District of Columbia Identity Theft Laws: Statute, Penalties, and Victim Rights

The District of Columbia's identity theft law, D.C. Code § 22-3227.02, splits the offense into two degrees based mainly on dollar value, and it gives victims an unusual additional right: a court petition to correct false information a thief created in DC's own public records. This article covers the DC statute, its penalty structure, the record-correction remedy, and how the federal identity theft framework applies to District residents.

This page addresses District of Columbia law specifically. For the federal reporting process, the FTC's free recovery tool, and the credit-freeze and fraud-alert rights available nationwide, see our identity theft laws hub and our guide to how to report identity theft.

DC's Identity Theft Statute: D.C. Code § 22-3227.02

A person commits identity theft in the District when they knowingly, and without the other person's consent, do one of three things with someone else's personal identifying information: use it to obtain or attempt to obtain property fraudulently, obtain or possess it with intent to use it fraudulently or let someone else use it fraudulently, or use it to identify themselves to a law enforcement officer in order to avoid arrest or detection, or to conceal a crime.

"Personal identifying information" is defined broadly under § 22-3227.01: name, address, phone number, date of birth, mother's maiden name, government identification numbers, financial account details, biometric data, and any other number or piece of information that could be used to access financial resources or medical information, or to obtain identification. "Property" incorporates DC's general theft-statute definition and expressly includes credit. "Financial injury" covers all monetary costs tied to the identity theft, including attorney's fees, credit-repair costs, and lost wages.

Penalties: First-Degree and Second-Degree Identity Theft

DC Code § 22-3227.03 sets penalties primarily by dollar amount. First-degree identity theft applies when the property obtained or attempted, or the financial injury caused, is $1,000 or more. It is punishable by a fine that is the greater of the amount set under the District's general criminal fine schedule at D.C. Code § 22-3571.01, which caps an individual's fine at $25,000 for an offense punishable by 10 years under § 22-3571.01(b)(7), twice the value of the property obtained, or twice the amount of the financial injury, imprisonment for up to 10 years, or both.

Second-degree identity theft applies in two situations. The first is any amount under $1,000, described in the statute as property or financial injury that "has some value." The second applies regardless of dollar value: identity theft that causes another person to be falsely accused of, or arrested for, a crime because someone misused their personal identifying information. Second-degree identity theft is punishable by a fine under the same criminal fine schedule, capped at $1,000 for an offense punishable by 180 days under § 22-3571.01(b)(4), or imprisonment for up to 180 days, or both.

Those ceilings are not the whole picture. Subsection (c) of § 22-3227.03, headed "Enhanced penalty," now reads only "Repealed." It was struck by D.C. Law 21-166, effective November 23, 2016, and the same act amended D.C. Code § 22-3601 to add identity theft to the offenses that carry the District's enhanced penalty for crimes against senior citizen victims. Under § 22-3601(a), an offense committed against a person who was 65 or older at the time may be punished by a fine of up to 1 1/2 times the maximum fine otherwise authorized and imprisonment for up to 1 1/2 times the maximum term otherwise authorized, which takes first-degree identity theft to 15 years. Section 22-3601(c) gives the accused an affirmative defense, established by a preponderance of the evidence, that they knew or reasonably believed the victim was not 65 or older, or could not have determined the victim's age because of the manner in which the offense was committed.

Restitution and Correcting DC Public Records

Under D.C. Code § 22-3227.04, a court may, in addition to any other penalty, order a convicted defendant to pay restitution for the full amount of the victim's financial injury. This restitution provision, added by the Identity Theft Amendment Act of 2003, is discretionary rather than mandatory.

DC also gives victims a distinct, non-monetary remedy that many states do not offer explicitly: correction of public records. Under D.C. Code § 22-3227.05(a), if a person is convicted, adjudicated delinquent, or found not guilty by reason of insanity of identity theft, the court may issue orders necessary to correct any District public record that contains false information resulting from the offense, and District agencies must comply with an order issued under that subsection within 30 days. Separately, subsection (b) lets any person who alleges they were victimized by identity theft, even without waiting for a conviction, petition the court for an expedited judicial determination that a DC public record contains false information from a violation of the identity theft statute. If the petitioner meets a clear-and-convincing-evidence standard, the court can order the correction, but the statute's 30-day agency-compliance deadline is textually tied to subsection (a) orders; it does not by its own terms extend to a subsection (b) civil-petition order.

DC's identity theft law also reaches conduct connected to the District even when the offender was never physically present here. Under § 22-3227.06, DC has extraterritorial jurisdiction over identity theft committed against a DC resident or DC-located victim, or where any part of the offense occurs in the District, which matters for online and out-of-state schemes that target DC residents.

