The penalty for identity theft runs from under a year in jail to 30 years in federal prison, with fines, restitution, and a long tail of consequences that outlast the sentence itself. Where a specific case falls depends on how the stolen information was used, how much money changed hands, how many victims there were, and whether state or federal prosecutors bring the charges.
Federal Prison Terms Under 18 U.S.C. 1028
The main federal identity theft statute sets a ladder of maximum prison terms, not a single number. Where a case lands depends on the conduct.
- Up to 1 year for minor offenses that don’t fit any of the higher categories.
- Up to 5 years for producing, transferring, or using someone’s identification or a fake ID in cases without aggravating factors.
- Up to 15 years for creating or transferring fake federal IDs, birth certificates, or driver’s licenses; producing five or more false IDs; or using stolen identity information to obtain $1,000 or more in value in a one-year period.
- Up to 20 years when the identity fraud is tied to drug trafficking or a violent crime, or when the defendant has a prior federal identity theft conviction.
- Up to 30 years when the identity fraud is committed to help with domestic or international terrorism.
Each tier can also carry fines and the forfeiture of any personal property used in the offense.1Office of the Law Revision Counsel. 18 USC 1028 Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information Federal prosecutors generally step in when the scheme crosses state lines, targets federal benefits, hits a large number of victims, or overlaps with wire fraud or bank fraud.
The Mandatory Two Years for Aggravated Identity Theft
A separate statute, 18 U.S.C. 1028A, creates an add-on charge called aggravated identity theft. It applies when someone uses another person’s identity during the commission of certain felonies, including mail fraud, wire fraud, bank fraud, immigration violations, theft of government funds, and false statements about Social Security benefits.2Office of the Law Revision Counsel. 18 U.S. Code 1028A – Aggravated Identity Theft
The penalty is two years in federal prison stacked on top of whatever sentence the defendant receives for the underlying felony. If the identity theft was connected to terrorism, that mandatory add-on is five years. Three features make this charge particularly hard to escape:
- Probation is not available. A court cannot substitute probation for the prison time.
- The sentence runs consecutively. The two years begin after the sentence for the underlying crime is served, and the judge has no discretion to overlap them.
- The judge cannot shorten the underlying sentence to offset the add-on.
Someone convicted of wire fraud who also gets tagged with aggravated identity theft serves the wire fraud sentence in full and then starts the two additional years. There is no negotiating around the mandatory minimum once the charge sticks.3Office of the Law Revision Counsel. 18 USC 1028A Aggravated Identity Theft
State Penalties
Every state has its own identity theft statute, and most cases are prosecuted at the state level. Local prosecutors handle the bulk of single-victim, lower-dollar schemes; federal charges tend to enter only when the conduct is large or crosses jurisdictional lines.
State penalty structures typically tier the charge by the dollar amount stolen or the number of victims. Losses below a set threshold are usually misdemeanors; losses above it become felonies. The thresholds vary but commonly fall between a few hundred and a few thousand dollars.
Misdemeanor identity theft generally carries fines up to a few thousand dollars and up to a year in a county jail. Felony convictions carry prison terms that range from two to 20 years in the most serious cases, with fines that can reach tens of thousands of dollars. Several states add enhanced penalties when the victim is elderly or otherwise vulnerable.
What Pushes a Sentence Up or Down
Within the statutory ranges, judges weigh a familiar set of factors in both state and federal cases.
- Financial loss. A few hundred dollars and a few hundred thousand dollars produce very different outcomes. Federal sentencing guidelines use specific dollar thresholds to add points to the calculation.
- Number of victims. One victim is serious; dozens or hundreds signals an organized operation and draws much heavier penalties.
- Type of information stolen. A stolen Social Security number generally triggers more severe charges than a stolen credit card number because it opens the door to new accounts, fraudulent tax returns, and ongoing fraud the victim struggles to shut down.
- Connection to other crimes. Ties to drug trafficking, violent crime, or terrorism move the federal maximum from 15 years to 20 or 30.
- Criminal history. A prior federal identity theft conviction automatically raises the maximum from 15 to 20 years, and state habitual-offender statutes have similar effects.
Identity theft charges also stack easily with other offenses. Someone filing fraudulent tax returns with stolen Social Security numbers can face identity fraud charges under 18 U.S.C. 1028, aggravated identity theft under 1028A for each return, and separate tax fraud charges under 26 U.S.C. 7206, which carries up to three years and a $100,000 fine per count for individuals.4Office of the Law Revision Counsel. 26 U.S. Code 7206 – Fraud and False Statements Those sentences can run consecutively, producing total prison time that far exceeds any single statute’s maximum.
Fines, Restitution, and Civil Liability
Prison is only part of the financial picture. Federal law requires restitution for property offenses committed through fraud or deceit whenever there’s an identifiable victim with a financial loss.5Office of the Law Revision Counsel. 18 U.S. Code 3663A – Mandatory Restitution to Victims of Certain Crimes The Identity Theft Enforcement and Restitution Act broadened what counts: courts can order restitution that includes the value of the time a victim spent cleaning up the fraud, from disputing charges to freezing credit reports and dealing with government agencies.6Office of Justice Programs. Federal Identity Theft Laws
Restitution is ordered by the judge as part of the criminal sentence. Separately, victims can sue in civil court for direct financial losses, the cost of repairing damaged credit, and emotional distress. Many states allow statutory damages — fixed amounts set by law — so a victim doesn’t have to prove every dollar of actual loss. The civil case runs independently of the criminal one.
Life After the Sentence
Federal sentences don’t end at the prison gate. Most defendants serve a term of supervised release after prison, with conditions like regular check-ins, travel restrictions, computer monitoring, and financial disclosure. The authorized length is up to three years for lower-level felonies and up to five years for the most serious ones.7Office of the Law Revision Counsel. 18 U.S. Code 3583 – Inclusion of a Term of Supervised Release After Imprisonment Violating the conditions can send a person back to prison. Common conditions in identity theft cases include limits on internet use, bans on possessing other people’s identifying information, and participation in financial responsibility programs.
The collateral consequences can outlast everything else. Under Section 19 of the Federal Deposit Insurance Act, a conviction for an offense involving dishonesty bars a person from employment at any FDIC-insured bank or financial institution. Identity theft is specifically listed as a covered offense and is excluded from the “simple theft” exceptions that soften the rule for less serious crimes.8Federal Register. Fair Hiring in Banking Act A waiver can be requested from the FDIC, but the applicant bears the burden of showing they don’t pose a risk.9Federal Deposit Insurance Corporation. Your Guide to Section 19
Background checks for jobs in healthcare, government, education, and any position touching sensitive data get much harder to pass. Professional licenses in accounting, law, and financial planning can be revoked or denied. For non-citizens, an identity theft conviction involving more than $10,000 in losses can trigger deportation proceedings as an aggravated felony or a crime involving moral turpitude. And because identity theft is a crime of dishonesty, it can be used to attack a person’s credibility if they ever testify in court, long after the sentence is served.