Georgia Identity Theft Laws: Identity Fraud Statute and Victim Resources

Georgia's Attorney General states plainly that "in Georgia, identity theft is a felony under Official Code of Georgia Annotated Section 16-9-121." This article covers what Georgia's identity fraud statute actually says, what it costs a person convicted under it, how to report identity theft through the Attorney General's Consumer Protection Division and your local police, and how federal identity theft protections apply to Georgia residents.

A note on sourcing for this page: Georgia's official code is published under an exclusive contract with LexisNexis rather than through a free state portal, so the statutory text quoted and summarized below comes from published copies of the Official Code of Georgia Annotated. The sections that matter here are stable, and none of them has been amended since 2018.

This page addresses Georgia law specifically. For the federal reporting process, the FTC's free recovery tool, and the credit-freeze and fraud-alert rights available nationwide, see our identity theft laws hub and our guide to how to report identity theft.

Georgia's Identity Fraud Statute

Georgia's identity theft offenses are codified in Article 8 of Title 16, titled "Identity Fraud," spanning O.C.G.A. §§ 16-9-120 through 16-9-132. The core offense sits at § 16-9-121, the narrower offense of aggravated identity fraud at § 16-9-121.1, and the penalties at § 16-9-126. The Georgia Attorney General's own consumer page confirms, in its own words, that identity theft in Georgia is a felony under § 16-9-121.

Under § 16-9-121(a), a person commits identity fraud when he or she willfully and fraudulently does any of the following:

• Without authorization or consent, uses or possesses with intent to fraudulently use identifying information concerning another person.
• Uses the identifying information of an individual under 18 over whom he or she exercises custodial authority. This is the provision that reaches a parent or guardian who opens accounts in a child's name.
• Uses, or possesses with intent to fraudulently use, the identifying information of a deceased individual.
• Creates, uses, or possesses with intent to fraudulently use counterfeit or fictitious identifying information concerning a fictitious person, intending to use it to commit or facilitate a crime or fraud on another person.
• Without authorization or consent, creates, uses, or possesses with intent to fraudulently use counterfeit or fictitious identifying information concerning a real person, with that same intent.

Section 16-9-121(b) creates a separate offense, identity fraud by receipt of fraudulent identification information, committed by willingly accepting for identification purposes information the person knows to be fraudulent, stolen, counterfeit, or fictitious. The statute says a prosecution under that subsection does not require a conviction of the principal thief, counterfeiter, or fraudulent user.

"Identifying information" is defined broadly at § 16-9-120(5). The list is not exhaustive, but it expressly includes current and former names, Social Security numbers, driver's license numbers, checking and savings account numbers, credit and debit card numbers, personal and electronic identification numbers, digital or electronic signatures, medical identification numbers, birth dates, a mother's maiden name, tax identification numbers, state identification card numbers, veteran and military medical identification numbers, and any other number or information that can be used to reach a person's resources or health care records.

Two structural rules matter for anyone reading a charging document. Under § 16-9-121(c), the offenses created by that section do not merge with any other offense, so an identity fraud count is sentenced alongside the underlying theft or forgery rather than folded into it. And § 16-9-121(d) carves out a person under 21 who uses a false identification card solely to get into a business establishment or to buy something he or she is not old enough to purchase.

Aggravated identity fraud, § 16-9-121.1, is narrower than the name suggests. It applies when a person willfully and fraudulently uses counterfeit or fictitious identifying information concerning a real, fictitious, or deceased person for the purpose of obtaining employment. It also does not merge with any other offense.

What a conviction carries

Georgia does not divide identity fraud into first-degree and second-degree offenses. Section 16-9-126 sets the ranges directly:

In each row the sentencing court may impose the prison term, the fine, or both. The reduced range for offenders under 21 comes from § 16-9-126(b) and applies only where the violation did not involve intent to commit theft or appropriation of any property, resource, or other thing of value. The consecutive-sentence rule for aggravated identity fraud is in § 16-9-126(a.1).

Three further provisions of § 16-9-126 affect victims directly. Subsection (c) allows the court to order a person found guilty to make restitution to any consumer victim or business victim of the fraud. Subsection (d) makes each violation of the article a separate offense. Subsection (e) lets the court, on conviction, issue any order necessary to correct a public record that contains false information resulting from the offense, which is the mechanism for cleaning up a record created in a victim's name.

