Identity Theft Charges and Penalties

Key Takeaways

• Identity theft is a federal and state crime, but both carry serious consequences.
• Aggravated identity theft under federal statute 18 U.S.C. § 1028A carries a mandatory two-year prison sentence that is added on top of any other sentence, and judges have no discretion to reduce it.
• 99 percent of people convicted under the aggravated identity theft statute are sentenced to prison.
• Free victim assistance is available from the Identity Theft Resource Center by calling 888.400.5530.

Identity theft is actively investigated by federal and state law enforcement agencies and prosecuted by the U.S. Department of Justice or state prosecuting attorneys. People convicted under identity theft laws are often punished with significant prison sentences, substantial fines and restitution orders. Understanding how that process works can help victims make informed decisions about reporting, and can offer some measure of clarity during what is often a confusing and stressful experience.

What Makes Something a Federal Identity Theft Crime?

Federal identity theft occurs when someone knowingly uses another person’s identifying information without authorization and with the intent to commit fraud or another unlawful act. The legal definition is broader than most people expect.

Under federal law, “means of identification” includes names, Social Security numbers, dates of birth, driver’s license numbers, bank account numbers, credit card numbers, biometric data and unique electronic identification numbers. In practice, this means that using someone’s name and SSN to open a credit card, filing a fraudulent tax return in someone else’s name or using a stolen password to access a financial account can all qualify as identity theft under the statute.

Congress made identity theft a federal crime in 1998 through the Identity Theft and Assumption Deterrence Act. Under that law, it is a federal offense to commit, deliberately attempt, or aid someone in committing identity theft, regardless of whether the underlying crime violates federal law or is a felony under state law. 

That broad reach was intentional. Identity theft rarely stands alone. It is almost always paired with fraud, wire fraud, money laundering or other crimes, which compounds the charges and the penalties significantly.

Federal Identity Theft Laws

Federal identity theft is governed primarily by two statutes: 18 U.S.C. § 1028 and 18 U.S.C. § 1028A. Understanding how they work is essential to understanding why federal sentences for identity theft can be severe.

18 U.S.C. § 1028 – Fraud Related to Identification Documents

This is the primary federal identity theft statute. It is broad by design, covering the production, transfer, possession and use of false identification documents and authentication features. Everything from a fake driver’s license to a stolen credit card falls within its reach.

A conviction under this statute, in most circumstances, carries a maximum term of 15 years in prison, a fine and criminal forfeiture of any personal property used or intended to be used to commit the offense. The penalties are tiered based on the nature and scope of the offense:

• Simple possession of a fake ID or authentication feature: up to 1 year in prison.
• Production or transfer of an ID document, authentication feature or false identification document: up to 15 years in prison.
• Any offense connected to drug trafficking, violent crime or other federal crimes: additional charges with separate penalties.
• Identity theft committed in connection with or to facilitate a terrorist act: up to 30 years in prison.

18 U.S.C. § 1028A – Aggravated Identity Theft

This is the statute that most significantly increases sentences for convicted identity thieves, and it is the one that gives federal prosecutors the most leverage.

Aggravated identity theft under 18 U.S.C. § 1028A applies when a person knowingly possesses, uses, or transfers another person’s means of identification during and in relation to one of more than 60 predicate federal felony offenses. Those predicate offenses include wire fraud, bank fraud, immigration fraud, Social Security fraud and many others. When aggravated identity theft is charged, it carries a mandatory consecutive two-year prison sentence that is added on top of whatever sentence the defendant receives for the underlying crime.

Prosecutors can also stack counts. A separate count of aggravated identity theft can be charged for each victim. Five victims means ten mandatory additional years of prison time before the underlying offense is even considered. 

Who Investigates and Prosecutes Federal Identity Theft

Federal identity theft cases are investigated by a network of agencies and prosecuted by the U.S. Department of Justice. The primary investigative agencies for federal identity theft include the Federal Bureau of Investigation, the United States Secret Service and the United States Postal Inspection Service. These agencies work in coordination with federal prosecutors to bring identity theft and fraud cases to court.

Federal charges typically occur when the alleged crime crosses state or national borders, involves federal interests such as fraud against a federal agency or federally insured financial institution, or is connected to a larger organized fraud scheme. The FBI and other federal agencies focus their resources on sophisticated, large-scale schemes involving significant financial losses. Smaller or more localized incidents are more likely to be handled by state law enforcement.

The FBI’s Internet Crime Complaint Center, known as IC3, serves as the central hub connecting public complaints to federal investigators. Reporting to IC3 is one of the primary ways that large-scale identity theft schemes are identified, tracked and ultimately prosecuted.

