Identity Theft Laws: Federal Rules and State Penalties

Identity theft is a federal crime under 18 U.S.C. § 1028, and every state also has its own identity theft or identity fraud statute layered on top of it. If someone has used your name, Social Security number, or other identifying information without your permission, both bodies of law give you specific tools to fight back, and the Federal Trade Commission runs a free recovery site built for exactly this situation.

This hub covers what identity theft means under federal and state law, the FTC's free recovery process at IdentityTheft.gov, the warning signs that your information has already been misused, a scam the FTC specifically warned about in January 2026, and a state-by-state look at how each state penalizes the crime. For the specific mechanics of reporting identity theft, freezing your credit versus placing a fraud alert, or tax-related identity theft, see the dedicated pages linked throughout this hub and in the Related Resources section below.

What Identity Theft Means Under Federal and State Law

«Identity theft» is not one single crime with one definition nationwide. At the federal level, 18 U.S.C. § 1028 criminalizes producing or transferring false identification documents, possessing five or more of them with intent to defraud, and knowingly using another person's «means of identification» without lawful authority to commit an unlawful act. Nearly every state also has its own identity theft or identity fraud statute, and the definitions do not line up with each other or with the federal statute. Some states define the offense around the dollar value the offender obtained; others tier it by the severity of the underlying crime the offender committed while impersonating the victim, or by the number of people victimized. There is no single national identity theft law that applies the same way everywhere in the country, and a claim that federal law resolves a specific identity theft question is usually incomplete without also checking the relevant state statute.

Federal penalties under § 1028 range from up to 5 years for basic unauthorized-use or possession offenses, up to 15 years for producing or transferring five or more false identification documents or for identity theft that nets the offender $1,000 or more, up to 20 years if the offense facilitated drug trafficking or a violent crime or followed a prior conviction under the statute, and up to 30 years if it facilitated an act of terrorism. A related statute, 18 U.S.C. § 1028A, defines «aggravated identity theft» and adds an additional mandatory prison term, served consecutively, when identity theft is committed in furtherance of certain other federal felonies. Confirm the exact current length of that additional term directly against the statute's text before relying on a specific number, since federal sentencing provisions are amended from time to time.

Every state's own penalty structure, current as of this page's last verification date, is listed in the table further down this page.

The FTC's Free Recovery Site: IdentityTheft.gov

If you believe your identity has already been misused, not merely exposed in a data breach, IdentityTheft.gov is the place to start. It is a free site run by the Federal Trade Commission, and its own homepage describes the process in three steps: "Tell us what happened. We'll ask some questions about your situation... Get a recovery plan. We'll use that info to create a personal recovery plan... Put your plan into action. If you create an account, we'll walk you through each recovery step, update your plan as needed, track your progress, and pre-fill forms and letters for you." Creating an account is optional but unlocks the pre-filled letters and step tracking, which most victims find worth the few minutes it takes.

The recovery plan IdentityTheft.gov generates is tailored to what actually happened. Someone whose credit card was opened in their name gets a different plan than someone whose tax return was rejected as a duplicate, or someone whose child's Social Security number turned up on a new utility account. See our guide to how to report identity theft for what an FTC Identity Theft Report actually does once you have one, including the specific federal law that lets you use it to get fraudulent information removed from your credit report.

IdentityTheft.gov's own banner carries a warning worth repeating here: "It is illegal to knowingly file a false identity theft report with the Federal Trade Commission. Filing a false report may result in a fine, imprisonment, or both." That warning exists in part because of a scheme the FTC specifically flagged in early 2026, covered below.

Warning Signs Your Identity Has Already Been Misused

Identity theft often surfaces somewhere other than where it actually happened. IdentityTheft.gov lists nine specific warning signs: unexplained withdrawals from your bank account; bills or mail that stops arriving as expected; merchants who refuse your checks; debt collectors calling about debts that are not yours; unfamiliar accounts or charges on your credit report; medical providers billing you for services you never received; a health plan rejecting a legitimate claim because you supposedly already reached a benefits limit; a health plan refusing to cover you because your records show a condition you do not have; and the IRS notifying you that more than one tax return was filed in your name, or that you have income from an employer you have never worked for.

One warning sign surprises most people: in some cases a thief has given a victim's name to police during an arrest, so the first sign of identity theft is a summons or a warrant for something the real person never did. If any of these signs apply to you, IdentityTheft.gov's recovery plan is built to address each one specifically, and our guide to how to report identity theft walks through what happens next.

If the identity theft you are dealing with traces back to a specific company's data breach rather than an unknown source, our guides on what to do after a data breach and how to freeze your credit for free cover that situation in full, step-by-step depth.

The "File a False Report to Erase Your Debt" Scam

In a consumer alert dated January 5, 2026, the FTC warned that social media influencers were coaching people to file a false identity theft report as a way to remove accurate debt from their credit report, a scheme sometimes marketed as a «credit sweep.» The FTC's own language leaves no ambiguity: "Some online influencers are telling people they have a fix: file a false identity theft report about a debt they owe. That's advice not to take. Filing a false identity theft report may leave you worse off, and it's a crime that could get you a fine, imprisonment, or both." The FTC adds plainly that "credit repair companies can't legally remove information from your credit report if it's accurate and current."

This scheme trades on a real, legitimate right, the ability to get fraudulent information blocked from your credit report after filing an actual FTC Identity Theft Report, and misapplies it to debt that genuinely belongs to the person filing. The block mechanic exists for real identity theft victims. Using it to erase a debt you actually owe is fraud on the credit bureau and on the FTC itself, and it can expose you to criminal liability on top of the debt you started with. If a debt on your credit report is inaccurate, outdated, or otherwise disputable, real tools exist: a standard credit-report dispute, negotiating directly with the creditor, or, if the debt truly is the product of identity theft, an actual FTC Identity Theft Report. Filing a false one is not among them.

Identity Theft Laws by State

Every state criminalizes identity theft, but the specific statute, and the penalty attached to it, differs meaningfully from state to state. The table below lists each state's primary identity theft or identity fraud statute and its penalty classification where that classification could be confirmed against the statutory text. States amend criminal statutes regularly, and penalty tiers are frequently set by dollar value, victim count, or repeat-offense status, so treat this table as a starting point and confirm the current text against your state's official code before relying on a specific classification for anything consequential.

* Statute citation identified in the recordingLaw legal research corpus. The specific penalty classification for this offense was not independently confirmed against the full statutory text before this page's publication. Consult the official state code, linked from your state legislature's website, for the current penalty.

** No single statute specifically titled around identity theft was confirmed for this state during research for this page. The state may address identity theft through a differently titled criminal statute or through its consumer-protection code. Consult the official state code directly.

For the federal rights that apply regardless of which state you live in, including a free credit freeze, a fraud alert, and getting fraudulent information blocked from your credit report, see how to report identity theft and credit freeze vs. fraud alert.

Information last verified on 2026-08-13, drawn directly from IdentityTheft.gov, 18 U.S.C. § 1028, 15 U.S.C. §§ 1681c-1 and 1681c-2, and the recordingLaw legal research corpus for the state penalty table. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert
• Tax Identity Theft: Form 14039 and the IP PIN Program
• Child Identity Theft: Warning Signs and the Minor Freeze Right
• Medical Identity Theft: HIPAA Rights and Fixing Your Records
• Synthetic Identity Theft: How It Works
• How to Freeze Your Credit After a Data Breach (Free)
• What To Do After a Data Breach: A Step-by-Step Guide

---

Last updated: 2026-08-13.