Reporting Identity Theft Through the Attorney General

The Georgia Attorney General's Consumer Protection Division is the state's primary identity theft resource. The Division accepts complaints by phone at (404) 651-8600 or toll-free at (800) 869-1123, online through a "File a Complaint" function, or in person at 40 Capitol Square SW, Atlanta, GA 30334. Its site publishes general identity theft guidance plus separate pages tailored to children, older adults, military personnel, job seekers, medical identity theft, and criminal identity theft, alongside step-by-step instructions for placing fraud alerts, pulling credit reports, and filing an FTC or police Identity Theft Report. The Division's identity theft page also notes that Georgia residents filed 55,955 identity theft complaints with the FTC in 2024. If your information was taken in a scam, such as a fake call or a bogus seller, our guide to Georgia scam and fraud laws covers the other places to report it and when the Fair Business Practices Act lets you sue a business.

The Attorney General's victim guidance page recommends filing a police report as part of building a formal Identity Theft Report alongside an FTC complaint at identitytheft.gov, and repeats the felony citation to § 16-9-121.

Georgia law goes further than that guidance describes. Under O.C.G.A. § 16-9-125.1(a), a person who has learned or reasonably believes that he or she is the victim of identity fraud may contact the law enforcement agency with jurisdiction over his or her actual residence for the purpose of making an incident report, and that agency "shall make a report of the complaint and provide the complainant with a copy of the report." If investigation and prosecution belong to a different agency, the agency taking the report must forward a copy to that agency and tell the complainant it has done so. Separately, O.C.G.A. § 35-1-13 requires any Georgia law enforcement agency that receives an identity fraud report from a state resident to prepare an incident report and transmit it to the Georgia Bureau of Investigation's identity fraud repository, even where the identity was used only to commit offenses outside Georgia.

That duty has a stated limit. Section 16-9-125.1(b) says nothing in the section interferes with a law enforcement agency's discretion to allocate resources for investigating crimes, and a report made under it is not required to be counted as an open case file. So the statute guarantees you the report and the copy, not an investigation. If a precinct tells you it does not take identity theft reports, § 16-9-125.1(a) is the provision to cite.

Security Freeze for Minors

Georgia has its own protected-consumer freeze law, and it predates the 2018 federal change that made freezes free nationwide. O.C.G.A. § 10-1-914.1(a) requires a consumer credit reporting agency to place a security freeze for a protected consumer when that person's representative requests one, submits the request in the manner the agency specifies, and provides sufficient proof of the protected consumer's and the representative's identity plus proof of authority to act.

Section 10-1-913 supplies the definitions. A protected consumer is an individual under 16 at the time of the request, or an individual for whom a guardian or conservator has been appointed. Sufficient proof of authority means a court order, a lawfully executed and valid power of attorney, or a written notarized statement describing the representative's authority. Sufficient proof of identification means a Social Security number or card, or a certified or official copy of a birth certificate.

Two features of the statute matter most to parents. If the agency has no file on the child, § 10-1-914.1(b) requires it to create a record for the child and freeze that record, which is what stops a thief from opening the first file. And § 10-1-914.1(g) bars the agency from charging any fee for anything done under the section. The agency has 30 days to place the freeze under subsection (c) and 30 days to remove it on a valid request under subsection (f). The general adult freeze right sits at § 10-1-914.

The Attorney General's Credit Freeze page reflects that history in its opening sentence: "As Georgia law had already provided, federal law now makes it free for all consumers to place a security freeze (also known as a 'credit freeze') on their credit file with every nationwide credit reporting agency." The Division's separate Child Identity Theft page describes the federal fraud-alert framework, including the standard 90-day initial alert and the seven-year extended alert available after filing an Identity Theft Report. Federal law, 15 U.S.C. § 1681c-1(j), independently guarantees every parent or guardian nationwide a free freeze on a minor's credit file, so a Georgia family can proceed under either the state or the federal route.

Federal Protections That Apply in Georgia

Georgia's state-level felony exposure for identity thieves sits on top of the federal identity theft framework available in every state. Under FCRA section 605B (15 U.S.C. § 1681c-2), a victim who submits an identity theft report can have a credit reporting agency block fraudulent information from their credit file. Under 15 U.S.C. § 1681c-1, every consumer nationwide has had the right to a free security freeze and to one-year or seven-year extended fraud alerts since a 2018 federal law made freezes free in every state. IdentityTheft.gov provides a free FTC Identity Theft Report, a personalized recovery plan, and pre-filled dispute letters, and it is the resource the Georgia Attorney General itself directs victims toward for the formal reporting step. For the full mechanics of freezes, fraud alerts, and the FTC reporting process, see our how to report identity theft and credit freeze vs. fraud alert guides.

