Identity theft is the knowing, unauthorized use of another person’s identifying information to commit fraud or any other crime. Federal law treats it as a standalone offense carrying prison sentences from five years up to 30 years depending on what the stolen information was used for, and it reaches millions of people each year through methods ranging from stolen mail to AI-generated voice cloning. The damage is rarely limited to a bank balance. A thief using your name can leave you with a false criminal record, corrupt your medical file, or wreck a child’s credit years before that child applies for anything.
How Federal Law Defines It
Federal law defines identity theft as knowingly transferring or using someone else’s identifying information, without permission, to carry out any unlawful activity that violates federal law or qualifies as a felony under state or local law.1Federal Trade Commission. Identity Theft and Assumption Deterrence Act The statutory phrase is “means of identification,” and it covers a broad set of personal data: name, Social Security number, date of birth, driver’s license number, passport number, and taxpayer identification number all qualify.2Social Security Administration. Social Security Legislative Bulletin 105-17
The definition goes further than the obvious identifiers. Biometric data like fingerprints and facial recognition patterns count, as do financial account numbers, routing information, and digital login credentials. The common thread is that the data can distinguish or trace a specific person. A thief who steals a credit card number and one who replicates a fingerprint to unlock a phone are committing the same category of offense.
Intent is the hinge. Simply possessing someone’s data can support other charges, but identity theft specifically requires that the person used or transferred the information to further an unlawful activity. The government has to show the defendant acted knowingly. That requirement is what separates identity theft from receiving a misdirected bank statement by mistake.
The Main Types of Identity Theft
Financial Identity Theft
This is the version most people picture. Someone uses your information to open credit cards, take out loans, or drain a bank account. You usually find out when unfamiliar charges show up on a statement or a debt collector calls about an account you never opened. The credit score damage can be severe, and separating fraudulent accounts from legitimate ones takes months of follow-up with creditors and credit bureaus.
Medical Identity Theft
When someone uses your insurance to get healthcare, prescriptions, or medical equipment, the money is only part of the problem. The thief’s medical history can merge with yours, introducing false diagnoses, allergies, and blood type information into your permanent records. In an actual emergency, a doctor relying on corrupted records could make a dangerous call. Medical identity theft is widely considered the hardest type to resolve because health records are fragmented across providers with no single point of correction.
Criminal Identity Theft
If someone gives your name and identifying details to police during an arrest, you can end up with a criminal record or outstanding warrants you know nothing about. Victims sometimes discover this during a background check for a job or after being pulled over for a traffic stop. Clearing your name means working with courts and law enforcement agencies, often in places you have never been.
Tax Identity Theft
A thief files a fraudulent return using your Social Security number to claim your refund before you file. The first sign is usually an e-file rejection because the IRS has already processed a return under your number. You may also receive an IRS notice about unreported income or a Form 1099-G for unemployment benefits you never collected. Resolving it requires filing IRS Form 14039 (Identity Theft Affidavit) and waiting for the IRS to investigate, which can delay your legitimate refund for months.
Child Identity Theft
Children are attractive targets because no one checks their credit. A thief can use a child’s Social Security number for years before anyone notices, building up debt against a credit profile the child doesn’t know exists. Warning signs include bills, credit card offers, or collection calls in your child’s name.3Consumer Financial Protection Bureau. How Do I Check to See if a Child Has a Credit Report Parents can contact each of the three nationwide credit bureaus to search for a credit file in their child’s name. If one exists and you didn’t create it, identity theft has almost certainly happened.
Synthetic Identity Theft
Rather than fully impersonating one person, a thief combines a real Social Security number with a fabricated name and date of birth to create a person who doesn’t exist. Because no single victim matches the fake identity, this fraud often goes undetected for years. The thief builds credit gradually, makes on-time payments to raise the limit, then maxes everything out and disappears. The person whose number was used may not learn about it until they apply for credit themselves and run into unexplained complications.
Business Identity Theft
Companies are targets too. Fraudsters file bogus documents with state agencies to change a business’s registered address or listed officers, then use the altered records to open lines of credit. Small businesses with infrequent filing activity are especially vulnerable because the changes can go unnoticed for months. Checking your business filings with the state registry regularly is the most effective way to catch this early.
