Kentucky Identity Theft Laws

Kentucky's identity theft statute, KRS § 514.160, is unusual among the states in a specific way: it is a flat Class D felony with no dollar-value tiers, no victim-count enhancement, and no separate penalty for a repeat offense written into the section itself. Kentucky escalates through a separate offense instead. KRS § 514.170, trafficking in stolen identities, is a Class C felony, one grade higher.

This page covers Kentucky's theft of identity and trafficking statutes, its own protected-person credit freeze law, the Attorney General's Identity Theft Hotline and Data Breach Hotline, and the civil, Consumer Protection Act, and restitution remedies available to Kentucky victims. For the federal rights that apply everywhere, see our identity theft laws hub.

Kentucky's Theft of Identity Statute

KRS § 514.160 makes a person guilty of theft of identity when they knowingly possess or use any current or former identifying information of another person, or of that person's family member or ancestor, with intent to represent that they are the other person for purposes that include obtaining benefits or property they would not otherwise be entitled to, making financial or credit transactions using the other person's identity, avoiding detection, or gaining commercial or political benefit. «Identifying information» covers name, address, telephone number, e-mail address, Social Security number, driver's license number, birth date, personal identification number or code, unique biometric data, and any other information that could identify the person.

The statute carves out two specific exceptions. It does not apply when a person obtains the identity of another to misrepresent his or her age for the purpose of obtaining alcoholic beverages, tobacco, or another privilege denied to minors. Read the subject carefully: the exception turns on the purpose, obtaining an age-restricted privilege, and not on the age of the person doing it. The statute also does not apply to credit or debit card fraud, which Kentucky addresses separately under KRS §§ 434.550 through 434.730. A person convicted forfeits any lawful claim to the identifying information, property, or other benefit realized from the violation.

Theft of identity is a Class D felony. Two independent readings of the current official statute text found no dollar-value tiers, no victim-count tiers, and no enhancement for repeat offenses or elderly or vulnerable victims anywhere in the section. That is not the whole picture on severity, though. Kentucky's escalation lives in the companion offense described in the next section. KRS 514.160(2) also carries a civil hook that is easy to miss: if the person violating the section is a business that has violated it on more than one occasion, that business also violates the Consumer Protection Act, KRS 367.110 to 367.300.

Trafficking in Stolen Identities

Kentucky's more serious identity crime is KRS § 514.170, trafficking in stolen identities. A person is guilty when they manufacture, sell, transfer, or purchase the personal identity of another person or persons, or possess it with the intent to do any of those things, for any of the purposes listed in KRS 514.160(1). The personal identity covered is the same set of identifying information described in KRS 514.160(1).

Trafficking in stolen identities is a Class C felony, one grade above theft of identity. The statute also supplies an evidentiary shortcut for prosecutors: possession of five or more separate identities is prima facie evidence that the identities are possessed for the purpose of trafficking. As with 514.160, a business that violates KRS 514.170 on more than one occasion also violates the Consumer Protection Act, KRS 367.110 to 367.300.

So while the theft of identity section itself does not scale with the number of victims, Kentucky does treat multi-identity and distribution conduct more harshly. It just does so through a separate charge rather than through tiers inside one statute.

Kentucky's Minor Credit Freeze Law

Kentucky has its own protected-person security freeze statute, KRS § 367.3645, predating the 2018 federal baseline. It defines a «protected person» as an individual under sixteen years of age at the time a freeze request is made, and bars a consumer reporting agency from releasing the protected person's consumer report, derived information, or records while the freeze is active.

Unlike Iowa's or Kansas's fee-free statutes, Kentucky's own statute as written permits the reporting agency to charge a fee of up to $10 for placement or removal of a protected-person freeze. Whether that fee provision is displaced in practice by the federal free-freeze mandate for protected consumers under 15 U.S.C. § 1681c-1(j) was not independently confirmed during this page's research. Willful noncompliance by a reporting agency exposes it to actual damages, liquidated damages of $100 to $1,000, punitive damages, and attorney's fees; obtaining a protected person's report under false pretenses exposes the requester to actual damages or $1,000, whichever is greater. A separate statute, KRS § 367.365, covers the general (adult) security freeze process, including placement, duration, removal, and temporary lifting.

