What Are the Federal Identity Theft Laws and Statutes?

Federal identity theft laws are a group of criminal statutes and consumer protection rules that together punish identity thieves and help victims recover. On the criminal side, 18 U.S.C. §§ 1028, 1028A, 1029, 1030, 1341, and 1343 cover everything from faking a driver’s license to hacking a database to running a phishing scheme, with prison terms ranging from one year up to thirty. On the civil side, the Fair Credit Reporting Act, the mandatory restitution statute, and the FTC’s reporting system give victims concrete tools to block fraudulent accounts, freeze their credit, and claim their losses back.

The Core Identity Fraud Statute

18 U.S.C. § 1028 is the main federal identity theft law. It criminalizes producing, transferring, possessing, or using fake or stolen identification documents and personal information to commit any unlawful activity.¹ Possessing five or more stolen or counterfeit IDs with intent to use them unlawfully is itself a federal crime, even if no fraud ever gets completed.

The statute’s definition of a “means of identification” is wide. It reaches names, Social Security numbers, dates of birth, driver’s license and passport numbers, taxpayer and alien registration numbers, fingerprints, voiceprints, retina and iris images, electronic identifiers, telecommunications identifiers, and access devices.¹ If a piece of data can identify you, misusing it can support a § 1028 charge.

Prison exposure under § 1028 scales with what the offender did:

Up to 5 years for general production, transfer, or use of fake or stolen identification.
Up to 15 years for producing a counterfeit government ID, birth certificate, or driver’s license; producing or transferring five or more identification documents; or using stolen identification to obtain $1,000 or more within one year.
Up to 20 years when the offense facilitates drug trafficking or a violent crime, or when the defendant has a prior conviction under the same statute.
Up to 30 years when the offense facilitates domestic or international terrorism.¹

Fines follow the general federal felony schedule and can reach $250,000.²

Aggravated Identity Theft

18 U.S.C. § 1028A is the statute that drives real prison time in most federal identity theft prosecutions. When someone uses another person’s identifying information while committing one of a listed set of other federal felonies, the court must add two years to the sentence for that underlying crime. The two years cannot be reduced, cannot run concurrently, and cannot be replaced with probation.³ If the underlying crime is terrorism-related, the mandatory add-on is five years.

The predicate felonies that trigger § 1028A include most Chapter 47 fraud offenses, all Chapter 63 mail and wire fraud charges, theft of public money, theft from employee benefit plans, false personation of citizenship, false statements to acquire a firearm, passport and visa fraud, Social Security and Medicare fraud, and obtaining customer information from a financial institution by false pretenses.³ Because mail and wire fraud appear on that list, prosecutors can pair § 1028A with almost any modern identity theft scheme and lock in the mandatory add-on even if the main charge is pled down.

Access Device Fraud

Stolen credit cards, cloned debit cards, intercepted PINs, pirated account numbers, and stolen electronic serial numbers fall under 18 U.S.C. § 1029. The statute defines an “access device” as any card, code, account number, or instrument that can obtain money, goods, or services or initiate a transfer of funds.⁴

Two thresholds come up most often. Using unauthorized access devices to obtain $1,000 or more in value within one year is a federal crime. So is simply possessing 15 or more counterfeit or unauthorized access devices, which lets investigators charge people caught with batches of stolen card numbers before any loss has occurred.⁴

First-time maximums reach 10 years for the production, use, trafficking, or 15-device possession offenses, and 15 years for using devices with intent to defraud, trafficking in device-making equipment, and certain telecommunications fraud offenses. Any repeat conviction under § 1029 is capped at 20 years.⁴

Mail and Wire Fraud

Two of the most commonly charged offenses in identity theft cases are not identity-theft-specific. Mail fraud under 18 U.S.C. § 1341 covers any fraud scheme that uses the postal system or a private interstate carrier. Wire fraud under 18 U.S.C. § 1343 covers any fraud scheme that uses interstate electronic communications: phone calls, emails, texts, or internet transmissions.⁵ A single phishing email can satisfy the jurisdictional element of wire fraud.

The elements are straightforward: a scheme to defraud plus a use of the mails or wires. Each mailing or transmission counts as a separate offense, so an operation involving dozens of emails can produce dozens of counts. Each count carries up to 20 years. When the scheme affects a financial institution, the maximum rises to 30 years and the fine ceiling to $1,000,000.⁶⁵ Both charges are also predicate felonies for aggravated identity theft, so prosecutors routinely stack them with § 1028A.

