Is Identity Theft a Felony? Use of Personal Information and Penalties by State (2026)

Yes — in most U.S. jurisdictions, identity theft is a felony. The critical distinction is that identity theft is the unauthorized USE of another person's identifying information, not the dollar loss caused. That is why many states make it a felony regardless of how much money was actually obtained: the offense is complete when you knowingly use the identifying information without authorization, with intent to defraud. In roughly 30 states and the District of Columbia, the core identity-theft statute is a felony at any dollar amount — including Alabama, Arizona, Arkansas, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Kansas, Kentucky, Michigan, Nevada, New Hampshire, New Jersey, New Mexico, North Carolina, North Dakota, Ohio, Oregon, South Carolina, South Dakota, Tennessee, Texas, Utah, Washington, West Virginia, and Wisconsin. In the remaining states, the offense is dollar-graded: smaller amounts are misdemeanors and larger amounts are felonies, with thresholds ranging from $200 (Virginia) to $2,500 (Pennsylvania). Federal identity theft under 18 U.S.C. § 1028 is a felony, and aggravated identity theft under 18 U.S.C. § 1028A carries a mandatory 2-year consecutive prison sentence that a judge cannot reduce, suspend, or run concurrently. If you are charged with identity theft, consult a qualified criminal defense attorney in your jurisdiction immediately — the grading, penalties, and enhancements vary significantly by state and by the specific facts of your case.

Identity theft is the crime of obtaining, possessing, transferring, or using another person's personal identifying information without that person's authorization, consent, or permission, with intent to defraud for the offender's own benefit or the benefit of a third person. 'Personal identifying information' is defined broadly in every state: it includes names, dates of birth, Social Security numbers, driver's license numbers, bank account numbers, credit and debit card numbers, personal identification numbers (PINs), biometric data (fingerprints, facial geometry), electronic identification numbers, passwords, mother's maiden name, employee identification numbers, insurance information, and any other number or information that could be used to access financial resources, obtain identification documents, obtain benefits, or act as identification. The unlawful purpose is typically to obtain money, credit, goods, services, real property, medical information, employment, or to avoid prosecution, or to harass the victim. The defining feature is the unauthorized USE of the identifying information — the offense is complete when you knowingly use the information without authorization with intent to defraud, even if no money is successfully obtained. This is what distinguishes identity theft from ordinary theft or fraud: ordinary theft requires the actual taking of property, while identity theft criminalizes the unauthorized use of the information itself. Many states also criminalize the possession of identifying information of multiple persons (creating an inference of intent to defraud), the production or transfer of false identification documents, the trafficking in stolen identities, and the possession of identity-theft tools.

Identity theft, fraud, and theft are related but distinct offenses. Theft (larceny) is the unlawful taking and carrying away of someone else's property with intent to permanently deprive the owner of it — the focus is on the property taken and its value. Fraud is a broader category covering deception for financial or personal gain, including false pretenses, forgery, check fraud, credit card fraud, and wire fraud — the focus is on the deception and the harm caused. Identity theft is a specific form of fraud that targets the use of another person's identifying information without authorization — the focus is on the unauthorized use of the identifying information itself, not necessarily the dollar loss. This distinction is why many states make identity theft a felony regardless of the amount obtained: the offense is the unauthorized use, not the loss. In contrast, ordinary theft and fraud are typically graded by the dollar value of the property or loss — small amounts are misdemeanors, larger amounts are felonies, with thresholds like $500, $1,000, $1,500, or $5,000 depending on the state. Identity theft charges are frequently filed alongside related charges: forgery, credit card fraud, check fraud, false personation, computer fraud, wire fraud, and larceny. The combination of charges can significantly affect sentencing exposure, especially when the dollar amounts trigger higher felony classes under the related statutes. In practice, prosecutors often add identity theft counts to fraud or theft cases to take advantage of the felony-at-any-amount grading that many state identity-theft statutes provide.

