Clone Cards Are Illegal: Federal Prison, Fines, and Restitution

Yes, clone cards are illegal. Making, possessing, or using a counterfeit payment card is a federal crime under 18 U.S.C. § 1029, with prison sentences reaching 20 years for repeat offenders and fines up to $250,000 per count.¹ Every state also criminalizes credit card fraud under its own laws, so a single cloning operation can be prosecuted at both levels for the same conduct.

A clone card is a counterfeit payment card encoded with data stolen from a real cardholder. The federal statute that covers it, 18 U.S.C. § 1029, uses the broader term “access device,” which includes cards, account numbers, PINs, and electronic serial numbers.¹ A second statute, 15 U.S.C. § 1644, specifically targets fraudulent credit card use affecting interstate commerce.² Prosecutors can charge under either or both.

What Conduct Is a Federal Crime

Section 1029 breaks clone card activity into separate offenses. Each stands on its own, so you don’t have to complete the full chain from skimming to spending to be charged:

Producing a clone card. Encoding stolen data onto a blank card with intent to defraud is a crime, whether or not the card is ever used.¹
Using a clone card. Using an unauthorized access device to obtain $1,000 or more in value within any one-year period is a separate offense. Multiple small purchases add up toward that threshold.¹
Holding 15 or more clone cards. Possessing 15 or more counterfeit or unauthorized access devices with intent to defraud is charged on its own, aimed at people who stockpile cards for distribution.¹
Owning the equipment. Possessing card-making equipment such as encoders, embossers, or skimmers with intent to defraud is illegal by itself, even if no cards have been made yet.¹

Every one of these turns on “intent to defraud.” The government does not have to prove any money was actually taken. Possession of the cards or the tools, paired with evidence of fraudulent purpose, is enough for a conviction.

Section 1644 adds a parallel credit-card-specific charge: using a counterfeit or stolen credit card to obtain $1,000 or more in goods, services, or cash within one year carries up to 10 years in prison and a $10,000 fine, and the same penalties apply to transporting or selling counterfeit credit cards across state lines. For transportation tickets bought with a fraudulent card, the threshold drops to $500.²

Federal Prison Time and Fines

Sentences under § 1029 depend on the specific offense and whether the defendant has a prior conviction under the same statute:

Producing, using, or possessing counterfeit access devices, first offense: up to 10 years in prison.¹
Possessing device-making equipment, first offense: up to 15 years in prison, reflecting the mass-production risk.¹
Any § 1029 offense after a prior conviction under the same statute: up to 20 years in prison.¹

Fines for each of these can reach $250,000 per count, the standard federal felony maximum under 18 U.S.C. § 3571.³ Convictions on multiple counts can push financial exposure into the millions.

The Identity Theft Add-On

Clone card sentences rarely stop at the § 1029 numbers. If the fraud used another person’s identifying information, and it usually does, prosecutors can add aggravated identity theft under 18 U.S.C. § 1028A. That charge carries a mandatory two-year prison term that runs consecutively to the underlying fraud sentence, not concurrently.⁴ The judge cannot cut the fraud sentence to offset it, and probation is off the table.

A defendant facing 10 years on the access device count is looking at a minimum of 12 with this enhancement stacked on top.⁴

Forfeiture and Restitution

Federal law requires forfeiture of any personal property used or intended to be used in the offense: computers, card readers, encoders, blank stock.¹

Restitution is also mandatory. Under the Mandatory Victims Restitution Act, the court must order the defendant to repay every victim the full value of the loss, calculated at whichever is greater between the value on the date of the loss and the value at sentencing.⁵ Victims include cardholders whose accounts were drained and financial institutions that absorbed the losses. Restitution is not discretionary and it is not dischargeable in bankruptcy, so the obligation follows a defendant after release.

State Charges Run Alongside

Every state criminalizes credit card fraud, and most sort offenses into misdemeanors or felonies based on the dollar amount involved. Felony thresholds vary widely, with some states escalating at a few hundred dollars and others waiting until the loss reaches $1,000 or more. Misdemeanor convictions typically bring shorter jail terms and lower fines; felonies can mean years in state prison.

State prosecutors also tend to stack charges. A single cloning scheme can produce counts for identity theft, computer fraud, possession of forgery devices, and theft, each with its own penalty range. Enhanced penalties are common when the victim is elderly or when many accounts are involved. Because state and federal charges are separate sovereigns’ cases, both can proceed from the same conduct.

If Your Card Was Cloned

Federal law caps your out-of-pocket losses when someone clones your card, but the protection is far stronger for credit cards than for debit cards, and it depends on how quickly you report.

Credit Cards

Your liability for unauthorized credit card charges is capped at $50, and even that cap only applies if the card issuer notified you of your rights and provided a means to identify you on the account.⁶ Most major issuers waive the $50 under zero-liability policies. You can report unauthorized charges by phone, online, or in writing.

Debit Cards

Debit card protection is weaker and the deadlines are strict:

Report within 2 business days of discovering the theft: liability capped at $50.⁷
Report after 2 business days but within 60 days of your statement: liability can rise to $500.⁷
Report more than 60 days after your statement: no cap on transfers occurring after the 60-day window.⁷

With a cloned credit card, the money never leaves your bank account and you dispute the charge. With a cloned debit card, funds leave your checking account immediately, and recovery can take days or weeks even after you report.

Steps to Take

Contact your bank or card issuer as soon as you notice unfamiliar charges or an unexpected decline. Most issuers run 24/7 fraud lines listed on the back of the card. After freezing the card, file a report with the FTC at IdentityTheft.gov or 1-877-438-4338; the FTC generates documentation you may need for bank disputes. For larger losses or broader identity theft, file a police report and consider a fraud alert or credit freeze with the three major credit bureaus. Keep written records of every call and dispute in case the bank pushes back on reimbursement.

1
Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices
2
Office of the Law Revision Counsel. 15 USC 1644 – Fraudulent Use of Credit Cards, Penalties
3
Office of the Law Revision Counsel. 18 US Code 3571 – Sentence of Fine
4
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
5
Office of the Law Revision Counsel. 18 US Code 3663A – Mandatory Restitution to Victims of Certain Crimes
6
eCFR. 12 CFR 1026.12 – Special Credit Card Provisions
7
Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers