What Is Access Device Fraud? Penalties, Sentencing, and Defenses

Access device fraud is a federal crime under 18 U.S.C. § 1029 that covers using, making, trafficking in, or possessing tools that can reach someone’s money or accounts without permission. Those tools can be physical (a cloned debit card, a card skimmer) or digital (a stolen account number, a PIN, a one-time passcode). A first offense carries up to 10 or 15 years in federal prison depending on the specific conduct, plus fines, forfeiture, and restitution. A second conviction under the same statute pushes the ceiling to 20 years.¹

What Counts as an Access Device

Federal law defines “access device” broadly. It includes any instrument or piece of data that can be used, alone or with something else, to obtain money, goods, services, or anything else of value, or to start a transfer of funds. Credit and debit card numbers, account numbers, PINs, electronic serial numbers, and mobile identification numbers all qualify. So do telecommunications equipment identifiers and “any other means of account access,” a catch-all that pulls in digital login credentials, one-time passcodes, and authentication tokens. The only carve-out is for transfers initiated solely by paper instruments like handwritten checks.²

Two related terms shape how charges are brought. A counterfeit access device is one that is forged, fictitious, altered, cloned, or an identifiable component of such a device. An unauthorized access device is a real one that has been lost, stolen, expired, revoked, canceled, or obtained through fraud. The statute also defines device-making equipment: any tool primarily designed to create access devices or counterfeits, such as a card embosser or skimming hardware.¹

Conduct the Statute Reaches

Section 1029 lists ten categories of prohibited conduct, each targeting a different stage of the fraud chain. The most commonly charged are:

Producing, using, or trafficking in counterfeit access devices with intent to defraud.
Using or trafficking in unauthorized (stolen, lost, revoked, or fraudulently obtained) devices when the value obtained reaches $1,000 or more in any one-year period.
Possessing 15 or more counterfeit or unauthorized access devices with intent to defraud. Prosecutors do not have to prove you used any of them; the possession alone is the offense.
Using a device issued to someone else to obtain $1,000 or more in value within a one-year period.
Producing, trafficking in, or possessing device-making equipment, including skimmers, embossers, and cloning software.
Possessing or using scanning receivers or modified telecommunications instruments to intercept communications or obtain unauthorized service.
Soliciting someone to sell an access device or application information without the issuer’s authorization.
Arranging to present fraudulent transaction records to a credit card system member.

Every one of these offenses requires knowledge, and most require intent to defraud. All must also affect interstate or foreign commerce.³

What Prosecutors Must Prove

Two elements decide whether conduct falls under § 1029: a culpable mental state and a connection to interstate commerce.

Nearly every subsection requires that you acted “knowingly and with intent to defraud.” That means prosecutors have to show you deliberately set out to deceive someone for financial gain, not that you made a mistake or acted carelessly. Intent is usually proven circumstantially: the number of devices found, patterns in transactions, communications with co-conspirators, use of fake identities, or steps taken to hide the activity.

The commerce element is a low bar in practice. Modern payment transactions move through electronic banking networks, processors, and servers in multiple states, so almost any use of a card or account number touches interstate commerce. Transmitting stolen card data over the internet or by text message is enough.³

Prison Time and Fines

Statutory maximums under § 1029 fall into two tiers for a first offense.

Up to 10 years applies to counterfeiting access devices, using unauthorized devices, possessing 15 or more devices, soliciting device applications, modifying telecom instruments, and presenting fraudulent transaction records.

Up to 15 years applies to possessing device-making equipment, using another person’s access device for $1,000 or more, possessing scanning receivers, and possessing telecom-altering hardware or software.

A second conviction under any subsection of § 1029 raises the maximum to 20 years, regardless of which specific offense is charged the second time.¹

Fines are set by the general federal felony fine statute: up to $250,000 for an individual and up to $500,000 for an organization.⁴

How Loss Amount Drives the Actual Sentence

The statutory maximum is the ceiling. The sentence you actually face is driven by the U.S. Sentencing Guidelines, where the total dollar loss added to the base offense level does most of the work. Under Guideline § 2B1.1, the loss ladder increases your offense level in steps:

$6,500 or less: no increase.
More than $6,500: +2 levels.
More than $40,000: +6 levels.
More than $150,000: +10 levels.
More than $1,500,000: +16 levels.
More than $9,500,000: +20 levels.

