Arizona Identity Theft Laws: A.R.S. 13-2008 Penalties and Rights

Arizona criminalizes identity theft under three connected statutes: A.R.S. § 13-2008 for the base offense, A.R.S. § 13-2009 for the aggravated version, which also reaches an employer who knowingly accepts a stolen identity from a job applicant, and A.R.S. § 13-2010 for trafficking in another person's identity, the most heavily punished of the three. Arizona backs all three with a mandatory police-report right, court-ordered restitution for the full amount of economic loss, and a separate civil remedy layered on top of that restitution.

This page covers the elements and penalties of all three statutes, the federal limits on Arizona's employment-intent prongs, your right to a police report, restitution and civil remedies, and where to report identity theft in Arizona. For the broader picture, see our identity theft laws hub and our guide to reporting identity theft.

Arizona's Identity Theft Statute: A.R.S. § 13-2008

Arizona's base identity theft offense makes it a crime for a person to knowingly take, purchase, manufacture, record, possess, or use any personal identifying information or entity identifying information of another person or entity, real or fictitious, without that person's or entity's consent. The statute requires intent, specifically to obtain or use the identity for any unlawful purpose, to cause loss, whether or not actual economic loss results, or to obtain or continue employment. The statute also builds in a police-report right, discussed below, and lets prosecutors consolidate multiple violations into a single complaint. It excludes minors under 21 who violate the state's alcohol statute using a fake identification. A.R.S. § 13-2008 is a class 4 felony, with no dollar-amount tiering built into the base offense itself.

Aggravated Identity Theft and the Employer Offense: A.R.S. § 13-2009

Arizona elevates identity theft to aggravated identity theft, a class 3 felony, in three situations: taking or using the identifying information of three or more people or entities; taking or using one person's identifying information and causing that person $1,000 or more in economic loss; or taking identifying information with intent to obtain employment. A separate clause in the same statute criminalizes an employer who knowingly accepts another person's identifying information from a job applicant, knowing that the applicant is not who the information identifies. That employer offense carries the same class 3 felony classification as aggravated identity theft itself.

Trafficking in Another Person's Identity: A.R.S. § 13-2010

The most severely punished offense in this statutory family is not identity theft itself but trafficking in it. Under A.R.S. § 13-2010, a person commits trafficking in the identity of another person or entity by knowingly selling, transferring, or transmitting any personal identifying information or entity identifying information of another person or entity, real or fictitious, without consent, for any unlawful purpose, to cause loss whether or not the victim actually suffers any economic loss, or to allow another person to obtain or continue employment. Trafficking is a class 2 felony, two classes above the base offense and one above the aggravated version.

This is the provision that reaches the resale and distribution side of identity theft rather than the single end user who applies the stolen information, so it is the charge that fits the bulk-data and credential markets many victims are actually harmed by. Like § 13-2008, it carves out a person under 21 who violates the state's alcohol statute.

Federal Limits on Arizona's Employment-Intent Prongs

Two of these prongs, the intent to obtain or continue employment in § 13-2008(A) and the intent to obtain employment in § 13-2009(A)(3), have been through federal preemption litigation, and the outcome shapes how they can be enforced today. In Puente Arizona v. Arpaio, 821 F.3d 1098 (9th Cir. 2016), the Ninth Circuit rejected a facial preemption challenge to Arizona's employment-related identity theft laws, vacated the district court's preliminary injunction, and remanded for the narrower as-applied challenge. The statutes themselves survived and remain enforceable.

On remand, the district court entered judgment for the plaintiffs on March 27, 2017. It declared that under the Supremacy Clause and the Immigration Reform and Control Act, the defendants are preempted from employing or relying on the Form I-9, and any other documents or information submitted to an employer solely as part of the federal employment verification process, for purposes of investigating or prosecuting violations of A.R.S. § 13-2002, § 13-2008(A), or § 13-2009(A)(3). The court permanently enjoined Maricopa County Sheriff Paul Penzone, along with his officers, agents, employees, and anyone acting in concert with them, from doing the same. The judgment carves out List A, B, or C documents identified by 8 C.F.R. § 274a.2 where they were also submitted for a purpose independent of the verification system, such as to demonstrate the ability to drive or as part of a typical employment application.