In approximately 30 states, the core identity-theft statute is a felony regardless of the dollar amount obtained, because the offense is the unauthorized use of the identifying information, not the loss. These states include: Alabama (Class B felony), Arizona (Class 4 felony), Arkansas (Class C felony), Colorado (Class 4 felony), Connecticut (Class D felony at minimum), Delaware (Class D felony), Florida (third-degree felony), Georgia (felony 1–10 years), Hawaii (Class C felony at minimum), Idaho (felony under § 18-3126), Illinois (Class 4 felony at minimum), Indiana (Class 6 felony), Kansas (severity level 8 nonperson felony), Kentucky (Class D felony), Michigan (felony up to 5 years), Nevada (category B felony), New Hampshire (Class A felony), New Jersey (crime of the fourth degree — an indictable offense/felony), New Mexico (fourth-degree felony), North Carolina (Class G felony), North Dakota (Class C felony at minimum under subsection 2), Ohio (fifth-degree felony), Oregon (Class C felony), South Carolina (felony up to 10 years), South Dakota (Class 6 felony), Tennessee (Class D felony), Texas (state jail felony at minimum), Utah (third-degree felony), Washington (Class C felony at minimum), West Virginia (felony up to 5 years), and Wisconsin (Class H felony). In these states, the dollar amount obtained affects the sentencing within the felony range or elevates the felony class, but the base offense is a felony. The rationale is that the harm of identity theft extends beyond the immediate financial loss — it includes the cost and time of correcting credit reports, clearing fraudulent debts, and restoring the victim's good name, which can take months or years regardless of the dollar amount involved.

States that grade identity theft use several tiering mechanisms. DOLLAR LOSS: The most common approach is to tier by the value of the credit, money, goods, or services obtained. Common thresholds include $200 (Virginia — felony above), $250 (Mississippi — discretionary misdemeanor below), $300 (Louisiana, New York — felony above), $500 (Illinois, Iowa, Maryland, Missouri, Nebraska — felony above), $1,000 (DC, Montana, Wyoming — felony above), $1,500 (Minnesota, Nebraska upper tier, Texas for theft tiers), and $2,500 (Pennsylvania — felony above). In Louisiana, the tiers are granular: under $300 (misdemeanor, 6 months), $300–$500 (felony, 3 years), $500–$1,000 (felony, 5 years), $1,000+ (felony, 10 years). NUMBER OF IDENTITIES OR VICTIMS: Many states tier by the number of persons whose identifying information was used, possessed, or transferred. Florida imposes mandatory minimum sentences at 10, 20, and 30 victims. Texas tiers by the number of items: state jail felony (under 5), third-degree (5–9), second-degree (10–49), first-degree (50+). New Jersey tiers by victims: fourth degree (1 victim), third degree (2–4), second degree (5+). Virginia: Class 5 felony for 5+ persons, Class 4 felony for 50+. Indiana: Class 5 felony for 100+ persons. Minnesota: felony for 2+ direct victims, enhanced for 8+. California: felony treatment more likely for 10+ persons' information. North Carolina: Class F felony for 3+ persons. VICTIM TYPE: Nearly every state has enhancements for vulnerable victims. The elderly enhancement is the most common — Alabama (1.5x for 65+), Arkansas (Class B felony for elder/disabled), Connecticut (lower thresholds for 60+), Louisiana (mandatory minimums for 60+/disabled/under 17), Ohio (enhanced class for elderly/disabled adult), Pennsylvania (one grade higher for 60+/care-dependent/under 18), Texas (next higher category for elderly), and others. Florida makes use of a minor's identifying information a second-degree felony regardless of amount. PRIOR CONVICTIONS: Most states enhance penalties for second or subsequent identity-theft convictions. Alabama (1.5x), Illinois (Class 3 for second under-$300), Michigan (up to 15 years for third), Mississippi (up to 10 years for second), Missouri (any amount becomes felony), New York (Class E felony for second), and others escalate the classification or the sentencing range for repeat offenders.

Federal identity theft law is layered across three main statutes. 18 U.S.C. § 1028 — Fraud and Related Activity in Connection with Identification Documents — criminalizes producing, transferring, or possessing identification documents, authentication features, document-making implements, or means of identification of another person, knowingly and without lawful authority. Penalties: up to 15 years for the standard serious offenses (production/transfer of US-issued IDs, birth certificates, driver's licenses; production/transfer of 5+ documents; offenses involving $1,000+); up to 5 years for lesser offenses; up to 20 years if the offense facilitates drug trafficking or a crime of violence, or if there is a prior conviction under this section; up to 30 years if the offense facilitates domestic or international terrorism; and up to 1 year for any other case. Fines can reach $250,000 for individuals ($500,000 for organizations). Forfeiture of personal property used in the offense is provided. 18 U.S.C. § 1028A — Aggravated Identity Theft, enacted by the Identity Theft Penalty Enhancement Act of 2004 — imposes a MANDATORY 2-year prison sentence that must run CONSECUTIVELY to any sentence for the underlying predicate felony, with no judicial discretion to reduce, suspend, or run it concurrently. The mandatory minimum increases to 5 years consecutive when the offense facilitates terrorism. Predicate felonies include: theft of public money (§ 641), bank theft/embezzlement (§ 656), theft from employee benefit plans (§ 664), false personation of citizenship (§ 911), false statements in firearm acquisition (§ 922(a)(6)), Chapter 47 fraud and false statements (excluding § 1028A and § 1028(a)(7)), Chapter 63 mail/bank/wire fraud, Chapter 69 nationality and citizenship, Chapter 75 passports and visas, Social Security Act false statements, immigration offenses, and others. The Supreme Court in Flores-Figueroa v. United States (2009) held that the government must prove the defendant knew the means of identification belonged to another person. In Dubin v. United States (2023), the Court narrowed the scope, holding § 1028A applies only when the defendant's use of another person's means of identification is 'at the crux of what makes the underlying offense criminal.' Approximately 99% of defendants convicted under § 1028A are sentenced to prison. 18 U.S.C. § 1029 — Fraud and Related Activity in Connection with Access Devices — criminalizes producing, using, trafficking in, or possessing counterfeit or unauthorized access devices (credit cards, account numbers, electronic serial numbers, mobile identification numbers) with intent to defraud. Penalties: up to 10 years (first offense, certain subsections), 15 years (first offense, other subsections), and 20 years (repeat offense). Forfeiture and extraterritorial application are provided. Federal prosecution typically occurs in large-scale, multi-state, or organized schemes; single-victim, in-state cases are usually prosecuted under state law.

