What Is Fraudulent Use or Possession of Identifying Info?

Fraudulent use or possession of identifying information is a crime, under federal law and in every state, that covers knowingly having or using another person’s identifying data without permission in order to commit or help commit an unlawful act. Federal penalties run from 5 years in prison at the low end to 30 years when terrorism is involved, and a separate federal provision tacks a mandatory two extra years onto certain related felonies. State charges can stack on top of the federal case without triggering double jeopardy.

What Counts as Identifying Information

The federal definition under 18 U.S.C. §1028 is wider than most people assume. “Means of identification” includes any name or number that can single out a specific person, alone or in combination with other data. The obvious items are there: Social Security numbers, dates of birth, driver’s license numbers, passport numbers, and taxpayer identification numbers.¹

Several categories go beyond that. Biometric data counts: fingerprints, voiceprints, retina and iris images. So does any unique electronic identification number, address, or routing code, which pulls in email addresses, IP addresses, and online account credentials. Telecommunications access devices such as phone numbers and SIM identifiers are also covered.¹

Because the definition is this broad, a case doesn’t require a stolen Social Security card or a forged driver’s license. Using someone’s email login to reach their financial accounts, or holding onto a cache of biometric records you had no right to have, can trigger the same statute.

What the Government Has to Prove

Section 1028 criminalizes several distinct acts: producing or transferring false identification documents, possessing document-making equipment with intent to use it illegally, and knowingly transferring, possessing, or using another person’s identifying information without lawful authority to commit or facilitate any federal crime or state felony.¹

Intent is the element that separates a crime from an innocent accident. A person who happens to have a coworker’s Social Security number written on a sticky note isn’t a criminal. The government has to prove the defendant acted “with the intent to commit, or to aid or abet, or in connection with” an unlawful activity. Prosecutors typically build intent through circumstantial evidence: possessing identifying data for multiple unrelated people, making purchases or applications using stolen credentials, or showing a pattern of accessing accounts the defendant had no reason to touch.

Attempting or conspiring to commit identity fraud carries the same penalties as the completed offense. Two people who agree to run a scheme and take even a preliminary step toward executing it face the full weight of the statute, whether or not they ever succeed in defrauding anyone.¹

Federal Prison Terms

There isn’t one penalty. Section 1028(b) splits the punishment into tiers based on what the defendant did, how much was at stake, and whether other serious offenses were tied in:

Up to 5 years for the baseline offense, including unauthorized transfer or use of identifying information that doesn’t fall into a higher tier.
Up to 15 years for producing or transferring a fake government-issued ID such as a forged birth certificate or driver’s license, producing more than five false identification documents, or using someone’s identity to obtain $1,000 or more in value within any one-year period.
Up to 20 years when the identity fraud facilitates drug trafficking, connects to a crime of violence, or is committed by someone with a prior conviction under this statute.
Up to 30 years when the identity fraud is used to facilitate domestic or international terrorism.

Every tier also carries potential fines and mandatory forfeiture of any personal property used to commit the offense.¹

The Mandatory Two-Year Add-On

A separate statute, 18 U.S.C. §1028A, creates aggravated identity theft. If someone uses another person’s identifying information during and in relation to any of a long list of federal felonies, including mail fraud, wire fraud, bank fraud, immigration violations, and theft of government property, the court must impose two extra years of imprisonment on top of whatever sentence the underlying felony carries. If the underlying felony relates to terrorism, that mandatory add-on becomes five years.²

Three features make this provision especially harsh. The judge cannot place the defendant on probation instead of imposing the two-year term. The two years cannot run concurrently with the sentence for the underlying crime. And the judge cannot shorten the sentence for the underlying felony to offset the extra time.² In practical terms, a defendant convicted of bank fraud carrying a five-year sentence who also gets an aggravated identity theft conviction serves at least seven.

Restitution Is Mandatory

A federal conviction here triggers mandatory victim restitution under 18 U.S.C. §3663A. The court must order the defendant to compensate victims for actual losses, including the value of any property lost or destroyed, income the victim lost as a direct result of the crime, and expenses incurred during the investigation and prosecution such as child care, transportation, and lost wages from attending court proceedings.³

In broader schemes or conspiracies, restitution isn’t limited to victims named in the indictment. Courts can order compensation for anyone directly harmed by the scheme the defendant was convicted of participating in. When multiple defendants acted together, each can be held jointly and severally liable for all foreseeable losses within the scope of the conspiracy, which means any single defendant could be on the hook for the full amount rather than their individual share.

