Opening a credit card in someone else’s name without their permission is identity theft, and it exposes the person who does it to felony charges at both the federal and state level, civil lawsuits from the card issuer and the victim, and a court order to pay back every dollar charged. Under the federal identity fraud statute alone, the maximum sentence reaches 15 years in prison.1Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents Additional charges almost always stack on top of that, and the sentences can run consecutively.
The Criminal Charges That Apply
A single fraudulent application rarely produces a single charge. Filling out a credit card application requires another person’s name, Social Security number, and date of birth, and using any of that information without permission satisfies the federal identity fraud statute at 18 U.S.C. § 1028.1Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents That’s the baseline charge.
What gets added depends on how the fraud was carried out. Submitting the application online or by phone can be prosecuted as wire fraud under 18 U.S.C. § 1343, because the scheme traveled through electronic communications.2Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television If the card, statements, or any other document connected to the fraud moved through the mail or a commercial carrier, that opens mail fraud under 18 U.S.C. § 1341.3Office of the Law Revision Counsel. 18 USC 1341 – Frauds and Swindles Actually using the card to buy anything triggers access device fraud under 18 U.S.C. § 1029, which treats the card number as an “access device” and criminalizes its unauthorized use.4Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices
Federal prosecutors typically step in when the fraud crosses state lines or causes significant financial harm. Every state also has its own identity theft and fraud statutes, so state charges can be filed independently or alongside a federal case.
How Much Prison Time and What Fines
Each charge carries its own maximum, and a judge can impose sentences for multiple counts.
- Identity fraud (18 U.S.C. § 1028): Up to 15 years in prison when the perpetrator obtains $1,000 or more in value within a year, which nearly any credit card fraud will reach. For smaller-scale offenses, the maximum drops to five years. A prior conviction under the same statute raises the ceiling to 20 years.1Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents
- Wire fraud (18 U.S.C. § 1343): Up to 20 years in prison. When the fraud affects a financial institution, which credit card fraud inherently does, the maximum rises to 30 years and fines up to $1 million.2Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
- Mail fraud (18 U.S.C. § 1341): Same structure as wire fraud. Up to 20 years normally, up to 30 years and $1 million in fines when a financial institution is affected.3Office of the Law Revision Counsel. 18 USC 1341 – Frauds and Swindles
- Access device fraud (18 U.S.C. § 1029): Up to 10 or 15 years depending on the specific violation, and up to 20 years for a repeat offender.4Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices
The Mandatory Two Years for Aggravated Identity Theft
Federal prosecutors also have the option to charge aggravated identity theft under 18 U.S.C. § 1028A whenever someone uses another person’s identifying information during one of the underlying felonies above. The statute carries a mandatory minimum of two additional years in prison, and those two years must be served after the sentence for the underlying felony. They cannot run concurrently, and courts are barred from substituting probation.5Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft This gives prosecutors significant leverage in plea negotiations, because any conviction guarantees at least two years of added prison time with no judicial discretion to reduce it.
Restitution Is Mandatory
Beyond prison time and fines, federal sentencing law requires courts to order restitution in fraud cases. The offender must repay the full financial loss, every dollar charged on the fraudulent account, to the card issuer or the victim.6Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes Courts also commonly impose a period of supervised release after prison, with strict conditions and regular check-ins.
State Penalties Vary
State consequences range widely. For low-dollar fraud, some states treat identity theft as a misdemeanor carrying up to a year in jail and modest fines. Once the amount crosses a threshold, commonly around $1,000 to $2,000 depending on the state, the charge typically escalates to a felony with multi-year prison sentences. The same conduct can be a misdemeanor in one state and a felony carrying up to 20 years in another.
Civil Lawsuits on Top of the Criminal Case
Criminal prosecution is not the only exposure. Anyone who suffered financial harm can sue in civil court, and a civil judgment is completely separate from any criminal sentence. It does not go away if the offender serves prison time.
The card issuer will go after the full unpaid balance plus interest, fees, and collection costs. From its perspective this is straightforward debt recovery. It extended credit based on fraudulent information and wants its money back. A judgment opens the door to wage garnishment, bank levies, and liens on property.
The victim whose identity was stolen has an independent right to sue. Those claims can seek repayment for out-of-pocket costs like credit monitoring, legal fees, and time off work, plus compensation for emotional distress. Because identity theft is intentional, victims can also pursue punitive damages, which are extra money awarded specifically to punish especially harmful conduct. Courts require proof that the defendant knowingly proceeded with conduct likely to cause injury, and they weigh the reprehensibility of the behavior when setting the amount.7Cornell Law School Legal Information Institute. Punitive Damages
When the Perpetrator Is a Family Member
An estimated 30 percent of identity theft is committed by someone the victim knows, often a parent, child, sibling, or spouse. The legal consequences are identical regardless of the relationship. Using a family member’s Social Security number to open a credit card is the same federal crime whether a stranger does it or a parent does it to a child.
What changes in family cases is the practical reality of prosecution. Victims are often reluctant to file a police report against a relative, and without that report, investigations rarely progress. Choosing not to report has a cost of its own. Without a police report or an FTC identity theft report, the victim loses access to credit report blocking, extended fraud alerts, and other protections that require documentation of the theft, and the credit damage simply sits there. For parents who discover that a relative opened accounts in a child’s name, acting quickly matters. Fraudulent accounts that go undetected for years are harder to clean up and can leave a young person with wrecked credit before they ever apply for anything on their own.
What Is Actually Legal
Sharing access to a credit card is not inherently illegal. The line is consent. A primary cardholder can add someone as an authorized user, who receives their own card linked to the account and can make purchases, though the authorized user is generally not contractually liable for the debt.8Consumer Financial Protection Bureau. Regulation B 1002.7 – Rules Concerning Extensions of Credit Two people can also apply together as co-borrowers on a joint account, with both submitting their own information and both equally responsible for every charge. And someone holding a valid durable power of attorney with the right financial language may be able to open or manage accounts on behalf of the person who granted it, subject to the bank’s own requirements.
The common thread across all of these arrangements is that the person whose name is on the account knew about it and agreed to it. When someone’s identity is used to open a credit line without their knowledge, no legal structure shields the person who did it from the charges, the restitution order, and the civil judgments that follow.