The Supreme Court reached a compatible result in Kansas v. Garcia, 589 U.S. 191 (2020), holding that state identity theft prosecutions built on tax-withholding forms were neither expressly nor impliedly preempted, even though the same false Social Security numbers also appeared on the defendants' I-9 forms. Read together, these decisions leave Arizona's employment prongs on the books while narrowing the evidence available to prove them: the I-9 and documents supplied only for federal verification are off limits, and independently submitted documents are not.

Your Right to a Police Report

Arizona law gives identity theft victims a concrete, enforceable reporting right. On request, a peace officer in any jurisdiction where an element of the offense occurred, a result of the offense occurred, or where the victim resides or is located, must take a report, and may share copies with agencies in other relevant jurisdictions. This matters in practice because identity theft frequently crosses jurisdictional lines, with the victim in one city, the thief operating from another, and the fraudulent transaction processed somewhere else entirely; Arizona's statute is written so a victim is not turned away simply because their local department did not handle the underlying crime itself.

Restitution Is Mandatory

Arizona's general sentencing statute, A.R.S. § 13-603(C), requires the sentencing court to order a convicted person to make restitution to the identity theft victim in the full amount of the economic loss as determined by the court. This is a mandatory obligation built into every qualifying sentence, not a discretionary option the court can decline to consider.

A Separate Civil Remedy on Top of Restitution

Arizona does not treat restitution as the end of a victim's options. Under A.R.S. § 13-807, an order of restitution does not preclude the victim from bringing a separate civil action and proving damages in that action in excess of the amount of restitution actually paid. In other words, restitution sets a floor, not a ceiling, and Arizona gives identity theft victims a real, independent civil remedy on top of it. The same statute also gives victims a practical advantage if they do sue: a criminal conviction, including a no-contest plea, precludes the defendant from denying the essential allegations of that offense in the later civil case.

Reporting to the Arizona Attorney General

The Arizona Attorney General's Consumer Protection & Advocacy division recommends three steps for identity theft victims: file with the FTC to obtain an Identity Theft Affidavit, report to local city or county law enforcement, and notify credit agencies and debt collectors, using the office's own letter templates. It links out to FTC guidance, the National Identity Theft Victims Assistance Network, and free credit reports from Equifax, Experian, and TransUnion. The office's contact information is 2005 N Central Ave, Phoenix, AZ 85004, (602) 542-5025. A companion general consumer-complaint channel is available online in English and Spanish, or by mail, email, or fax, with separate phone lines for Phoenix at (602) 542-5763 and Tucson at (520) 628-6648; complaints are confidential. If a business or person deceived you into handing over your information or money, our guide to Arizona scam and fraud laws explains what the Attorney General does with that complaint and when the Consumer Fraud Act lets a person sue.

Credit Freezes for Minors in Arizona

The Arizona Attorney General's site references a general security-freeze resource under its data privacy and breach-reporting section, but this page could not confirm whether Arizona has enacted its own protected-consumer or minor-specific credit freeze statute, distinct from the federal minimum. Either way, Arizona parents and guardians already have a right here: federal law, 15 U.S.C. § 1681c-1(j), requires all three nationwide credit bureaus to let a parent or guardian freeze a child's credit file for free, even before the child has a credit file at all. See our credit freeze vs. fraud alert page for how the freeze right works generally.

