Colorado Identity Theft Laws: Penalties, Freezes, and Remedies

Colorado criminalizes identity theft under Colo. Rev. Stat. § 18-5-902, with penalties that range from a class 2 misdemeanor up to a class 4 felony depending on which subsection applies and how many victims or devices are involved. Colorado also gives residents one of the more comprehensive protected-consumer credit freeze laws in the country, reaching both minors and incapacitated adults, plus a court process to fix a criminal record mistakenly attached to an identity theft victim's name.

This page covers § 18-5-902's offenses and penalties, Colorado's protected-consumer freeze law, the factual-innocence and record-correction process, restitution and civil remedies, and where to report identity theft in Colorado. For the broader picture, see our identity theft laws hub and our guide to reporting identity theft.

Colorado's Identity Theft Statute

Colo. Rev. Stat. § 18-5-902 defines several ways a person commits identity theft. Knowingly using another person's personal identifying information, financial identifying information, or financial device without permission or lawful authority, with intent to obtain cash, credit, property, services, or anything else of value, or to make a financial payment, is one path. Knowingly possessing that same kind of information without permission, with intent to use it or let someone else use it for the same purposes, is a separate path. The statute also reaches using or possessing identifying information to make, alter, or complete a written instrument, or to acquire or use a financial device, and using or possessing identifying information to obtain a government-issued document, all without proper permission.

Penalties

Identity theft under subsections (1)(a) or (1)(c), the use-based offenses, is a class 4 felony. Identity theft under subsections (1)(b), (1)(d), or (1)(e), the possession-based offenses, is ordinarily a class 2 misdemeanor, but becomes a class 5 felony if the person possesses three or more financial devices, or the personal or financial identifying information of three or more other people. Two related offenses sit in the same part of the criminal code: criminal possession of a financial device is a class 2 misdemeanor for one device, escalating to a class 5 felony for possessing three or more devices with at least two from different account holders, and possession of identity theft tools is a straight class 5 felony.

Colorado's Protected-Consumer Credit Freeze

Colorado has its own protected-consumer credit freeze statute, and it reaches further than most states' versions. § 5-18-103(13.5) defines a "protected consumer" as someone who, at the time the freeze request is made, is either under 16 years of age, or represented by a "representative." § 5-18-103(13.9) then defines "representative" narrowly, and the wording matters: a parent of an individual who is under sixteen years of age, or a legal guardian who, pursuant to a testamentary or other trusteeship, power of attorney, or court appointment, is qualified to make decisions regarding the support, care, education, health, or welfare of an individual.

Read together, the parent category stops at 16, so a parent of a 16- or 17-year-old is not a representative unless that parent separately qualifies as a legal guardian under the second prong. The legal-guardian category carries no age limit, and that is what lets Colorado's law reach incapacitated adults rather than only minors. The statute does not use the word "conservator," so authority has to fit the trusteeship, power-of-attorney, or court-appointment language to count.

§ 5-18-112.5 requires a consumer reporting agency to place the freeze within 10 business days of confirming the request's authenticity, meaning proof of authority plus proof of identification. Subsection (10) then sets two separate fee bars, and the difference between them is easy to miss. The first applies to every protected consumer: no fee to create a record, and no fee for a request to place or remove a security freeze. The second lists more actions but protects fewer people: no fee to place, temporarily lift, temporarily lift for a specific party, or permanently remove a freeze, but only for a consumer under eighteen years of age. So an adult protected consumer with a qualifying legal guardian gets free placement and free removal, while a fee-free temporary lift is not guaranteed for that person. Colorado's law was enacted in 2018, the same year Congress added the federal minor freeze right, so it arrived roughly concurrently with the federal baseline rather than filling a gap that existed before it, giving Coloradans an independently enforceable state right on top of the federal floor.

Fixing a Criminal Record Mistaken for Yours

If a thief used your identifying information and it ended up attached to someone else's arrest, summons, complaint, indictment, or conviction, Colorado gives you a specific court process to fix it. Under § 16-5-103(2)(a), you may petition the court with jurisdiction over that case only if a criminal charge is not pending, and you must give notice to the prosecutor. Where a charge is pending, the petition is not yours to file: only the prosecuting attorney may ask the court to make the determination, though the court may also make it on its own motion. The court may decide with or without a hearing, based on declarations, affidavits, or police reports, and upon finding no reasonable cause to believe you committed the offense, "shall find" you factually innocent and issue an order certifying that determination. The court then provides that order to the Colorado Bureau of Investigation, which must modify your criminal-history record accordingly.

If your identity was stolen or used but it never became attached to an arrest, summons, complaint, indictment, or conviction, which is the more common situation, § 16-5-103(2.5) gives you a separate route: petition the district court in the county where you live for an order of factual innocence. If the court finds that your identity was stolen or used by another person, it issues an order certifying that determination. Under both routes, a court may later vacate a determination of factual innocence if the petition or its supporting information contained material misrepresentation or fraud.

A parallel administrative path lets you submit fingerprints to CBI for comparison against the arrest record; if the prints do not match, CBI must issue a letter of misidentification and correct its own records.

