Misappropriating identity information to obtain money means using another person’s identifying details, such as a name, Social Security number, account number, or login credentials, without permission to commit a fraud that produces financial gain. Under federal law it is a distinct crime, punishable by up to 30 years in prison in the most serious cases, and it can be charged on top of whatever underlying fraud the identifying information was used to carry out.1Office of the Law Revision Counsel. 18 USC 1028 Fraud and Related Activity in Connection With Identification Documents More than 1.1 million people reported identity theft to the Federal Trade Commission in 2024.2Federal Trade Commission. New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024
What the Conduct Actually Looks Like
The phrase describes a two-part act. First, the offender obtains identifying information belonging to a real person. Second, the offender uses that information, without authorization, to get something of value. Common versions include opening a credit card or bank account in the victim’s name, draining an existing account by impersonating the account holder, taking out a loan, cashing a fraudulent tax refund, or running purchases through a payment card whose number was stolen.
Federal law defines “means of identification” broadly. It covers names, Social Security numbers, dates of birth, driver’s license numbers, passport numbers, taxpayer identification numbers, biometric data, and electronic account credentials. Anything that can be used to identify a specific person qualifies. What matters legally is not how the information was obtained but that it belonged to a real person and was used without permission in furtherance of a crime.
Synthetic Variations
Not every scheme relies on a full stolen identity. In synthetic identity theft, a thief pairs a real Social Security number with a fabricated name and address, then builds a credit history under that hybrid identity before running up debt and disappearing. Standard monitoring services often miss it because they look for exact matches of a person’s information rather than partial use of a single data point. Legally, using someone else’s Social Security number this way still falls within the statute even though the accounts do not appear in the victim’s own name.
The Federal Statutes That Apply
The core statute is 18 U.S.C. § 1028, expanded by the Identity Theft and Assumption Deterrence Act of 1998. Before that law, federal statutes reached only the creation or production of false identification documents. The 1998 Act made it a federal crime to use someone else’s identifying information to commit any unlawful activity, whether the underlying offense violates federal law or qualifies as a felony under state or local law.3Federal Trade Commission. Identity Theft and Assumption Deterrence Act – Section 003 Identity Theft
Congress added a separate, harsher offense in 2004: aggravated identity theft, at 18 U.S.C. § 1028A. It applies when someone uses another person’s identifying information during the commission of certain specified felonies, including mail fraud, wire fraud, bank fraud, immigration violations, theft of government funds, and Social Security fraud.4Office of the Law Revision Counsel. 18 USC 1028A Aggravated Identity Theft Most schemes that use stolen identifiers to obtain money touch at least one of those predicate felonies, which is why aggravated identity theft is a common companion charge in these cases.
Federal Penalty Tiers
Under § 1028, prison exposure scales with the seriousness of the conduct:
- Up to 5 years for general cases involving the production, transfer, or use of stolen identification documents or information.
- Up to 15 years for cases involving government-issued documents like driver’s licenses and birth certificates, production of more than five false identification documents, or obtaining $1,000 or more in value during any one-year period through identity theft.
- Up to 20 years when the identity theft facilitates drug trafficking, is connected to a violent crime, or follows a prior federal identity theft conviction.
- Up to 30 years when the identity theft facilitates domestic or international terrorism.
Every tier also carries potential fines and forfeiture of personal property used in the offense. These are statutory maximums. Actual sentences turn on the federal sentencing guidelines, which factor in the total financial loss, the number of victims, the level of planning involved, and the defendant’s criminal history. A two-level enhancement applies when the offense involved device-making equipment, trafficking in counterfeit access devices, or possession of five or more stolen means of identification.5United States Sentencing Commission. Amendment 596 Courts may also depart upward when the offense caused substantial harm to a victim’s credit record or reputation, or when the defendant essentially assumed another person’s entire identity.
The Mandatory Two-Year Add-On
Aggravated identity theft carries a mandatory two-year prison sentence added on top of whatever sentence the defendant receives for the underlying felony. If the identity theft is connected to a terrorism-related offense, the mandatory add-on jumps to five years. These sentences must run consecutively, so they cannot overlap with the sentence for the underlying crime. Courts cannot reduce the sentence for the underlying felony to compensate, and they cannot substitute probation.6Office of the Law Revision Counsel. 18 U.S. Code 1028A – Aggravated Identity Theft That structure makes § 1028A one of the most reliably punished federal offenses since judges have no discretion to lower the mandatory term.
Restitution to the Victim
Federal courts must order restitution in identity theft cases because the offense qualifies as a crime against property committed through fraud or deceit. The order requires defendants to return stolen property or pay its equivalent value, reimburse victims for lost income, and cover expenses like child care and transportation that victims incurred while participating in the investigation or prosecution.7Office of the Law Revision Counsel. 18 USC 3663A Mandatory Restitution to Victims of Certain Crimes Restitution is mandatory and separate from any fines the court imposes. It does not cover pain and suffering.8U.S. Department of Justice. Restitution Process
After prison, defendants typically face supervised release. Under 18 U.S.C. § 3583, courts can impose terms of up to five years for serious felonies and up to three years for mid-level felonies. During that time, the defendant must avoid new crimes, comply with any restitution order, and meet other conditions the court sets. Violations can send the person back to prison.9Office of the Law Revision Counsel. 18 USC 3583 Inclusion of a Term of Supervised Release After Imprisonment
How Thieves Get the Information in the First Place
Prosecutions do not require proof of any particular acquisition method, but a few recur.
Phishing uses emails, texts, or website pop-ups that impersonate a bank, government agency, or retailer. The message manufactures urgency (“your account has been compromised”) to push the target into entering passwords, Social Security numbers, or card details on a fake page. Spear phishing is the same technique customized with information the attacker already knows about the target.
Skimming captures data from the magnetic strip on credit or debit cards through hidden readers installed on ATMs or payment terminals. RFID skimmers can intercept data from contactless chip-enabled cards without physical contact.
Social engineering skips the technology and manipulates the person. A caller impersonates a bank representative or IRS agent, builds rapport, and persuades the target to hand over personal details voluntarily. These schemes rely on trust rather than software, which makes them harder to detect than a suspicious email.
If You Are the Victim
If your identifying information has already been used to take money or open accounts, the recovery process has a specific starting point. File a complaint with the FTC through IdentityTheft.gov or by calling 1-877-438-4338, and print and save your FTC Identity Theft Affidavit before leaving the page; you will not be able to retrieve it later.10Federal Trade Commission. Identity Theft: What To Do Right Away Then file a police report with your local department, bringing the FTC affidavit, a government-issued photo ID, proof of address, and evidence of the theft. Together those documents form an official Identity Theft Report, which unlocks your strongest protections under the Fair Credit Reporting Act, including the right to require credit bureaus to block fraudulent information from your file within four business days of a valid request.11Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft IdentityTheft.gov will generate a personalized recovery plan based on what happened in your case.