District of Columbia Identity Theft Laws: Statute, Penalties, and Victim Rights

The District of Columbia's identity theft law, D.C. Code § 22-3227.02, splits the offense into two degrees based mainly on dollar value, and it gives victims an unusual additional right: a court petition to correct false information a thief created in DC's own public records. This article covers the DC statute, its penalty structure, the record-correction remedy, and how the federal identity theft framework applies to District residents.

This page addresses District of Columbia law specifically. For the federal reporting process, the FTC's free recovery tool, and the credit-freeze and fraud-alert rights available nationwide, see our identity theft laws hub and our guide to how to report identity theft.

DC's Identity Theft Statute: D.C. Code § 22-3227.02

A person commits identity theft in the District when they knowingly, and without the other person's consent, do one of three things with someone else's personal identifying information: use it to obtain or attempt to obtain property fraudulently, obtain or possess it with intent to use it fraudulently or let someone else use it fraudulently, or use it to identify themselves to a law enforcement officer in order to avoid arrest or detection, or to conceal a crime.

"Personal identifying information" is defined broadly under § 22-3227.01: name, address, phone number, date of birth, mother's maiden name, government identification numbers, financial account details, biometric data, and any other number or piece of information that could be used to access financial resources or medical information, or to obtain identification. "Property" incorporates DC's general theft-statute definition and expressly includes credit. "Financial injury" covers all monetary costs tied to the identity theft, including attorney's fees, credit-repair costs, and lost wages.

Penalties: First-Degree and Second-Degree Identity Theft

DC Code § 22-3227.03 sets penalties primarily by dollar amount. First-degree identity theft applies when the property obtained or attempted, or the financial injury caused, is $1,000 or more. It is punishable by a fine that is the greater of the amount set under the District's general organizational-fine table, twice the value of the property obtained, or twice the amount of the financial injury, imprisonment for up to 10 years, or both.

Second-degree identity theft applies in two situations. The first is any amount under $1,000, described in the statute as property or financial injury that "has some value." The second applies regardless of dollar value: identity theft that causes another person to be falsely accused of, or arrested for, a crime because someone misused their personal identifying information. Second-degree identity theft is punishable by a fine under the same organizational-fine table or imprisonment for up to 180 days, or both. The statute's text notes that an earlier enhanced-penalty provision for repeat offenders has been repealed, so there is no current prior-conviction escalation clause built into § 22-3227.03 itself.

Restitution and Correcting DC Public Records

Under D.C. Code § 22-3227.04, a court may, in addition to any other penalty, order a convicted defendant to pay restitution for the full amount of the victim's financial injury. This restitution provision, added by the Identity Theft Amendment Act of 2003, is discretionary rather than mandatory.

DC also gives victims a distinct, non-monetary remedy that many states do not offer explicitly: correction of public records. Under D.C. Code § 22-3227.05(a), if a person is convicted, adjudicated delinquent, or found not guilty by reason of insanity of identity theft, the court may issue orders necessary to correct any District public record that contains false information resulting from the offense, and District agencies must comply with an order issued under that subsection within 30 days. Separately, subsection (b) lets any person who alleges they were victimized by identity theft, even without waiting for a conviction, petition the court for an expedited judicial determination that a DC public record contains false information from a violation of the identity theft statute. If the petitioner meets a clear-and-convincing-evidence standard, the court can order the correction, but the statute's 30-day agency-compliance deadline is textually tied to subsection (a) orders; it does not by its own terms extend to a subsection (b) civil-petition order.

DC's identity theft law also reaches conduct connected to the District even when the offender was never physically present here. Under § 22-3227.06, DC has extraterritorial jurisdiction over identity theft committed against a DC resident or DC-located victim, or where any part of the offense occurs in the District, which matters for online and out-of-state schemes that target DC residents.

Security Freeze for Minors: Rely on Federal Law

The District's general Consumer Security Freeze statute (D.C. Code §§ 28-3861 through 28-3864) does not include a minor or protected-consumer provision. It defines "consumer" simply as "an individual who resides in the District of Columbia," with no age qualifier and no separate process for a parent, guardian, or conservator to place a freeze for someone who does not yet have a credit file. DC residents therefore rely on the federal minors' and protected-consumers' freeze right under 15 U.S.C. § 1681c-1(j), added in 2018, rather than a District-specific statute.

Reporting Identity Theft in DC

The Office of the Attorney General for the District of Columbia lays out a four-step process for identity theft victims. First, file a police report with the Metropolitan Police Department's Financial and Cyber Crimes Unit, reachable at 202-727-4159 or online. Second, immediately call the security or fraud department of each affected financial institution, and follow up in writing by certified mail. Third, pull your free annual credit reports and review them for unfamiliar inquiries or accounts. Fourth, place fraud alerts or security freezes with the credit bureaus.

The OAG's consumer alert does not cite the identity theft statute by number and does not advertise a dedicated OAG identity-theft hotline separate from general consumer complaints, which go through 202-442-9828, consumer.protection@dc.gov, or an online complaint portal. For the identity-theft hotline itself, the OAG points residents to the FTC's 1-877-ID-THEFT (438-4338) line and IdentityTheft.gov.

Federal Protections That Apply in DC

DC's state-law rights layer onto the federal identity theft framework available to every resident of every state. Under FCRA section 605B (15 U.S.C. § 1681c-2), a victim who submits an identity theft report can have a credit reporting agency block fraudulent information from their credit file. Under 15 U.S.C. § 1681c-1, every consumer, including DC residents, has had the right to a free security freeze and to one-year or seven-year extended fraud alerts since a 2018 federal law made freezes free nationwide. IdentityTheft.gov provides a free FTC Identity Theft Report, a personalized recovery plan, and pre-filled dispute letters. For the full mechanics of freezes, fraud alerts, and the FTC reporting process, see our how to report identity theft and credit freeze vs. fraud alert guides.

2025-26 Currency

As of this session's research, the current text of § 22-3227.03 shows a legislative history running from original enactment in 1982 through D.C. Law 21-166 (November 23, 2016), the most recent amendment on record. No 2025-26 amendment was found.

Information last verified on 2026-08-13, drawn directly from the DC Code and the Office of the Attorney General's consumer alert page. This article has not yet been reviewed by a licensed lawyer and is general legal information, not legal advice for your specific situation.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.