Federal Rights That Apply in Every State

On top of Arizona's own statutes, every identity theft victim also has federal rights that do not depend on state law. IdentityTheft.gov, run by the FTC, is a free national recovery site that builds a personal recovery plan once you describe what happened. Once you have an FTC Identity Theft Report, 15 U.S.C. § 1681c-2 (FCRA § 605B) requires a credit bureau to block fraudulent information from your report within 4 business days of receiving your documentation. Federal law has also made both credit freezes and fraud alerts free at all three bureaus since 2018, under 15 U.S.C. § 1681c-1. See our guides to reporting identity theft and credit freeze vs. fraud alert for the full mechanics of both.

No 2025-26 amendment to A.R.S. § 13-2008 or § 13-2009 surfaced during this page's research. The Arizona Legislature's own bill search tool for the 57th Legislature's 2025 and 2026 sessions was confirmed reachable, but a keyword search inside it could not be completed with the tools available this session, so treat this as a partial check rather than an exhaustive one.

Information last verified on 2026-08-13, drawn directly from A.R.S. §§ 13-2008, 13-2009, 13-603, and 13-807, and from the Arizona Attorney General's identity theft page. A.R.S. § 13-2010 and the federal preemption history were verified against primary sources on 2026-09-01. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-09-01.

Frequently Asked Questions

What is Arizona's identity theft statute?

A.R.S. § 13-2008 makes it a class 4 felony to knowingly take, possess, or use another person's identifying information without consent, with intent to use it unlawfully, cause loss, or obtain or continue employment. A.R.S. § 13-2009 elevates the offense to a class 3 felony in aggravated circumstances, and A.R.S. § 13-2010 makes trafficking in another person's identity a class 2 felony.

When does identity theft become aggravated identity theft in Arizona?

Under A.R.S. § 13-2009, identity theft becomes aggravated, a class 3 felony, when it involves three or more victims, causes a single victim $1,000 or more in economic loss, or is committed with intent to obtain employment. The same felony class applies to an employer who knowingly accepts a stolen identity from a worker. The intent-to-obtain-employment prong is subject to federal limits on using Form I-9 evidence.

What is the penalty for selling someone's personal information in Arizona?

Knowingly selling, transferring, or transmitting another person's or entity's identifying information without consent, for an unlawful purpose, to cause loss, or to allow someone to obtain or continue employment, is trafficking in the identity of another person under A.R.S. § 13-2010. It is a class 2 felony, the most severely punished offense in Arizona's identity theft family.

Can Arizona still prosecute identity theft committed to get a job?

Yes. The employment-intent prongs of A.R.S. § 13-2008(A) and § 13-2009(A)(3) remain valid law after the Ninth Circuit rejected a facial preemption challenge in Puente Arizona v. Arpaio, 821 F.3d 1098 (9th Cir. 2016). But on remand, the federal district court entered a March 27, 2017 judgment that bars using the Form I-9, and other documents submitted to an employer solely for federal employment verification, to investigate or prosecute those prongs, and permanently enjoined the Maricopa County Sheriff from doing so. Kansas v. Garcia, 589 U.S. 191 (2020), later allowed state prosecutions built on documents outside the I-9 process, such as tax-withholding forms.

Do Arizona police have to take my identity theft report?

Yes. A.R.S. § 13-2008 requires a peace officer in any jurisdiction connected to the offense, or where you live, to take a report on request, and the officer may share copies with other relevant jurisdictions.

Is restitution mandatory for identity theft in Arizona?

Yes. A.R.S. § 13-603(C) requires the sentencing court to order restitution to the victim in the full amount of the economic loss the court determines, as part of every qualifying sentence.

Can I sue an identity thief in Arizona even after criminal restitution?

Yes. A.R.S. § 13-807 allows a separate civil action for damages in excess of the restitution actually paid, and a criminal conviction precludes the defendant from denying the essential facts of the offense in that later civil case.

How do I report identity theft in Arizona?

The Arizona Attorney General recommends filing an FTC Identity Theft Affidavit, reporting to your local police department, and notifying credit agencies and debt collectors directly. You can also file a consumer complaint with the Attorney General's office at (602) 542-5763 in Phoenix or (520) 628-6648 in Tucson.