A “means of identification” under federal law is any name or number that can identify a specific person, either on its own or combined with other information. The definition sits in 18 U.S.C. § 1028(d)(7) and reaches from Social Security numbers and driver’s license numbers to fingerprints, iris scans, and the electronic serial number inside your phone.1Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information The breadth is deliberate. It is the backbone definition for federal identity-crime prosecutions, and anything that can single you out tends to fall inside it.
The Four Categories the Statute Covers
Section 1028 sorts qualifying identifiers into four groups.
The first is standard personal data: your name, Social Security number, date of birth, driver’s license or state ID number, alien registration number, government passport number, and employer or taxpayer identification number.1Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information Social Security numbers do the heaviest lifting here because they’re unique to one person for life and used across tax, employment, and benefit records, which is also why they’re the single most valuable item in an identity thief’s hands. Driver’s license and state ID numbers carry similar weight because motor vehicle agencies verify identity with documents and photographs before issuing them. Employer and taxpayer identification numbers belong on the list too; sole proprietors and certain tax filers use them as personal identifiers, so misusing a business’s EIN to impersonate its owner fits inside the statute.
The second category is unique biometric data: fingerprints, voice prints, retina or iris images, and other unique physical representations of a person. Biometrics differ from the rest in a way that matters after a breach. You cannot get a new fingerprint if yours is compromised, and the permanence raises the stakes of any exposure.
The third category covers unique electronic identification numbers, addresses, and routing codes. This is where the statute reaches cellular device identifiers, network addresses, and the hardware-level markers that let systems recognize a specific device or account.
The fourth category pulls in telecommunication identifying information and access devices as defined by the companion fraud statute, 18 U.S.C. § 1029. That statute defines an access device as any card, code, account number, electronic serial number, PIN, or other means of account access that can be used to obtain money, goods, services, or anything of value, or to initiate a transfer of funds.2Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices Credit card numbers, debit card numbers, bank account numbers, PINs, and routing codes all qualify. The definition hinges on function, not form; if something can unlock access to funds or value, it’s an access device whether or not it looks like a traditional card.
Why Combinations Count
The phrase “alone or in conjunction with any other information” is what gives the definition its reach. Your first name standing by itself probably won’t identify you out of a crowd of people with the same one. Your name plus your date of birth, or your name plus your zip code, often will. The statute treats those combinations as a means of identification too. That is why data breaches exposing fields that look harmless in isolation still draw federal attention — the government looks at whether the exposed pieces can be fitted together to point at one person.
What Misuse Costs Under Federal Law
Section 1028(a) criminalizes several categories of conduct involving these identifiers, including producing false identification documents, transferring stolen or fraudulently made IDs, possessing five or more fake IDs with intent to use or transfer them, and using another person’s means of identification in connection with any federal crime or state felony.3Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information The prison exposure scales with what the conduct was tied to:
- Up to 15 years for producing or transferring a fake U.S. identification document, birth certificate, or driver’s license; producing or transferring more than five false IDs; or using someone’s identity to obtain $1,000 or more in value during any one-year period.
- Up to 5 years for most other production, transfer, or use of false identification documents or someone else’s means of identification.
- Up to 20 years for any identity offense committed to facilitate drug trafficking or a violent crime, or committed after a prior conviction under the same statute.
- Up to 30 years for any identity offense committed to facilitate domestic or international terrorism.
Fines run up to $250,000 for individuals under the general federal sentencing statute.4Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine Conviction also triggers forfeiture of personal property used in the offense and of any illicit identification documents or means of identification involved.3Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information Possessing fifteen or more counterfeit or unauthorized access devices under § 1029 is its own federal crime carrying up to ten years for a first offense.2Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices
Aggravated Identity Theft Adds Mandatory Time
The Identity Theft Penalty Enhancement Act created a separate offense at 18 U.S.C. § 1028A.5GovInfo. 118 Stat. 831 – Identity Theft Penalty Enhancement Act Using someone else’s means of identification during and in relation to certain felonies — bank fraud, wire fraud, mail fraud, immigration fraud, theft of government property, and false statements in connection with firearms, among others — adds a mandatory two-year prison sentence on top of whatever the underlying offense carries.6Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
That two-year sentence runs consecutively, not concurrently. Courts cannot reduce the sentence for the predicate felony to compensate, and probation is off the table. If the identity theft was tied to terrorism, the mandatory add-on jumps to five years.6Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft Prosecutors routinely stack § 1028A on top of a fraud charge, and the mandatory consecutive structure strips judges of discretion to soften the result.
What To Do if Your Identifiers Are Compromised
If someone has used your personal information without authorization, acting quickly limits the damage because identity thieves tend to escalate once they’re inside.
File an Identity Theft Report
The Federal Trade Commission runs IdentityTheft.gov, where you can report online or by calling 1-877-438-4338. The site generates a formal Identity Theft Report and a personalized recovery plan based on what happened. If you don’t create an account on the site, print and save both documents immediately because you won’t be able to access them later.7Federal Trade Commission. IdentityTheft.gov – Steps Creditors and credit bureaus may require that Identity Theft Report before they will remove fraudulent accounts or charges.
If your Social Security number was stolen, the Social Security Administration directs you to the same FTC reporting process rather than handling it internally.8Social Security Administration. Report Stolen Social Security Number There is no separate SSA complaint form for identity theft.
Handle Tax-Related Identity Theft Separately
When someone uses your SSN or ITIN to file a fraudulent return, the IRS has its own process. File Form 14039 (Identity Theft Affidavit) if you know or suspect someone filed a federal return using your information, if you or a dependent was fraudulently claimed, or if your SSN was misused for employment. The form can be submitted online, by fax, or by mail.9Internal Revenue Service. Identity Theft Affidavit (Form 14039) Don’t file it for identity theft unrelated to taxes; the FTC process covers those.
To prevent future tax fraud, the IRS offers an Identity Protection PIN. It’s a six-digit number assigned to your account each year that must appear on your federal return before the IRS will process it. Anyone with an SSN or ITIN can enroll, either online through an IRS account, by submitting Form 15227 if adjusted gross income is below $84,000 (or $168,000 for joint filers), or by visiting a Taxpayer Assistance Center in person.10Internal Revenue Service. Get an Identity Protection PIN (IP PIN) A thief who doesn’t have the current year’s PIN cannot file a return in your name.
Freeze Your Credit
Federal law gives every consumer the right to place a security freeze on their credit reports at no cost. A freeze prevents the credit bureaus from releasing your report to potential lenders, which effectively blocks anyone from opening new credit accounts using your information. You have to contact each of the three major bureaus separately. The freeze stays in place until you lift it, and you can temporarily thaw it when you need to apply for credit yourself. The inconvenience is minor compared with the damage an open credit file can sustain after a breach.