The Computer Fraud and Abuse Act

Identity theft often begins with a data breach, and the Computer Fraud and Abuse Act (18 U.S.C. § 1030) is the primary tool for prosecuting the intrusion itself. It covers accessing a protected computer without authorization, or exceeding authorized access, to steal information, commit fraud, or cause damage. A “protected computer” includes any computer connected to the internet.⁷

Penalties depend on the type of intrusion:

Up to 1 year for basic unauthorized access to obtain information, without aggravating factors.
Up to 5 years for access for commercial advantage or financial gain, access in furtherance of another crime, access to a nonpublic government computer, or intentional damage through reckless conduct. The 5-year tier also applies when the value of stolen information exceeds $5,000.
Up to 10 years for accessing restricted national security information or intentionally causing damage through malicious code.

Repeat offenders face doubled maximums under most tiers, reaching up to 20 years.⁷ CFAA charges are regularly paired with identity theft and access device charges when a hacker steals personal data and then uses or sells it.

Mandatory Restitution to Victims

Federal law requires courts to order restitution in any case involving a property offense committed through fraud or deceit, as long as there is an identifiable victim with a financial loss. 18 U.S.C. § 3663A removes the judge’s discretion: the order must be entered.⁸

For stolen or destroyed property, the defendant must return it or pay its value. Victims can also recover lost income caused by the crime and expenses tied to participating in the investigation and prosecution, including child care, transportation, and related costs. Expenses incurred by a victim’s legal guardian or estate representative are also recoverable.⁸ Collection is often the harder part, since many defendants lack assets, but the order follows them indefinitely and can be enforced through wage garnishment and asset seizure.

Victim Rights Under Federal Law

Alongside the criminal statutes, federal law gives identity theft victims specific tools to limit damage and rebuild their financial identity.

Blocking Fraudulent Credit Report Entries

The Fair Credit Reporting Act lets you force credit reporting agencies to block information on your credit report that resulted from identity theft. You have to send the agency proof of identity, a copy of an identity theft report, identification of the specific fraudulent entries, and a statement that those entries do not relate to transactions you made. The agency must put the block in place within four business days of receiving your documentation and must notify the company that reported the information.⁹

An agency can decline or lift a block only if it decides the request was based on a material misrepresentation, was made in error, or you actually received the goods or money from the disputed transaction.⁹

Free Credit Freezes

A credit freeze blocks new creditors from pulling your credit report, which stops most attempts to open fraudulent accounts in your name. Since 2018, federal law has required all three major credit reporting agencies to provide freezes and unfreezes free of charge to every consumer.¹⁰ A freeze does not affect your credit score, and you can lift it temporarily when you need to apply for legitimate credit.

Filing an Identity Theft Report

The Federal Trade Commission runs IdentityTheft.gov as the federal government’s central reporting and recovery resource.¹¹ Filing there generates a personalized recovery plan and produces the identity theft report you need to request credit blocks, dispute fraudulent accounts, and exercise other victim rights.

Tax-Related Identity Theft

Tax refund fraud, where a thief uses your Social Security number to file a return and claim your refund, has its own process. If the IRS flags a suspicious return filed under your name, it will send a letter asking you to verify your identity before any refund is issued.¹²

If you discover the problem first, file Form 14039 (Identity Theft Affidavit) with a paper return. The IRS warns against submitting duplicates or calling for status updates, which slow resolution. Confirmed victims are placed in the Identity Protection PIN program and issued a new six-digit PIN each year that must appear on all future federal returns.¹³

You do not need to be a confirmed victim to get an IP PIN. Any taxpayer with a Social Security number or individual taxpayer identification number can enroll through the IRS website, and parents or legal guardians can request PINs for dependents. The PIN changes annually and is generally available in your IRS online account starting in mid-January. A missing or incorrect PIN will cause an electronic return to be rejected or a paper return to be delayed.¹³

1
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information
2
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
3
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
4
Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection with Access Devices
5
Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
6
Office of the Law Revision Counsel. 18 USC 1341 – Frauds and Swindles
7
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
8
Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes
9
Office of the Law Revision Counsel. 15 USC 1681c-2 – Block of Information Resulting from Identity Theft
10
U.S. Congress. S.2155 – Economic Growth, Regulatory Relief, and Consumer Protection Act
11
Federal Trade Commission. Report Identity Theft
12
Internal Revenue Service. How IRS ID Theft Victim Assistance Works
13
Internal Revenue Service. Get an Identity Protection PIN