Security Freeze for Minors: Rely on Federal Law

The District's general Consumer Security Freeze statute (D.C. Code §§ 28-3861 through 28-3864) does not include a minor or protected-consumer provision. It defines "consumer" simply as "an individual who resides in the District of Columbia," with no age qualifier and no separate process for a parent, guardian, or conservator to place a freeze for someone who does not yet have a credit file. DC residents therefore rely on the federal minors' and protected-consumers' freeze right under 15 U.S.C. § 1681c-1(j), added in 2018, rather than a District-specific statute.

Reporting Identity Theft in DC

The Office of the Attorney General for the District of Columbia lays out a four-step process for identity theft victims. First, file a police report with the Metropolitan Police Department's Financial and Cyber Crimes Unit, reachable at 202-727-4159 or online. Second, immediately call the security or fraud department of each affected financial institution, and follow up in writing by certified mail. Third, pull your free annual credit reports and review them for unfamiliar inquiries or accounts. Fourth, place fraud alerts or security freezes with the credit bureaus.

The OAG's consumer alert does not cite the identity theft statute by number and does not advertise a dedicated OAG identity-theft hotline separate from general consumer complaints, which go through 202-442-9828, consumer.protection@dc.gov, or an online complaint portal. That channel handles a business or seller that scammed or misled you, and our guide to D.C. scam and fraud laws explains what the OAG does with those complaints and when a consumer can sue a merchant. For the identity-theft hotline itself, the OAG points residents to the FTC's 1-877-ID-THEFT (438-4338) line and IdentityTheft.gov.

Federal Protections That Apply in DC

DC's state-law rights layer onto the federal identity theft framework available to every resident of every state. Under FCRA section 605B (15 U.S.C. § 1681c-2), a victim who submits an identity theft report can have a credit reporting agency block fraudulent information from their credit file. Under 15 U.S.C. § 1681c-1, every consumer, including DC residents, has had the right to a free security freeze and to one-year or seven-year extended fraud alerts since a 2018 federal law made freezes free nationwide. IdentityTheft.gov provides a free FTC Identity Theft Report, a personalized recovery plan, and pre-filled dispute letters. For the full mechanics of freezes, fraud alerts, and the FTC reporting process, see our how to report identity theft and credit freeze vs. fraud alert guides.

2025-26 Currency

The most recent amendment to § 22-3227.03 on record is D.C. Law 21-166, effective November 23, 2016, and it was substantive rather than technical: it repealed the section's own enhanced-penalty subsection, and in the same act added identity theft to the list of offenses carrying the senior-victim enhancement in § 22-3601. The enhancement statute itself was amended more recently, by D.C. Law 25-175 effective June 8, 2024. No 2025-26 amendment to either section was found.

Information last verified on 2026-08-13, drawn directly from the DC Code and the Office of the Attorney General's consumer alert page. This article has not yet been reviewed by a licensed lawyer and is general legal information, not legal advice for your specific situation.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.

Frequently Asked Questions

What is the penalty for identity theft in Washington, DC?

It depends on the dollar amount. First-degree identity theft, for property or financial injury of $1,000 or more, carries up to 10 years in prison and a fine that is the greater of the § 22-3571.01 amount for a 10-year offense, $25,000 for an individual, twice the value of the property, or twice the financial injury. Second-degree identity theft, for smaller amounts, or for causing someone to be falsely accused of or arrested for a crime regardless of amount, carries up to 180 days and a fine of up to $1,000. Under D.C. Code § 22-3601, those maximums rise to 1 1/2 times the otherwise authorized fine and prison term when the victim was 65 or older, so first-degree exposure becomes 15 years.

Can identity theft in DC be charged even if no money was stolen?

Yes. Second-degree identity theft applies when someone else's personal identifying information is used to falsely accuse or get a person arrested for a crime, regardless of any dollar amount involved.

Is restitution mandatory for identity theft victims in DC?

No. Under D.C. Code section 22-3227.04, a court may order restitution for the victim's full financial injury, but the statute makes this discretionary rather than a required part of every sentence.

Can I get false information removed from DC public records after identity theft?

Yes. Under D.C. Code section 22-3227.05, a court can order the correction of a DC public record containing false information caused by identity theft, either as part of a conviction, adjudication, or not-guilty-by-reason-of-insanity finding under subsection (a), or through a separate civil petition any alleged victim can file under subsection (b), decided on clear and convincing evidence. The statute's 30-day agency-compliance deadline is textually tied to subsection (a) orders only.

Does DC have a minor credit freeze law?

DC does not have its own minor or protected-consumer security freeze statute. Families in the District rely on the federal minors' freeze right under 15 U.S.C. section 1681c-1(j), which lets a parent or guardian place a free freeze for a child or protected person nationwide.

Where do I report identity theft in DC?

File a police report with the Metropolitan Police Department's Financial and Cyber Crimes Unit at 202-727-4159, contact your financial institutions directly, place fraud alerts or freezes with the credit bureaus, and file a report with the FTC at IdentityTheft.gov or 1-877-438-4338.