Florida Identity Theft Laws: Penalties, Protected Classes, and Victim Rights

Florida's identity theft law, Fla. Stat. § 817.568, starts as a third-degree felony and escalates based on how much money changed hands, how many people's information was involved, and, separately, whether the victim was a minor or an older adult. Florida also runs its own protected-consumer credit-freeze statute, predating the federal minors' freeze right by a decade. This article covers Florida's criminal statute, its age-based enhancements, the state freeze law, and how federal identity theft protections layer on top.

This page addresses Florida law specifically. For the federal reporting process, the FTC's free recovery tool, and the credit-freeze and fraud-alert rights available nationwide, see our identity theft laws hub and our guide to how to report identity theft.

Florida's Identity Theft Statute: Fla. Stat. § 817.568

Under Florida law, a person commits criminal use of personal identification information when they willfully and without authorization fraudulently use, or possess with intent to fraudulently use, another person's personal identification information without first getting that person's consent. "Personal identification information" is defined broadly: name, address, Social Security number, driver's license or state ID number, alien registration number, passport number, employer or taxpayer ID, Medicaid or food-assistance account number, bank account number, credit or debit card number, biometric data, medical records, and other numbers or information that could be used to access someone's financial resources. A related but separate offense, harassment by use of personal identification information under subsection (4), covers using or possessing someone's information without consent for the purpose of harassing them, and is a first-degree misdemeanor.

Penalty Escalation by Dollar Value and Victim Count

The base offense under § 817.568 is a third-degree felony. It escalates to a second-degree felony, carrying a 3-year mandatory minimum, when the pecuniary benefit reaches $5,000 or more, or when 10 to 19 people's information is used or possessed. It escalates further to a first-degree felony, carrying a 5-year mandatory minimum, when the benefit reaches $50,000 or more, or 20 to 29 victims' information is involved. If the benefit reaches $100,000 or more, or 30 or more victims are involved, the mandatory minimum for the first-degree felony rises to 10 years. Impersonating a law enforcement officer or a financial institution to commit the offense escalates the degree of the crime by one additional level.

Automatic Enhancement for Minor and Elderly Victims

Separate from the dollar-value tiers, Florida automatically enhances the offense to a second-degree felony, regardless of the amount involved, in several specific circumstances. This applies whenever the victim is under 18 or 60 years of age or older, whenever a parent or guardian fraudulently uses a minor's or an elderly person's information, and whenever the victim is 60 or older, a disabled adult, a public servant, a veteran, or a first responder. These enhancements exist on top of, not instead of, the dollar-value escalation described above, so a Florida prosecutor can reach a second-degree felony either by dollar amount or by the identity of the victim.

Florida also separately criminalizes mere possession. Under Fla. Stat. § 817.5685, unlawfully possessing five or more other people's personal identification information, without yet using it fraudulently, is independently punishable as up to a third-degree felony. This means Florida prosecutors do not need to wait for the information to actually be used before charging a case.

Restitution

Section 817.568(15)(a) lets the sentencing court order restitution under Florida's general restitution statute, § 775.089, which can cover the victim's out-of-pocket losses and the cost, including attorney's fees, of correcting a credit or financial record damaged by the identity theft.

Security Freeze for Minors and Protected Consumers

Florida has run its own protected-consumer security freeze statute, Fla. Stat. § 501.0051, since before the federal government added a parallel right in 2018. A "protected consumer" is a person under 16 at the time of the freeze request, or a person for whom a guardian has been appointed. A representative, meaning a parent or legal guardian, including a court-appointed guardian, can place the freeze by submitting a request to each consumer reporting agency along with proof of authority, such as a court order, power of attorney, notarized statement, or certified birth certificate, plus proof of identification.

The agency must place the freeze within 30 days at no charge, send written confirmation within 10 business days along with a unique PIN or identifier for later removal, and remove the freeze within 30 days of a proper request from the representative. Because the federal baseline added in 2018 also guarantees a free minor and protected-consumer freeze nationwide, Florida's statute is now largely duplicative of federal law in practice, but it remains independently operative state law with its own enforcement mechanism.

Reporting Identity Theft in Florida

Florida's data breach notification law, the Florida Information Protection Act (Fla. Stat. § 501.171), requires companies to notify affected Florida residents of a breach without unreasonable delay and no later than 30 days after discovery, with a possible 15-day extension, and to notify the consumer reporting agencies if 1,000 or more people are affected. If your information was exposed in a breach, that notice is usually the first sign something is wrong.

The Florida Attorney General's Office of Consumer Protection is the state's general channel for identity theft complaints. That office's specific identity-theft resource page could not be independently confirmed during this article's research session, so for the most current Florida-specific reporting steps and any state victim-assistance programs, check the Attorney General's site directly or use the federal reporting path described below, which applies in every state.

Federal Protections That Apply in Florida

Florida's state-law rights layer onto the federal identity theft framework available to every state. Under FCRA section 605B (15 U.S.C. § 1681c-2), a victim who submits an identity theft report can have a credit reporting agency block fraudulent information from their credit file. Under 15 U.S.C. § 1681c-1, every consumer nationwide has had the right to a free security freeze and to one-year or seven-year extended fraud alerts since a 2018 federal law made freezes free in every state. IdentityTheft.gov provides a free FTC Identity Theft Report, a personalized recovery plan, and pre-filled dispute letters. For the full mechanics of freezes, fraud alerts, and the FTC reporting process, see our how to report identity theft and credit freeze vs. fraud alert guides.

2025-26 Currency

This page cites the 2025 Florida Statutes as currently published by the Florida Senate. A search of the 2025 legislative session's bill list for identity-theft-related legislation did not turn up filtered results in this session's research, so that search should be treated as inconclusive rather than a confirmed absence of pending legislation. Check the Florida Senate's bill-tracking site directly for the latest session before relying on this page for a pending change.

Information last verified on 2026-08-13, drawn directly from the Florida Statutes. This article has not yet been reviewed by a licensed lawyer and is general legal information, not legal advice for your specific situation.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.