2025-26 Currency

The provisions described on this page are long-settled. O.C.G.A. § 16-9-121 was last amended in 2010 (Ga. L. 2010, p. 568, § 1/HB 1016), § 16-9-126 in 2011 (Ga. L. 2011, p. 794, § 5/HB 87), § 16-9-121.1 was enacted in 2011 by the same act, § 16-9-125.1 was enacted in 2007 (Ga. L. 2007, p. 450, § 5/SB 236), and § 10-1-914.1 was last amended in 2018 (Ga. L. 2018, p. 245, § 2/SB 376). All five appear in that form in the current published Code.

A search of the Georgia General Assembly's own bill-tracking site for the current 2025-2026 legislative session (session 68) using the term "identity fraud" returned a results page covering firearms, county governance, tax credits, environmental protection, education, health services, and banking topics, none related to identity theft or identity fraud, among the bills reviewed. Only the first page of results was checked, so this should be read as a lead toward no pending amendment rather than a fully confirmed negative. Check the Georgia General Assembly's site directly for the latest status.

Statutory text verified on 2026-09-02 against published copies of the Official Code of Georgia Annotated; the Georgia Attorney General's Consumer Protection Division pages were last verified on 2026-08-13. This article has not yet been reviewed by a licensed lawyer and is general legal information, not legal advice for your specific situation.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-09-02.

Frequently Asked Questions

Is identity theft a felony in Georgia?

Yes. Identity fraud is a felony under O.C.G.A. section 16-9-121. Under section 16-9-126(a), a first violation of Georgia's identity fraud article, other than aggravated identity fraud, is punishable by imprisonment for one to ten years, a fine of up to $100,000, or both. A second or subsequent violation carries three to 15 years, a fine of up to $250,000, or both. Georgia does not divide the offense into degrees.

What is aggravated identity fraud under Georgia law?

Aggravated identity fraud, O.C.G.A. section 16-9-121.1, is committed when a person willfully and fraudulently uses counterfeit or fictitious identifying information concerning a real, fictitious, or deceased person for the purpose of obtaining employment. Section 16-9-126(a.1) punishes it by one to 15 years of imprisonment, a fine of up to $250,000, or both, and the sentence runs consecutively to any other sentence the person receives.

Can Georgia police refuse to take my identity theft report?

No. O.C.G.A. section 16-9-125.1(a) provides that a person who reasonably believes he or she is a victim of identity fraud may contact the law enforcement agency with jurisdiction over his or her residence, and that agency shall make a report of the complaint and provide the complainant with a copy of the report. If another agency has investigative jurisdiction, the reporting agency must forward a copy and tell you it did so. Subsection (b) does preserve each agency's discretion over how it allocates investigative resources, so the guarantee is the report and the copy rather than an investigation.

Does Georgia have a state law letting me freeze my child's credit?

Yes. O.C.G.A. section 10-1-914.1 requires a consumer credit reporting agency to place a security freeze for a protected consumer at the request of that person's representative, with proof of identity and of authority to act. Section 10-1-913 defines a protected consumer as an individual under 16 or an individual with a guardian or conservator. If no file exists for the child, the agency must create a record and freeze it, and the agency cannot charge a fee. Federal law, 15 U.S.C. section 1681c-1(j), guarantees the same free freeze nationwide.

Does Georgia allow restitution for identity theft victims?

Yes. O.C.G.A. section 16-9-126(c) provides that any person found guilty of a violation of Georgia's identity fraud article may be ordered by the court to make restitution to any consumer victim or business victim of the fraud. Restitution is ordered by the sentencing court, so it depends on a prosecution and a conviction. Section 16-9-126(e) separately lets the court issue any order necessary to correct a public record that contains false information resulting from the offense.

Where do I report identity theft in Georgia?

Contact the Georgia Attorney General's Consumer Protection Division at (404) 651-8600 or (800) 869-1123, file online, or visit in person at 40 Capitol Square SW, Atlanta. File a report with the law enforcement agency covering your residence, which O.C.G.A. section 16-9-125.1 requires it to take and give you a copy of, and file an FTC Identity Theft Report at IdentityTheft.gov.

How common is identity theft in Georgia?

According to the Georgia Attorney General's Consumer Protection Division, Georgia residents filed 55,955 identity theft complaints with the FTC in 2024.