Is Identity Theft a Federal Crime in 2026?
Reviewed · Updated
Not legal or financial advice. Identity theft protection services reduce risk; they do not prevent all fraud.
Quick answer: Yes. Using another personâs name, Social Security number or other identifying information to commit a crime is a federal offense under 18 U.S.C. §1028(a)(7), punishable by up to 15 years in prison when the thief gets $1,000 or more in a year, and up to 5 years otherwise (checked 10/09/2026).
- A separate law, aggravated identity theft, adds a mandatory 2 years on top of the sentence for certain felonies such as bank or wire fraud.
- States have their own identity theft laws. Depending on the state and the case, it can be a felony or a misdemeanor.
- If it happened to you, the first stop is IdentityTheft.gov, run by the FTC. It’s free.
This is not legal or financial advice. If someone used your identity, start at IdentityTheft.gov.
How federal identity theft law works
The federal offense dates to 1998. That fall, Congress passed the Identity Theft and Assumption Deterrence Act, which added identity theft to 18 U.S.C. §1028. The Justice Department describes the result on its identity theft page, updated 10/07/2026.
The core text is §1028(a)(7). It covers anyone who “knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person.” The purpose has to be a federal crime or a state felony.
Two parts of that sentence matter most:
- âMeans of identificationâ is broad. Section 1028(d)(7) lists a name, Social Security number, date of birth, driver’s license number, passport number and taxpayer ID. It also covers fingerprints and other biometrics, plus account numbers and other electronic identifiers.
- It must connect to another crime. Holding someone’s details isn’t enough. The law requires intent to commit, aid or abet unlawful activity, such as fraud, that breaks federal law or is a felony under state law.
For a case to be federal, it also needs a federal link. Section 1028(c) names, among other things, conduct that affects trade between states or uses the mail. Online fraud often crosses state lines, which is one reason federal agencies get involved.
Is identity theft a felony? Federal penalties
Yes. The Justice Department calls §1028 and the related fraud laws “felonies that carry substantial penalties.” Section 1028(b) sets the maximum prison terms for identity theft under (a)(7):
| Situation under 18 U.S.C. §1028(b) | Maximum prison term |
|---|---|
| The thief gets $1,000 or more in value within a year (b)(1)(D) | 15 years |
| Other identity theft under (a)(7) (b)(2)(B) | 5 years |
| Tied to drug trafficking or a crime of violence, or after a prior conviction (b)(3) | 20 years |
| Tied to terrorism (b)(4) | 30 years |
Fines and forfeiture of property used in the crime can come on top. The Justice Department sums it up this way: the offense âin most circumstances, carries a maximum term of 15 years’ imprisonment, a fine, and criminal forfeiture.â
Aggravated identity theft adds 2 years
A second statute, 18 U.S.C. §1028A, is stricter. If someone uses another person’s identity during one of the felonies it lists, the court must add 2 years in prison. The list includes mail, bank and wire fraud, passport and immigration crimes, and false statements to Social Security. Terrorism cases get 5 years.
That time can’t be served as probation. It also runs consecutively, after the sentence for the fraud itself, not at the same time.
In 2023 the Supreme Court narrowed §1028A in Dubin v. United States. A defendant who overbilled Medicaid had used a patient’s ID number on the claim. The Court held that the law applies when using someone’s identity is âat the crux of what makes the conduct criminal.â An incidental part of a billing fraud doesn’t count.
How often identity theft is prosecuted federally
Reports far outnumber federal cases. The FTC’s Consumer Sentinel network took in 1.1 million identity theft reports in 2024, 18% of all its reports. That’s the latest annual Data Book listed on ftc.gov as of 10/09/2026.
On the court side, the U.S. Sentencing Commission counted 561 cases involving aggravated identity theft (§1028A) in fiscal year 2025. That’s out of 66,662 federal cases reported to it, and 8% fewer than in fiscal year 2021.
The two numbers measure different things. The 561 counts only §1028A sentencings, not plain §1028 cases or state prosecutions. Still, the Commission’s data shows what happens when a case does reach federal court:
- 92% of those people were also convicted of another offense.
- 99% went to prison. The average sentence was 54 months.
- With §1028A as the only conviction, the average was 24 months.
Federal cases are investigated by federal agencies. The Justice Department names the FBI, the Secret Service and the Postal Inspection Service. Prosecutors also have other charges available. The same page lists credit card fraud, computer fraud, mail fraud, wire fraud and bank fraud, and says the penalties reach “as high as 30 years” in some cases.
State identity theft laws: felony or misdemeanor?
States write their own identity theft laws, and the grades differ a lot. Most identity theft cases are prosecuted at the state level or not at all. Three examples, read on 10/09/2026:
- Texas (Penal Code §32.51) grades by how many items of identifying information were used. Using fewer than five is a state jail felony; 50 or more is a first-degree felony. Crimes against an elderly person move up a grade.
- California (Penal Code §530.5(a)) allows a fine and up to a year in county jail, or a felony term under §1170(h). Prosecutors choose which way to charge.
