your name.

Fraud Alerts

An initial fraud alert lasts one year and requires businesses to take extra verification steps before extending credit. You contact only one of the three major credit bureaus (Equifax, Experian, or TransUnion), and that bureau must notify the other two.⁷

If you have an identity theft report from the FTC or police, you qualify for an extended fraud alert lasting seven years. That alert also removes you from pre-screened credit and insurance offer lists for five years and entitles you to two free credit report copies per year during the first twelve months.⁷ If you have the report, use the longer alert.

Credit Freezes

A freeze goes further. It blocks access to your credit report entirely, so no one can open new accounts in your name. Federal law makes placing and lifting a freeze free, and bureaus must process electronic or phone requests within one business day, three business days for mail.⁷ Unlike fraud alerts, you have to place a freeze at each bureau separately.⁸ Most victims should use both tools: alerts for the verification requirement, a freeze for the hard block.

Blocking Fraudulent Tradelines

You also have a right to demand that credit bureaus remove fraudulent accounts from your file entirely. Under 15 U.S.C. 1681c-2, a bureau must block fraudulent tradelines within four business days of receiving your identity theft report, proof of identity, identification of the fraudulent information, and a statement that the accounts are not yours.⁹ This is stronger than a routine dispute. A block removes the fraudulent entries rather than flagging them as contested.

Contact Your Banks and Card Issuers

If existing accounts were compromised, call the fraud department of each affected institution right away. Ask them to freeze the account, reverse unauthorized charges, and reissue account numbers. For credit cards, federal law caps your liability at $50 for unauthorized charges reported promptly, and most issuers waive that. The liability window for debit cards and bank accounts is tighter, so speed matters more there. Keep a log of every call: representative name, date, case or reference number.

For fraudulent accounts opened at institutions you’ve never done business with, your FTC Identity Theft Report and police report are the tools that close them. Send copies to the fraud department with a letter explaining the situation, by certified mail so you have proof of delivery.

If Your Taxes Were Filed by Someone Else

A common interstate scenario is someone filing a fraudulent federal return with your SSN to claim your refund. The IRS will reject your electronic return or send a duplicate-filing notice. File IRS Form 14039 (Identity Theft Affidavit), preferably online. If you can’t e-file because your SSN was already used, attach Form 14039 to the back of your paper return and mail it to your normal filing address.¹⁰ File only one per incident; duplicates slow processing.

Once the issue is resolved, enroll in the IRS Identity Protection PIN program. Anyone with an SSN or ITIN can enroll by verifying identity through their IRS Online Account. The IP PIN is a six-digit number the IRS issues annually; no return filed under your SSN will be accepted without it.¹¹

If Medical Records Were Involved

Medical identity theft is its own problem because the thief’s health information can get mixed into your records, which risks wrong diagnoses, incorrect medications, or denied insurance claims. Request records from every provider, clinic, hospital, pharmacy, and insurer where your information may have been used, and review for entries that aren’t yours. Report errors in writing with a copy of the record, send everything certified mail, and expect a 30-day response window; providers must also notify others who may hold the same incorrect information.¹²

Restitution if the Thief Is Convicted

If federal prosecutors charge and convict the person who stole your identity, you may be entitled to mandatory restitution. Under 18 U.S.C. 3663A, courts must order restitution for victims of offenses committed by fraud or deceit when identifiable victims have suffered financial losses, and the defendant’s conduct must be both the actual and proximate cause of those losses.¹³ In conspiracy cases, defendants can be jointly and severally liable for all foreseeable losses within the scheme.

Restitution can cover fraudulent charges, fees you paid to repair your credit, lost wages from time spent cleaning up the theft, and similar out-of-pocket expenses. The practical catch is collection: many identity thieves don’t have assets to pay. The order still establishes a legal obligation that follows the defendant and can be enforced through wage garnishment or seizure if they later acquire money.

To position yourself for restitution, document everything from the moment you discover the theft: receipts for credit monitoring, copies of correspondence, records of time taken off work, fees charged by institutions during recovery. Federal prosecutors and victim-witness coordinators use that documentation when asking the court for a restitution order at sentencing.

1
Office of the Law Revision Counsel. 18 U.S.C. 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
2
Office of the Law Revision Counsel. 18 U.S.C. 1028A – Aggravated Identity Theft
3
Internet Crime Complaint Center (IC3). IC3 Home Page
4
U.S. Secret Service. Financial Investigations
5
USAGov. Identity Theft
6
Office of the Inspector General (Social Security Administration). Report Fraud
7
Office of the Law Revision Counsel. 15 U.S.C. 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
8
Federal Trade Commission. Credit Freezes and Fraud Alerts
9
Office of the Law Revision Counsel. 15 U.S.C. 1681c-2 – Block of Information Resulting From Identity Theft
10
Internal Revenue Service. Form 14039 – Identity Theft Affidavit
11
Internal Revenue Service. Frequently Asked Questions About the Identity Protection Personal Identification Number (IP PIN)
12
Federal Trade Commission. What To Know About Medical Identity Theft
13
Office of the Law Revision Counsel. 18 U.S.C. 3663A – Mandatory Restitution to Victims of Certain Offenses