How Thieves Get Your Information
The oldest tricks still work. Dumpster diving, where someone goes through your trash for bank statements or pre-approved credit offers, remains effective because most people shred nothing. Shoulder surfing is exactly what it sounds like: watching you type a PIN at an ATM or a password at a coffee shop. These methods require no technical skill and account for a surprising share of cases.
Mail theft is another low-tech route with serious consequences. Stolen letters can contain tax documents, insurance statements, and new credit cards. Taking mail from someone’s mailbox is a separate federal crime carrying up to five years in prison on its own.4Office of the Law Revision Counsel. 18 US Code 1708 – Theft or Receipt of Stolen Mail Matter Generally A single piece of stolen mail can give a thief enough information to open accounts, file a fraudulent tax return, or redirect your existing accounts to a new address.
On the digital side, phishing is the workhorse. You get an email or text that looks like it came from your bank, the IRS, or a delivery service, and it asks you to click a link and log in. The site looks legitimate, but it captures every keystroke. Skimming devices attached to gas pumps and ATMs do something similar, quietly reading the magnetic stripe during an otherwise normal transaction. Large-scale data breaches round out the picture, exposing millions of records at once when hackers get into corporate or government databases.
AI Voice Cloning and Impersonation
Generative AI has added a genuinely alarming dimension. Voice cloning software can mimic a family member’s voice well enough to fool most people over the phone. A scammer calls pretending to be your child, says they’ve been in an accident and need bail money, and the voice sounds right. The same technology helps fraudsters impersonate bank representatives, employers, and government officials with regionally appropriate accents and vocabulary. Minimizing the amount of your own audio and video publicly available online is one of the few practical defenses against voice cloning.
Federal Penalties
Before 1998, federal law focused mainly on fraudulent identification documents rather than the theft of an identity itself. The Identity Theft and Assumption Deterrence Act made it a standalone federal crime to knowingly use another person’s identifying information to commit any unlawful activity, and it recognized the person whose information was stolen as the victim, not just the defrauded bank or business.1Federal Trade Commission. Identity Theft and Assumption Deterrence Act
Penalties under 18 U.S.C. § 1028 scale with the severity of the conduct:5Office of the Law Revision Counsel. 18 US Code 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
- Up to five years for basic identity theft offenses, including transferring or using someone’s identifying information to commit a crime.
- Up to 15 years for producing or transferring fraudulent government-issued documents like birth certificates or driver’s licenses, trafficking five or more false identification documents, or obtaining $1,000 or more in value through identity theft within a one-year period.
- Up to 20 years for identity theft committed to facilitate drug trafficking, in connection with a crime of violence, or after a prior identity theft conviction.
- Up to 30 years for identity theft committed to facilitate domestic or international terrorism.
Courts can also impose fines and must order forfeiture of personal property used to commit the offense. Restitution to victims is a standard part of sentencing and is based on actual losses. A judge cannot reduce restitution because the defendant can’t afford it; the defendant’s finances factor only into the payment schedule, not the total.
Aggravated Identity Theft
A separate statute, 18 U.S.C. § 1028A, imposes a mandatory additional prison sentence when identity theft is committed during certain other felonies. The add-on is two years on top of whatever sentence the underlying felony carries, and five years when the underlying crime is terrorism-related.6Office of the Law Revision Counsel. 18 US Code 1028A – Aggravated Identity Theft That sentence cannot run concurrently with the sentence for the underlying crime, so it always extends total prison time. Probation is not an option for an aggravated identity theft conviction.