How State Charges Stack On Top

Every state has its own identity theft statute, and they differ meaningfully. Some classify possession of a single person’s identifying information as a misdemeanor; others treat it as a felony from the start. Many scale penalties by the number of victims or the dollar value of losses, with higher felony categories kicking in once a case involves dozens of victims or substantial amounts.

Several states create a legal presumption of fraudulent intent when someone possesses identifying information for three or more unrelated people. That shifts the practical burden onto the defense to explain why the data was there. Other states focus on the dollar amount of harm instead, with felony thresholds starting anywhere from $500 to several thousand dollars.

When victims span multiple states or the conduct crosses state lines through the internet, federal prosecutors can take the case. They often do when the scale is large, because federal penalties tend to be stiffer and federal sentencing guidelines give judges less room. A single defendant can face charges in both systems. Federal and state governments are considered separate sovereigns, so prosecuting the same conduct in each doesn’t violate double jeopardy.

Defenses That Fit These Cases

Several defenses are commonly used, and which one applies depends heavily on the specific facts.

Lack of Intent

Because intent to defraud is an essential element, the most common defense is that the defendant never intended to use the information unlawfully. Someone who unknowingly possessed another person’s data, such as a landlord who kept old tenant applications containing Social Security numbers, hasn’t committed a crime. The defense focuses on context: why the defendant had the information, whether they ever attempted to use it, and whether the circumstances point to an innocent explanation.

Authorization or Consent

If the person whose information was used actually gave permission, the “without lawful authority” element fails. This defense comes up with family members, business partners, and employees who had legitimate access to someone’s personal data. The key is a clear, consensual understanding, ideally documented through written agreements, emails, or text messages. Verbal consent alone is harder to prove but not impossible with corroborating witnesses.

Mistaken Identity

Cases built on digital evidence sometimes charge the wrong person. IP addresses can be shared across household members or spoofed entirely. Devices can be accessed remotely. Digital forensic analysis may show that the accused’s actual online activity doesn’t match the pattern attributed to them, or that someone else had access to the computer or account used in the fraud.

Challenging the Evidence

If law enforcement obtained evidence through an unlawful search, a coerced confession, or a warrant that lacked probable cause, the defense can move to suppress it. Identity fraud cases often turn technically complex, with seized computers, phone records, IP logs, and financial documents each carrying their own chain of custody and Fourth Amendment questions. Successful suppression of a key piece of evidence can gut the prosecution’s case.

If You’re the Victim Rather Than the Accused

The same statutory framework gives victims tools to limit the damage. You can place an initial fraud alert on your credit file by contacting any one of the three nationwide credit bureaus, which then has to notify the other two. An initial alert lasts at least one year; an extended fraud alert, available after you file an identity theft report, stays on your file for seven.⁴

A security freeze goes further, blocking the bureaus from releasing your credit report to new creditors at all. Federal law makes placing and lifting a freeze free. Online and phone requests must be implemented within one business day; mail requests within three.⁴

You can also ask a credit bureau to block fraudulent entries from your file. The request needs proof of your identity, an identity theft report, and a statement identifying the fraudulent entries and confirming they don’t relate to any transaction you made. The bureau must implement the block within four business days. Once a debt is blocked, a creditor or debt collector who knows about the block cannot sell, transfer, or place that debt for collection.⁵

The FTC runs IdentityTheft.gov as a centralized reporting and recovery tool. The report you create through that process is the same document you’ll need when requesting extended fraud alerts and credit report blocks.⁶ Report as early as you can, because the federal statute of limitations for identity theft offenses is generally five years from when the crime was committed, not from when it was discovered.⁷

1
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information
2
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
3
GovInfo. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes
4
Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
5
Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting from Identity Theft
6
Federal Trade Commission. IdentityTheft.gov Helps You Report and Recover from Identity Theft
7
Office of the Law Revision Counsel. 18 U.S. Code 3282 – Offenses Not Capital