Restitution is available in every jurisdiction and is mandatory in most. Restitution typically covers not only the direct financial loss (the value of money, goods, or services fraudulently obtained) but also the victim's costs of correcting credit history, clearing fraudulent debts and liens, attorney fees, lost wages (including time spent remediating the harm), costs of civil or administrative proceedings to satisfy fraudulent obligations, and in some states the costs of monitoring and repairing credit reports for a reasonable period. States with specific identity-theft restitution provisions include Alabama, Arkansas, California, Colorado, Connecticut, Delaware, DC, Florida, Georgia, Hawaii, Illinois, Iowa, Kansas, Kentucky, Louisiana, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Jersey, New Mexico, New York, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Virginia, Washington, Wisconsin, and Wyoming. Several states also provide for forfeiture of property used in or obtained through identity theft: Iowa, Kansas, Kentucky, Michigan, and Tennessee. CIVIL LIABILITY: Some states provide a civil cause of action for identity-theft victims. California, Texas, and New York allow victims to sue for actual damages, attorney fees, and in some cases statutory damages without having to prove a specific dollar loss. The federal Fair Credit Reporting Act (FCRA) gives victims rights to dispute fraudulent accounts, place fraud alerts, and obtain blockage of fraudulent information from credit reports. COLLATERAL CONSEQUENCES: A felony identity-theft conviction carries long-term consequences beyond the sentence. Identity theft is widely treated as a crime involving moral turpitude (CIMT), which can trigger immigration consequences including deportation, denial of re-entry, or denial of naturalization for non-citizens. A felony conviction results in loss of firearm rights in most jurisdictions. Professional licensing consequences, employment barriers, housing application impacts, and the permanent criminal record itself can follow the convicted person for years. Restitution orders are often enforceable as civil judgments, meaning they can survive bankruptcy and follow the defendant for decades.

If you are charged with identity theft, take it seriously — in many states a conviction means a felony record and prison time even where no money was obtained. First, do not speak to law enforcement without an attorney present; anything you say can and will be used against you. Second, consult a qualified criminal defense attorney licensed in your jurisdiction immediately — identity theft statutes are complex, frequently amended, and the grading and enhancements vary significantly by state. Third, understand the grading in your state: is it felony at any amount, or dollar-graded? Are there enhancements for the number of victims, the victim's age, your prior record, or gang/organized-crime connections? Fourth, gather and preserve evidence: authorization or consent from the alleged victim (if you had it), lack of intent to defraud, mistaken identity, or evidence that the identifying information was used for a lawful purpose. Common defenses include: lack of intent to defraud (the statute requires intent), authorization or consent from the victim, lack of knowledge that the information belonged to another person (the Flores-Figueroa defense for federal aggravated identity theft), statute of limitations (Alabama has a 7-year limit; most states have 3–6 years), and insufficient evidence. Fifth, consider the collateral consequences: immigration consequences (CIMT), firearm rights, professional licensing, and employment. Sixth, if you are a victim of identity theft, report it to the FTC at IdentityTheft.gov, place a fraud alert on your credit reports, file a police report, dispute fraudulent accounts, and consider an identity theft passport if your state offers one (Arkansas, Delaware, Iowa, Maryland, Mississippi, Montana, Nevada, New Mexico, Ohio, Oklahoma, and Virginia have passport programs). This is informational only, not legal advice — consult a qualified attorney for your specific situation.