Your Rights If You Are a Victim
Federal law gives identity theft victims specific, enforceable rights when dealing with credit bureaus and creditors. Once you report the theft, you can demand that credit reporting companies block fraudulent accounts and debts from your credit report. To start, send the credit bureau an identity theft report (which you can generate at IdentityTheft.gov), proof of your identity, and a letter identifying the fraudulent items.7Consumer Financial Protection Bureau. What Do I Do if I Think I Have Been a Victim of Identity Theft
The credit bureau must block the fraudulent information within four business days of receiving your request. It must also notify the companies that reported the fraudulent accounts, and once those creditors are notified, they cannot turn identity-theft-related debts over to debt collectors.7Consumer Financial Protection Bureau. What Do I Do if I Think I Have Been a Victim of Identity Theft The credit bureau can refuse to block information only if you misrepresented your victim status or actually benefited from the fraudulent transaction.
What to Do Right Away
Speed matters. The longer fraudulent accounts stay open, the harder they are to unwind.
Start at IdentityTheft.gov, the federal government’s dedicated recovery site. Complete the online form or call 1-877-438-4338 to file a report. The site generates an official Identity Theft Report, which serves as proof to businesses and credit bureaus that your identity was stolen and triggers your legal rights to have fraudulent information blocked.8Federal Trade Commission. Identity Theft Recovery Steps The site also builds a personalized recovery plan based on your situation.
File a report with your local police department. Bring copies of your FTC Identity Theft Report, any credit report pages showing fraudulent items, and any other evidence. A police report strengthens your position when disputing fraudulent accounts and is sometimes required for extended fraud alerts. Keep a copy; creditors and credit bureaus will ask for it.
Contact the three nationwide credit bureaus to place a fraud alert or credit freeze. Then reach out directly to every company where a fraudulent account was opened. The FTC’s Identity Theft Affidavit, generated as part of your IdentityTheft.gov report, is a standardized form that most creditors and bureaus accept, saving you from filling out each company’s individual paperwork.
Credit Freezes, Fraud Alerts, and the IRS IP PIN
A credit freeze blocks anyone, including you, from opening new credit accounts in your name until you lift it. It lasts indefinitely and is the strongest preventive tool available.9Consumer Advice – FTC. Credit Freezes and Fraud Alerts When you need to apply for credit yourself, you temporarily lift the freeze with a PIN or password, then refreeze afterward. Placing and lifting a freeze is free under federal law.
A fraud alert is lighter. Instead of blocking access to your credit report, it tells lenders to verify your identity before granting new credit. An initial fraud alert lasts one year and is renewable. An extended fraud alert, available to confirmed identity theft victims, lasts seven years and also removes you from marketing lists for unsolicited credit offers for five years.9Consumer Advice – FTC. Credit Freezes and Fraud Alerts Active-duty military members can place a one-year alert that’s renewable for the length of deployment.
If you have already been victimized, use a credit freeze. It’s more protective and costs nothing. A fraud alert is a reasonable first step if you suspect your data was exposed in a breach but have not seen fraudulent activity yet.
To guard against tax-related identity theft, the IRS offers an Identity Protection PIN, a six-digit number that must appear on your tax return for it to be accepted. Anyone with a Social Security number or Individual Taxpayer Identification Number can enroll. The fastest method is through your IRS online account. If you can’t verify your identity online and your adjusted gross income is below $84,000 (or $168,000 for married filing jointly), you can submit Form 15227 and receive the PIN by mail within four to six weeks. In-person enrollment at a Taxpayer Assistance Center is also available.10Internal Revenue Service. Get an Identity Protection PIN Parents can request an IP PIN for dependents, though minors must use an alternative enrollment method rather than the online portal.
The Real Cost to Victims
The costs go well beyond the fraudulent charges. About 40 percent of victims spend an average of $600 in out-of-pocket expenses on recovery, covering postage, phone calls, transportation, and bounced-check fees. Nearly a quarter have to take time off work, leading to lost wages, exhausted personal days, and in some cases long-term career consequences. Victims report spending an average of 200 hours over six months working to restore their identity. Roughly a third end up taking out a loan to cover expenses related to the theft.
In federal criminal cases, courts order restitution based on the victim’s actual losses, not the intended loss or the amount the defendant gained. Restitution can cover direct financial losses, lost wages caused by the defendant’s conduct, and the cost of replacing compromised documents. Judges must order the full amount regardless of the defendant’s ability to pay, and where multiple defendants contributed to the harm, each can be held liable for the full restitution amount.