The identity theft statute of limitations is five years for most federal criminal cases, ten years when the scheme targets a financial institution, and anywhere from one to six years on the civil side depending on which law you sue under. State criminal deadlines generally fall between three and seven years. Many of these clocks don’t start ticking until you discover the theft, which matters because fraudulent accounts often go unnoticed for a long time.
How Long Federal Prosecutors Have to File Charges
Federal identity theft is prosecuted mainly under 18 U.S.C. § 1028 and the aggravated identity theft statute at § 1028A. Neither law sets its own deadline, so the general federal rule governs: charges must be filed within five years of the offense for any non-capital crime.1Office of the Law Revision Counsel. 18 USC 3282 – Statute of Limitations
There’s one big exception. If the identity theft involves fraud against a financial institution, such as bank fraud or wire fraud aimed at a bank, prosecutors get ten years instead of five.2Office of the Law Revision Counsel. 18 USC 3293 – Financial Institution Offenses A lot of identity theft fits that description, because opening fraudulent bank accounts or credit lines is often the whole point of the scheme.
The clock also stops entirely if the person who stole your identity flees. Federal law provides that no statute of limitations runs in favor of a fugitive from justice, so a thief who disappears can’t simply wait the deadline out.3Office of the Law Revision Counsel. 18 USC 3290 – Fugitives From Justice
State Criminal Deadlines
State prosecution deadlines for identity theft usually land somewhere between three and seven years. Where a state falls in that range depends on how it grades the offense. Most states treat identity theft as a felony, especially when the loss is significant or multiple victims are involved, and felonies carry longer windows than misdemeanors. Some states tier their deadlines further based on the dollar amount stolen or whether the victim was elderly or a minor.
Many states apply a discovery rule to identity theft, so the clock doesn’t start until the crime is discovered or reasonably should have been. That protection matters because identity theft often sits hidden for years, particularly when a thief opens new accounts rather than draining existing ones. Some states cap the discovery rule with an outer limit, meaning you can’t bring charges beyond a fixed number of years after the theft itself occurred, no matter when it came to light.
Civil Deadlines for Suing After Identity Theft
If you want to recover money through a lawsuit, you’re on a different clock than the prosecutors. Whether the government files criminal charges has no effect on your right to sue, and the civil deadline depends on which law you’re using.
Fair Credit Reporting Act
The FCRA is the main tool when a credit bureau won’t remove fraudulent accounts or refuses to investigate a dispute. You have to file by whichever comes first: two years after you discover the violation, or five years after the violation occurred.4Office of the Law Revision Counsel. 15 USC 1681p – Jurisdictions of Courts; Limitation of Actions The five-year outer limit is firm. If you don’t discover the problem until year six, the claim is gone.
That structure is a reason to pull your credit reports on a regular schedule. The earlier you catch fraudulent activity, the more of the two-year discovery window you preserve.
Fair Debt Collection Practices Act
Identity theft victims sometimes get pursued by debt collectors for accounts they never opened. If a collector violates the FDCPA while chasing a fraudulent debt, you have one year from the date of the violation to file suit.5Office of the Law Revision Counsel. 15 USC 1692k – Civil Liability This clock runs from when the violation happens, not from when you learn about it. Courts have recognized equitable tolling in narrow circumstances, but this is one of the shortest windows a victim faces.
State Fraud and Negligence Claims
Beyond those federal statutes, you can also bring common-law fraud or negligence claims in state court. These deadlines vary, generally falling in the two-to-six-year range. Most states apply a discovery rule, starting the clock when you became aware of the theft or should have been aware with reasonable diligence. If a defendant later argues you waited too long, evidence that you were monitoring your credit and following up on suspicious mail can matter.
What Pauses or Extends the Clock
Several doctrines can push these deadlines back or freeze them.
The discovery rule is the most common. In jurisdictions that apply it, the limitations period doesn’t start until the victim knew or reasonably should have known about the theft. That rule exists for exactly the situation identity theft creates: a thief opens accounts at an address you’ve never lived at and operates for years without anyone noticing.
Flight tolls the federal clock indefinitely under the fugitive statute, and many states have parallel rules that pause their own deadlines while a defendant is absent from the state.3Office of the Law Revision Counsel. 18 USC 3290 – Fugitives From Justice
A bankruptcy filing by the thief can affect civil timelines too. The automatic stay under 11 U.S.C. § 362 halts most proceedings against the debtor, including lawsuits by identity theft victims, which freezes the limitations period while the stay is in effect.6Office of the Law Revision Counsel. 11 USC 362 – Automatic Stay
Some jurisdictions also toll deadlines for minors and incapacitated people, pausing the clock until a child reaches adulthood or a disabled person regains legal capacity. That matters for child identity theft, since a stolen Social Security number may not surface until the victim applies for a first credit card or student loan years later.
What to Do Now to Protect Your Deadlines
Acting fast after you discover identity theft protects more than your bank account. The shorter deadlines, like the FDCPA’s one-year window, can run out before you even realize they’re moving.
File a report at IdentityTheft.gov, the FTC’s recovery portal. It generates a personalized plan and an identity theft affidavit you’ll use when disputing fraudulent accounts with creditors and credit bureaus. File a police report as well. It isn’t always legally required for a civil suit, but it’s a prerequisite for certain protections, including extended fraud alerts.
Under the FCRA, you can place a one-year initial fraud alert on your credit file by contacting one of the three major credit bureaus, which then has to notify the other two. If you’ve filed an identity theft report, you can request an extended fraud alert lasting seven years, plus five years off prescreened credit offer lists.7Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts A credit freeze, also free, goes further by blocking new creditors from pulling your file at all.
Document as you go. Keep dates you discovered fraudulent accounts, copies of letters to creditors, phone logs, and receipts for any expenses you incur cleaning things up. That record proves diligence if a court later asks whether you acted promptly, and it builds the damages file for any restitution or civil claim you pursue.