Colorado Identity Theft Laws: Penalties, Freezes, and Remedies

Colorado criminalizes identity theft under Colo. Rev. Stat. § 18-5-902, with penalties that range from a class 2 misdemeanor up to a class 4 felony depending on which subsection applies and how many victims or devices are involved. Colorado also gives residents one of the more comprehensive protected-consumer credit freeze laws in the country, reaching both minors and incapacitated adults, plus a court process to fix a criminal record mistakenly attached to an identity theft victim's name.

This page covers § 18-5-902's offenses and penalties, Colorado's protected-consumer freeze law, the factual-innocence and record-correction process, restitution and civil remedies, and where to report identity theft in Colorado. For the broader picture, see our identity theft laws hub and our guide to reporting identity theft.

Colorado's Identity Theft Statute

Colo. Rev. Stat. § 18-5-902 defines several ways a person commits identity theft. Knowingly using another person's personal identifying information, financial identifying information, or financial device without permission or lawful authority, with intent to obtain cash, credit, property, services, or anything else of value, or to make a financial payment, is one path. Knowingly possessing that same kind of information without permission, with intent to use it or let someone else use it for the same purposes, is a separate path. The statute also reaches using or possessing identifying information to make, alter, or complete a written instrument, or to acquire or use a financial device, and using or possessing identifying information to obtain a government-issued document, all without proper permission.

Penalties

Identity theft under subsections (1)(a) or (1)(c), the use-based offenses, is a class 4 felony. Identity theft under subsections (1)(b), (1)(d), or (1)(e), the possession-based offenses, is ordinarily a class 2 misdemeanor, but becomes a class 5 felony if the person possesses three or more financial devices, or the personal or financial identifying information of three or more other people. Two related offenses sit in the same part of the criminal code: criminal possession of a financial device is a class 2 misdemeanor for one device, escalating to a class 5 felony for possessing three or more devices with at least two from different account holders, and possession of identity theft tools is a straight class 5 felony.

Colorado's Protected-Consumer Credit Freeze

Colorado has its own protected-consumer credit freeze statute, and it reaches further than most states' versions. § 5-18-103(13.5) defines a "protected consumer" as someone who, at the time the freeze request is made, is either under 16 years of age, or represented by a "representative," a term that includes a parent of a minor and a legal guardian, conservator, or other person authorized by power of attorney or court order to make decisions for the consumer's support, care, education, health, or welfare. That second category means Colorado's law explicitly covers incapacitated adults with a qualifying representative, not just minors.

§ 5-18-112.5 requires a consumer reporting agency to place the freeze within 10 business days of confirming the request's authenticity, meaning proof of authority plus proof of identification, and charges no fee to create a record or to place, lift, or remove the freeze for a protected consumer, with an explicit bar on any fee for anyone under 18. Colorado's law was enacted in 2018, the same year Congress added the federal minor freeze right, so it arrived roughly concurrently with the federal baseline rather than filling a gap that existed before it, giving Coloradans an independently enforceable state right on top of the federal floor.

Fixing a Criminal Record Mistaken for Yours

If a thief used your identifying information and it ended up attached to someone else's arrest, summons, complaint, indictment, or conviction, Colorado gives you a specific court process to fix it. Under § 16-5-103, you can petition the court with jurisdiction over the case; the court may decide with or without a hearing, based on declarations, affidavits, or police reports, and upon finding no reasonable cause to believe you committed the offense, "shall find" you factually innocent, issue a certification order, and notify the Colorado Bureau of Investigation to correct your criminal-history record. A parallel administrative path lets you submit fingerprints to CBI for comparison against the arrest record; if the prints do not match, CBI must issue a letter of misidentification and correct its own records.

Restitution: Considered, Not Automatic

Colorado's general sentencing statute, § 18-1.3-603, requires every order of conviction to include consideration of restitution, but it also expressly permits the court to make a specific finding that no victim suffered a pecuniary loss and therefore decline to order any restitution at all. In practice, this means restitution must be considered in every identity theft case, but it is not an unconditional guarantee the way mandatory-restitution language in some other states' statutes is.

A Possible Civil Remedy

Colorado does not appear to have an identity-theft-specific civil damages statute comparable to some other states' laws. The closest available fit is Colorado's general civil-theft statute, § 18-4-405, which lets an owner of stolen property recover it regardless of a purchaser's good faith, and recover from the person who committed the theft the greater of $200 or three times the actual damages sustained, plus costs and reasonable attorney's fees. Whether Colorado courts have actually applied this treble-damages civil-theft remedy to identity-theft fact patterns specifically, as opposed to physical stolen property, was not confirmed via case law this session, so treat it as the closest available tool rather than a confirmed identity-theft-specific remedy, and discuss it with a licensed Colorado attorney before relying on it.

Reporting to the Colorado Attorney General

Stop Fraud Colorado, developed by the Consumer Protection Section of the Colorado Attorney General's Office, is the state's main identity theft and fraud resource. It provides a prominent "File a Complaint" button that routes to the office's complaint process, a consumer hotline at 1-800-222-4444, dedicated identity-theft educational content, a searchable database of the office's enforcement actions and settlements, and a monthly consumer-alert newsletter. The Attorney General's Consumer Protection section separately runs a Technology & Privacy Protection unit that handles data-security and breach-notification enforcement relevant to identity theft prevention.

Federal Rights That Apply in Every State

On top of Colorado's own statutes, every identity theft victim also has federal rights that do not depend on state law. IdentityTheft.gov, run by the FTC, is a free national recovery site that builds a personal recovery plan once you describe what happened. Once you have an FTC Identity Theft Report, 15 U.S.C. § 1681c-2 (FCRA § 605B) requires a credit bureau to block fraudulent information from your report within 4 business days of receiving your documentation. Federal law has also made both credit freezes and fraud alerts free at all three bureaus since 2018, under 15 U.S.C. § 1681c-1. See our guides to reporting identity theft and credit freeze vs. fraud alert for the full mechanics of both.

Recent Change: SB25-179

In 2025, Colorado enacted SB25-179, the Sunset Identity Theft & Financial Deterrence Act, which continues the state's Identity Theft and Financial Fraud Deterrence Act until September 1, 2036. The bill repeals the program's oversight board and its dedicated cash-fund structure in favor of general-fund appropriations, and lets the Department of Public Safety accept gifts, grants, and donations to help staff the state's identity theft investigators unit. This was a funding and governance reauthorization, not a change to the criminal offense, its penalties, or the victim-rights provisions described above.

Information last verified on 2026-08-13, drawn directly from Colo. Rev. Stat. §§ 18-5-902, 5-18-103, 5-18-112.5, 16-5-103, and 18-4-405, and from SB25-179 and Stop Fraud Colorado. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.