The scale keeps climbing through losses above $550 million.⁵

For access device cases specifically, the guidelines set a floor of $500 per unauthorized device, even when actual charges came in lower. For telecom-related access devices that were possessed but never used, the floor is $100 per device. Someone caught with 50 stolen card numbers starts with a presumed loss of at least $25,000 before investigators even tally actual spending.⁵

Other enhancements come from using sophisticated means (encryption, tunneling, or layered account structures to hide the activity), a large number of victims, or abusing a position of trust at a financial institution.

Forfeiture, Restitution, and Supervised Release

Every conviction under § 1029 triggers mandatory forfeiture of personal property used or intended to be used in the offense. That reaches computers, phones, card readers, specialized software, and any assets purchased with the stolen funds.⁶

Restitution is also typically ordered. Under the Mandatory Victims Restitution Act, restitution is required for Title 18 fraud offenses with an identifiable victim who suffered a financial loss, meaning you can be ordered to repay banks, cardholders, and other victims in full.⁷

After prison, most defendants face supervised release. The maximum term depends on how the offense is graded: most § 1029 offenses are Class C or Class D felonies with up to three years of supervised release, while the more serious subsections carrying a 15-year statutory maximum may be Class B felonies, allowing up to five years. During that time you must avoid new crimes, comply with any restitution order, and follow conditions set by the court.⁸

The Identity Theft Add-On

Access device fraud almost always involves someone else’s personal information, which exposes defendants to a separate charge under 18 U.S.C. § 1028A: aggravated identity theft. If you use another person’s identifying information during an access device fraud offense, you face a mandatory additional two years in prison. In terrorism-related offenses, the add-on is five years.⁹

Three features make this charge particularly damaging. The time runs consecutively, stacking on top of whatever sentence you receive for the underlying fraud rather than running alongside it. The court cannot shave down the fraud sentence to compensate. And probation is unavailable; a conviction means prison.⁹

Statute of Limitations

Section 1029 does not have its own limitations period, so the general federal statute applies: five years from the date the offense was committed.¹⁰

For an ongoing scheme, the clock may not start until the last fraudulent act. And because the clock runs from when the crime happened rather than when it was discovered, late-detected fraud can still fall inside the window years after the original transactions.

Defenses That Work Against These Charges

Because every § 1029 offense requires knowledge, and most require intent to defraud, the strongest defenses attack those mental states.

No intent to defraud. You believed you had permission to use the device, or you used the wrong card by mistake. If the government cannot prove you set out to deceive someone for gain, the charge fails.

Lack of knowledge. You did not know the device was counterfeit, stolen, or unauthorized. Someone handed you a card and said it was theirs; you had no reason to think otherwise.

Authorization. The cardholder or issuer gave you legitimate permission for the transaction in question.

No interstate commerce connection. Available in theory, rarely successful. The way modern payment networks route transactions means almost any card-based activity crosses state lines electronically.

A conviction also carries consequences beyond the sentence. A federal fraud record can disqualify you from work in financial services, government positions, and roles that require a security clearance or professional licensing. Those collateral effects often outlast the prison term, the restitution, and the supervised release combined.

1
Office of the Law Revision Counsel. 18 U.S. Code 1029 – Fraud and Related Activity in Connection With Access Devices
2
Office of the Law Revision Counsel. 18 USC 1029 Fraud and Related Activity in Connection With Access Devices
3
Office of the Law Revision Counsel. 18 USC 1029 Fraud and Related Activity in Connection With Access Devices
4
Office of the Law Revision Counsel. 18 U.S. Code 3571 – Sentence of Fine
5
United States Sentencing Commission. USSG 2B1.1 Larceny, Embezzlement, and Other Forms of Theft
6
Office of the Law Revision Counsel. 18 USC 1029 Fraud and Related Activity in Connection With Access Devices
7
Office of the Law Revision Counsel. 18 U.S. Code 3663A – Mandatory Restitution to Victims of Certain Crimes
8
Office of the Law Revision Counsel. 18 U.S. Code 3583 – Inclusion of a Term of Supervised Release After Imprisonment
9
Office of the Law Revision Counsel. 18 USC 1028A Aggravated Identity Theft
10
Office of the Law Revision Counsel. 18 U.S. Code 3282 – Offenses Not Capital