Reporting Identity Theft to the Kentucky Attorney General

The Kentucky Attorney General's Office of Consumer Protection offers an online complaint and scam form at ag.ky.gov/scams, a dedicated Data Breach Hotline (1-855-813-6508), and a separate Identity Theft Hotline (1-877-438-4338), plus a mailing address at 1024 Capital Center Drive, Suite 200, Frankfort, KY 40601. The office provides an «Identity Theft: The Name Game» recovery brochure and can mail a hard copy of the FTC's ID Theft Booklet on request (502-696-5389).

The Attorney General's page advises victims to act quickly, report to the FTC at identitytheft.gov, monitor credit reports, place fraud alerts, and obtain a police report, and specifically notes that a police report helps secure a seven-year extended fraud-alert protection. Separately, the office flags unemployment-insurance identity fraud for reporting to Kentucky's Office of Unemployment Insurance and to the U.S. Department of Justice's National Center for Disaster Fraud (866-720-5721).

Civil Remedies in Kentucky

Kentucky does have an identity-theft-specific civil cause of action, and it is the first place a victim should look. KRS § 411.210, «Action for theft of identity or trafficking in stolen identities», provides that anyone who is a victim under KRS 514.160, 514.170, 434.872, or 434.874 has a cause of action for compensatory and punitive damages against the violator. Suit may be brought either where the victim resides or where the defendant resides, and a successful plaintiff «shall be awarded reasonable costs and attorneys' fees». The limitations period is five years from the date the victim discovers the violation, and the statute opens by saying the action is available «in addition to pursuing any other remedy».

The Kentucky Consumer Protection Act is a second, narrower route. KRS § 367.220 allows a person who purchases or leases goods or services primarily for personal, family, or household purposes and suffers an ascertainable loss to sue for actual damages, equitable relief, and, as the statute preserves, punitive damages, plus attorney's fees and costs at the court's discretion, within one year after the Attorney General's action terminates or two years after the violation, whichever is later. Because it is tied to a covered consumer transaction, it does not reach identity theft harm generally the way KRS 411.210 does. The same purchase requirement shapes what a Kentucky scam victim can do under the act, which our guide to Kentucky scam and fraud laws walks through.

There is one bridge between the two. KRS 514.160(2) and KRS 514.170(3) each provide that a business that violates the section on more than one occasion also violates the Consumer Protection Act, KRS 367.110 to 367.300. That route can reach a repeat-offender business without the personal, family, or household purchase KRS 367.220 otherwise requires.

A criminal case carries its own money remedy on top of all of this. KRS § 532.034 provides that a person found guilty under KRS 514.160, 514.170, 434.872, or 434.874 shall, in addition to any other punishment, be ordered to make restitution for the financial loss a victim sustained. The statute says that loss may include costs the victim incurred correcting their credit history and costs of any civil or administrative proceeding to satisfy a debt or other obligation created by the theft, including lost wages and attorney's fees. Restitution is paid to the person or entity that suffered the loss, which may include a financial institution, insurance company, or bonding association that took a direct financial hit.

The Federal Layer

Kentucky's own protections sit alongside the federal baseline available to every state. Since 2018, federal law has required free credit freezes and free freeze removals nationwide. A fraud alert placed with one credit bureau is shared with the other two, lasts one year by default, and extends to seven years once you have filed an FTC Identity Theft Report, the same extended-alert benefit the Kentucky Attorney General's own page points victims toward. Under FCRA § 605B (15 U.S.C. § 1681c-2), a victim with an identity theft report can get specific fraudulent information blocked from a credit report. IdentityTheft.gov, the FTC's free recovery site, builds a personalized recovery plan and, for account holders, pre-fills the letters and forms most victims need. See our guide to reporting identity theft and our comparison of credit freezes versus fraud alerts for more.

