Understanding the Legal Framework of Identity Theft

Identity theft is one of the most pervasive crimes of the digital age, a violation that extends far beyond mere financial loss. For a victim, it can translate into damaged credit, unwarranted debt collection lawsuits, and even wrongful arrests. Understanding the legal landscape of this complex crime—including the statutes that define it, the penalties imposed, and the rights afforded to victims—is the first crucial step toward prevention and recovery.

What is Identity Theft Legally?

At its core, identity theft involves the unauthorized use of another person’s personal information to commit an unlawful act. Federal law defines the crime as knowingly transferring or using, without lawful authority, a “means of identification” of another person with the intent to commit, or to aid or abet, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law.

A “means of identification” is broadly interpreted, including, but not limited to:

• Names and social security numbers.
• Credit card numbers and bank account information.
• Driver’s license numbers, PINs, and electronic serial numbers.

Federal and State Legal Frameworks

Identity theft is prosecuted under both federal and state laws. While many cases are handled in state criminal court, federal jurisdiction applies when the crime involves large dollar amounts, the use of numerous identifications, or crosses state lines via interstate communication.

Federal Legislation: The Foundational Statutes

The primary foundation for federal identity theft prosecution is the Identity Theft and Assumption Deterrence Act of 1998, which officially made identity theft a federal crime (codified primarily under 18 U.S.C. § 1028).

Key Federal Identity Theft Laws

Statute	Focus
18 U.S.C. § 1028	Fraud and related activity in connection with identification documents and information.
Identity Theft Penalty Enhancement Act of 2004 (18 U.S.C. § 1028A)	Establishes penalties for “aggravated” identity theft, where the identity is used to commit felony crimes.
Identity Theft Enforcement and Restitution Act of 2008	Clarifies that restitution can include the value of the victim’s time spent correcting the harm.

State Laws and Penalties

Every state criminalizes identity theft or impersonation, though the specific names and classifications vary. Many states utilize a tiered penalty system that often depends on the monetary loss, the number of victims, or whether a vulnerable person was targeted.

Consequences for the Perpetrator: Punishment and Restitution

The penalties for a conviction of identity theft are severe at both the federal and state levels, reflecting the serious nature of the crime.

Criminal Penalties

• Federal Sentencing: Most federal identity theft convictions carry a maximum penalty of 15 years in imprisonment, a fine, and forfeiture of any property used to commit the crime.
• Aggravated Offenses: Crimes involving aggravated identity theft or related charges like bank fraud or wire fraud can lead to sentences as high as 30 years in prison, substantial fines, and criminal forfeiture.
• State Harsher Penalties: Many states impose harsher penalties if the victim is a child, an elderly person, or disabled.

Mandatory Restitution for Victims

A significant consequence is the mandatory requirement for the convicted person to make restitution to the victim. This is not just for stolen funds but also covers the substantial financial burden of recovering one’s identity.

Victim’s Path to Recovery: Legal Procedures

Recovery is an intensive process, but specific legal tools and procedures are in place to help victims restore their identity and credit.

Essential Recovery Steps

1. Report to the FTC: Use IdentityTheft.gov to report the crime. This step generates an official FTC Identity Theft Report and a personalized recovery plan, which is often required by businesses and creditors.
2. Contact Creditors: Immediately report the fraud to each creditor and work with them to close or freeze compromised accounts.
3. Place Fraud Alerts/Security Freeze: The Fair Credit Reporting Act (FCRA) and Fair and Accurate Credit Transactions Act (FACTA) require Consumer Reporting Agencies (CRAs) to help victims. Placing a fraud alert or security freeze on your credit files (Experian, Equifax, TransUnion) is essential to block new fraudulent accounts.
4. File a Police Report: Though not always required for initial recovery, a police report is often crucial for providing evidence to creditors, disputing inaccurate credit information, and for pursuing criminal prosecution.

Summary of Legal Protections and Recourse

Key Takeaways for Legal Protection

1. Federal Law Defines the Crime: 18 U.S.C. § 1028 (via the Identity Theft and Assumption Deterrence Act) establishes the federal criminal offense, which can carry up to 15 years imprisonment and large fines.
2. State Laws Fill the Gaps: Every state has laws, often classifying the crime as a felony or misdemeanor based on the extent of the financial loss or the vulnerability of the victim.
3. Victim Restitution is Mandatory: Convicts must pay for financial losses, including the cost of correcting credit reports and the value of the victim’s time spent on recovery.
4. Credit Reporting Agencies Must Assist: The FCRA/FACTA laws mandate that credit bureaus and creditors help victims recover by allowing fraud alerts, security freezes, and investigating disputed, inaccurate information.

---

Frequently Asked Questions (FAQ)

Q1: Is Identity Theft always a felony?

A: No. While it can be a federal felony with a maximum penalty of 15 years, many state laws treat identity theft as a “wobbler,” meaning it can be charged as either a felony or a misdemeanor depending on the value of the property or services obtained, or other aggravating factors.

Q2: What is “Aggravated Identity Theft”?

A: Aggravated identity theft is a specific federal charge (18 U.S.C. § 1028A) for using the identity of another person to commit an underlying felony. This offense carries a mandatory additional two-year prison sentence on top of the penalty for the underlying felony, such as immigration violations or domestic terrorism.

Q3: What is the most important legal step for a victim of identity theft?

A: The single most important step is reporting the crime to the Federal Trade Commission (FTC) via IdentityTheft.gov. This action generates the official FTC Identity Theft Report, which is the primary document needed to dispute fraudulent debts, close accounts, and correct credit reports with creditors and credit reporting agencies.

Q4: Can I sue the credit bureaus if they don’t fix my credit after identity theft?

A: Yes. Under the Fair Credit Reporting Act (FCRA), credit reporting agencies and creditors have legal obligations once a victim disputes inaccurate information. If they fail to investigate or correct demonstrably inaccurate information stemming from identity theft, you may have grounds for a civil lawsuit for violations of the FCRA.

Q5: What is the role of the police report in a civil case?

A: A police report, while not always legally mandatory for initial recovery, is highly recommended. It serves as powerful, objective evidence to substantiate your claim of identity theft in disputes with creditors or in defending against a civil collection lawsuit, as many businesses require it alongside the FTC Affidavit.

identity theft, identity fraud, federal identity theft law, state identity theft laws, 18 U.S.C. § 1028, victim restitution, credit report fraud, security freeze, FTC Identity Theft Report, Fair Credit Reporting Act (FCRA), aggravated identity theft, criminal penalties, civil lawsuit, means of identification, unauthorized use, felony vs. misdemeanor, financial loss, police report, Identity Theft and Assumption Deterrence Act