State Identity Theft Laws and Penalties

Most identity theft cases never reach the federal level and are instead prosecuted under state law. Every state has its own identity theft statute, and while they share common elements with the federal framework, penalties vary significantly by jurisdiction.

How state penalties are structured:

State identity theft laws create a tiered penalty structure similar to the federal model, but the thresholds and ranges vary by state.

Misdemeanor convictions generally carry a sentence of up to one year in county jail and fines ranging from $1,000 to $5,000. Felony convictions carry prison sentences ranging from two to 20 years and substantial fines, often above $10,000.

The threshold that determines whether an offense is charged as a misdemeanor or a felony depends primarily on the dollar value of the fraud committed. Most states classify identity theft involving smaller amounts as a misdemeanor while classifying larger-amount cases as a felony. That threshold ranges from as low as $500 in some states to $2,500 or more in others.

A subset of states have gone further, mirroring the federal aggravated identity theft statute and mandating a consecutive two-year sentence for identity theft committed during certain predicate felonies. California, Texas and New York each provide civil causes of action as well, allowing victims to sue for actual damages, attorney fees and in some cases statutory damages – without having to prove a specific dollar loss.

What Crimes Often Occur with Identity Theft?

Identity theft rarely exists in isolation. Understanding the crimes most commonly committed alongside it helps explain why sentences can be severe and why federal involvement is often triggered.

The 2025 IC3 Annual Report provides a clear picture of the fraud landscape in which identity theft operates:

• Phishing and spoofing – the primary methods used to harvest personal information – generated 191,561 complaints in 2025, the highest count of any crime type reported to IC3.
• Personal data breach complaints totaled 67,456, with associated losses exceeding $1.3 billion.
• Business email compromise generated more than $3 billion in losses, frequently involving the use of stolen or spoofed identities to impersonate executives or vendors.

When identity theft is committed in connection with wire fraud, bank fraud, mail fraud or money laundering – all of which are federal offenses – each of those charges carries its own sentence. Those sentences can run consecutively to the identity theft penalty, compounding the total time a convicted offender serves.

The growing role of artificial intelligence is also worth noting. AI-related complaints to IC3 in 2025 totaled 22,364 and generated $893 million in reported losses. AI tools are increasingly being used to automate phishing attacks, clone voices and generate deepfake content, all of which can be used to steal identities at scale. As these tools become more accessible, the complexity and scope of identity theft schemes is likely to increase, which may drive further escalation in federal enforcement and sentencing.

What Victims Should Know About the Legal Process

The criminal justice process pace and outcomes can vary significantly depending on the scope of the case, the agencies involved and the evidence available. However, victims have important rights throughout the process, and their participation matters.

Victims have legal rights in federal cases

The Crime Victims’ Rights Act gives federal crime victims the right to be reasonably informed of any public court proceeding involving the crime, to be heard at sentencing, and to receive full and timely restitution as provided by law. If you are identified as a victim in a federal identity theft case, you may be contacted by the prosecuting U.S. Attorney’s office and given the opportunity to submit a victim impact statement.

Restitution is a real but imperfect remedy

When a defendant is convicted, a court can order them to repay victims for losses caused by the crime. However, collecting restitution depends on the defendant’s ability to pay, and recovery is not always guaranteed or timely. Restitution orders are meaningful and enforceable, but they should not be the only recovery strategy victims pursue.

Reporting is essential – even when prosecution feels uncertain

Without a complaint, many identity theft schemes are never detected by law enforcement. Filing a report with IC3 at ic3.gov, with the FTC at identitytheft.gov, and with local law enforcement creates an official record and contributes to the datasets that identify patterns and support investigations. A single report may connect your case to a larger scheme already under investigation.

Criminal prosecution and identity recovery are two separate processes

A criminal investigation focuses on holding the perpetrator accountable. Identity recovery focuses on restoring your credit, correcting your records, and protecting your financial future. You do not need to wait for a verdict or for charges to be filed to begin the recovery process. Those two tracks can and should move forward at the same time.

The Law Takes Identity Theft Seriously. So Do We.

Identity thieves can face years in federal or state prison, six-figure fines, and court orders to repay every victim they harmed. If your identity has been stolen, you do not have to wait for a verdict to start rebuilding. The recovery process can begin immediately, and free, confidential help is available right now.

The ITRC has supported victims of identity crime since 1999. Our advisors can help you understand your next steps, connect you with the right reporting agencies, and guide you through the recovery process at no cost. Reach us by calling 888.400.5530.