If You Are a Victim of Identity Theft in Kentucky

File a police report first, since Kentucky's own Attorney General notes it helps secure the seven-year extended fraud alert. Call the Identity Theft Hotline at 1-877-438-4338 or file online at ag.ky.gov/scams. Report to the FTC through IdentityTheft.gov, and place a freeze with all three major credit bureaus. If the theft involves a child's information, use Kentucky's protected-person freeze process under KRS 367.3645, and confirm the current fee, if any, directly with the credit bureau before paying it. If you know who took your identity and you have measurable losses, KRS 411.210 gives you five years from discovery to bring a civil claim, so it is worth asking a Kentucky lawyer about that action rather than assuming the criminal case is your only path.

Information last verified on 2026-09-02, drawn directly from KRS §§ 514.160, 514.170, 411.210, 532.034, 367.3645, 367.365, and 367.220, and the Kentucky Attorney General's identity theft page. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert
• Child Identity Theft: Warning Signs, Credit Checks, and the Minor Freeze Right

---

Last updated: 2026-09-02.

Frequently Asked Questions

Is identity theft a felony in Kentucky?

Yes. KRS 514.160, theft of identity, is a Class D felony, and that section contains no dollar-value or victim-count tiers. The related offense of trafficking in stolen identities, KRS 514.170, is a Class C felony, one grade higher.

What is the difference between theft of identity and trafficking in stolen identities in Kentucky?

Theft of identity under KRS 514.160 covers knowingly possessing or using another person's identifying information with intent to pose as them. Trafficking under KRS 514.170 covers manufacturing, selling, transferring, or purchasing identities, or possessing them with that intent, and it is a Class C felony rather than a Class D felony. Possession of five or more separate identities is prima facie evidence of trafficking.

Does Kentucky's minor credit freeze cost money?

Kentucky's protected-person freeze statute, KRS 367.3645, as written permits a fee of up to $10 for placement or removal for a person under 16. Whether this is still charged given the 2018 federal free-freeze mandate was not confirmed this session; ask the credit bureau directly before paying.

Can I sue the person who stole my identity in Kentucky?

Yes. KRS 411.210 gives a victim of theft of identity or trafficking in stolen identities a civil cause of action for compensatory and punitive damages, and a successful plaintiff is awarded reasonable costs and attorneys' fees. You have five years from the date you discover the violation, and the statute makes this remedy available in addition to any other remedy. The Kentucky Consumer Protection Act, KRS 367.220, is a separate and narrower route tied to a personal, family, or household transaction.

Does a Kentucky identity theft conviction require restitution?

Yes. KRS 532.034 requires a person found guilty under KRS 514.160 or 514.170 to be ordered to make restitution, in addition to any other punishment, for the victim's financial loss. That can include the cost of correcting a credit history, lost wages, and attorney's fees, and it is paid to whoever suffered the loss, which may include a financial institution or insurer.

What is Kentucky's Identity Theft Hotline?

The Kentucky Attorney General's Office of Consumer Protection runs an Identity Theft Hotline at 1-877-438-4338, separate from its Data Breach Hotline at 1-855-813-6508.

Does theft of identity in Kentucky apply to using a fake ID to buy alcohol?

Not under KRS 514.160. That section does not apply when a person obtains the identity of another to misrepresent his or her age for the purpose of obtaining alcoholic beverages, tobacco, or another privilege denied to minors. The exception is written around that purpose, not around the age of the person using the identity. Other charges can still apply.

Why does a police report matter for a Kentucky identity theft victim?

The Kentucky Attorney General's own guidance notes that a police report helps secure the seven-year extended fraud alert available under federal law once you have an identity theft report on file.