Restitution: Considered, Not Automatic

Colorado's general sentencing statute, § 18-1.3-603, requires every order of conviction to include consideration of restitution, but it also expressly permits the court to make a specific finding that no victim suffered a pecuniary loss and therefore decline to order any restitution at all. In practice, this means restitution must be considered in every identity theft case, but it is not an unconditional guarantee the way mandatory-restitution language in some other states' statutes is.

A Possible Civil Remedy

Colorado does not appear to have an identity-theft-specific civil damages statute comparable to some other states' laws. The closest available fit is Colorado's general civil-theft statute, § 18-4-405, which lets an owner of stolen property recover it regardless of a purchaser's good faith, and recover from the person who committed the theft the greater of $200 or three times the actual damages sustained, plus costs and reasonable attorney's fees. Whether Colorado courts have actually applied this treble-damages civil-theft remedy to identity-theft fact patterns specifically, as opposed to physical stolen property, was not confirmed via case law this session, so treat it as the closest available tool rather than a confirmed identity-theft-specific remedy, and discuss it with a licensed Colorado attorney before relying on it.

Reporting to the Colorado Attorney General

Stop Fraud Colorado, developed by the Consumer Protection Section of the Colorado Attorney General's Office, is the state's main identity theft and fraud resource. It provides a prominent "File a Complaint" button that routes to the office's complaint process, a consumer hotline at 1-800-222-4444, dedicated identity-theft educational content, a searchable database of the office's enforcement actions and settlements, and a monthly consumer-alert newsletter. When the misuse began with a scam, such as a caller who talked you into sending money or account details, our guide to Colorado scam and fraud laws covers the other places to report it and when the Colorado Consumer Protection Act lets you sue. The Attorney General's Consumer Protection section separately runs a Technology & Privacy Protection unit that handles data-security and breach-notification enforcement relevant to identity theft prevention.

Federal Rights That Apply in Every State

On top of Colorado's own statutes, every identity theft victim also has federal rights that do not depend on state law. IdentityTheft.gov, run by the FTC, is a free national recovery site that builds a personal recovery plan once you describe what happened. Once you have an FTC Identity Theft Report, 15 U.S.C. § 1681c-2 (FCRA § 605B) requires a credit bureau to block fraudulent information from your report within 4 business days of receiving your documentation. Federal law has also made both credit freezes and fraud alerts free at all three bureaus since 2018, under 15 U.S.C. § 1681c-1. See our guides to reporting identity theft and credit freeze vs. fraud alert for the full mechanics of both.

Recent Change: SB25-179

In 2025, Colorado enacted SB25-179, the Sunset Identity Theft & Financial Deterrence Act, which continues the state's Identity Theft and Financial Fraud Deterrence Act until September 1, 2036. The bill repeals the program's oversight board and its dedicated cash-fund structure in favor of general-fund appropriations, and lets the Department of Public Safety accept gifts, grants, and donations to help staff the state's identity theft investigators unit. This was a funding and governance reauthorization, not a change to the criminal offense, its penalties, or the victim-rights provisions described above.

Information last verified on 2026-09-02, drawn directly from Colo. Rev. Stat. §§ 18-5-902, 5-18-103, 5-18-112.5, 16-5-103, and 18-4-405, and from SB25-179 and Stop Fraud Colorado. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-09-02.

Frequently Asked Questions

What is Colorado's identity theft statute?

Colo. Rev. Stat. § 18-5-902 criminalizes knowingly using or possessing another person's personal, financial, or financial-device identifying information without permission, with intent to obtain something of value, make a payment, or complete a written instrument or government document.

Is identity theft a felony in Colorado?

It depends on the subsection. Using the information to obtain something of value is a class 4 felony. Merely possessing it with intent to use it is ordinarily a class 2 misdemeanor, but becomes a class 5 felony if three or more devices or victims are involved.

Can I freeze my child's credit for free in Colorado?

Yes. Colorado's protected-consumer freeze law covers consumers under 16, and also covers a consumer of any age who has a qualifying legal guardian under § 5-18-103(13.9). Under § 5-18-112.5(10), creating the record and placing or removing the freeze carries no fee for any protected consumer, and the broader fee bar that also covers temporary lifts applies to consumers under 18.

How do I fix a criminal record that was created using my stolen identity in Colorado?

If no criminal charge is pending, petition the court with jurisdiction over the case under § 16-5-103(2)(a), giving notice to the prosecutor. If a charge is pending, only the prosecuting attorney may ask the court for that determination, though the court can also act on its own motion. If the court finds no reasonable cause to believe you committed the offense, it must find you factually innocent and provide the order to the Colorado Bureau of Investigation, which corrects your criminal-history record. If your identity was stolen but never attached to an arrest or charge, § 16-5-103(2.5) lets you petition the district court in the county where you live instead.

Is restitution guaranteed for identity theft victims in Colorado?

Not automatically. Colorado's sentencing law requires courts to consider restitution in every case, but a court can decline to order it if it specifically finds the victim suffered no pecuniary loss.

What did SB25-179 change about Colorado identity theft law?

SB25-179, enacted in 2025, reauthorized Colorado's Identity Theft and Financial Fraud Deterrence Act through 2036 and changed its funding and oversight structure. It did not change the criminal identity theft statute, its penalties, or victim rights.