- New York (Penal Law §190.78) makes identity theft in the third degree a class A misdemeanor. Higher degrees, in §190.79 and §190.80, are felonies.
The same act can break federal and state law at once. Texas says so in §32.51(e): the person may be prosecuted under that section, the other law, or both.
If it happened to you: reporting is free
Victims don’t decide whether a case is charged. A Buffalo, New York, victim asked about it on Avvo (05/10/2016). A defense lawyer put it plainly: âYou don’t get to press charges, you get to report to police, who may forward to a prosecutor for charging.â
The reporting itself costs nothing:
- Report at IdentityTheft.gov. The FTC site asks what happened and builds a recovery plan. It also gives you an Identity Theft Report.
- Use that report with companies. The FTC says that in most cases the Identity Theft Report can replace a police report for clearing accounts and credit records.
- Go to the police when it helps. The FTC lists three cases: you know the thief or have leads, the thief used your name with police, or a creditor or collector insists on a police report.
Two limits are worth knowing. The FTC’s own Data Book says the agency âdoes not intervene in individual consumer disputes.â Reports go into a database for law enforcement. And IdentityTheft.gov warns that knowingly filing a false report is itself illegal.
What victims ask lawyers
I read three identity theft threads on Avvo Legal Answers. It’s a small sample, and two of the three are from 2016, so treat it as color, not data.
- A Buffalo victim found a satellite TV account opened with their SSN at a neighbor’s address and asked whether to âpress charges.â The answers said that’s the prosecutor’s call.
- A Waco, Texas, victim found 2008 traffic tickets in their name and couldn’t get the city prosecutor to call back (10/27/2016). A lawyer suggested pulling the driving record and using IdentityTheft.gov.
- A Radford, Virginia, victim asked in 2024 whether to hire a lawyer. The answer pointed to credit report disputes under the Fair Credit Reporting Act, plus a fraud alert or a credit freeze.
Common misconceptions
- âIt’s a federal crime, so the FBI will investigate my case.â Federal agencies take cases with a federal link and enough scale. Many cases stay with local police, or nobody investigates.
- âHaving someone’s personal data is identity theft.â Under §1028(a)(7), the use or transfer has to connect to another crime, such as fraud.
- “The FTC will get my money back.” The FTC collects reports and gives you a recovery plan. The recovery steps, such as disputes and fraud alerts, are yours to take.
Free help vs paid protection
Everything in the reporting steps above is free. Paid identity theft protection, sold by companies like Aura and LifeLock, adds monitoring, alerts and recovery help. It can’t make a prosecution more likely.
If you’re weighing a paid plan, compare them in our best identity theft protection guide, or read the Aura review and the LifeLock review.
See also
What we checked
- Federal law: 18 U.S.C. §1028 and §1028A and Dubin v. United States (2023), read on Cornell’s Legal Information Institute 10/09/2026. The official uscode.house.gov site was down for maintenance that day
- Justice Department identity theft page (updated 10/07/2026), U.S. Sentencing Commission Quick Facts for fiscal year 2025, FTC Consumer Sentinel Data Book 2024 — read and captured 10/09/2026
- State law: California Penal Code §530.5, Texas Penal Code §32.51, New York Penal Law §190.78 — read 10/09/2026
- Victims’ questions: three threads on Avvo Legal Answers (2016, 2016, 2024). Reddit blocked our connection
FAQ
Is identity theft a felony?
Under federal law, yes. The Justice Department calls §1028 and the related fraud statutes felonies. Identity theft under §1028(a)(7) carries up to 5 years, or up to 15 when the thief gets $1,000 or more in a year. Under state law it depends. In Texas it starts as a state jail felony, while identity theft in the third degree in New York is a class A misdemeanor.
Is identity theft a felony or a misdemeanor?
It can be either, depending on which law is used and how serious the case is. Federal identity theft is mostly charged as a felony. States set their own grades. California’s §530.5(a) allows up to a year in county jail or a felony term, and New York’s lowest degree is a misdemeanor.
What is aggravated identity theft?
It’s a separate federal crime, 18 U.S.C. §1028A. It applies when someone uses another person’s identity during certain felonies, such as mail, bank or wire fraud. It adds a mandatory 2 years in prison, served on top of the other sentence, with no probation. In 2023 the Supreme Court limited it to cases where the identity use is at the crux of the crime.
Who prosecutes identity theft?
Federal prosecutors bring federal cases, working with the FBI, the Secret Service and the Postal Inspection Service, according to the Justice Department. Many cases are handled by local police and state prosecutors under state law instead. The FTC collects reports but, by its own description, does not intervene in individual disputes.
Can I press charges for identity theft?
Not directly. You report the crime, and a prosecutor decides whether to charge. As one defense lawyer put it on Avvo in 2016: “You don’t get to press charges, you get to report to police, who may forward to a prosecutor for charging.”
Do I need a police report for identity theft?
Often not. The FTC says that in most cases the Identity Theft Report you get from IdentityTheft.gov can be used in place of a police report. It still suggests going to the police if you know who the thief is, if the thief used your name with police, or if a creditor insists on one.
This page contains no affiliate links.