Kentucky Identity Theft Laws

Kentucky's identity theft statute, KRS § 514.160, is unusual among the states in a specific way: it is a flat Class D felony with no dollar-value tiers, no victim-count enhancement, and no separate penalty for a repeat offense written into the statute itself. Two independent live readings of the current official text confirm that flat structure.

This page covers Kentucky's theft of identity statute, its own protected-person credit freeze law, the Attorney General's Identity Theft Hotline and Data Breach Hotline, and the civil remedies available to Kentucky victims. For the federal rights that apply everywhere, see our identity theft laws hub.

Kentucky's Theft of Identity Statute

KRS § 514.160 makes a person guilty of theft of identity when they knowingly possess or use any current or former identifying information of another person, or of that person's family member or ancestor, with intent to represent that they are the other person for purposes that include obtaining benefits or property they would not otherwise be entitled to, making financial or credit transactions using the other person's identity, avoiding detection, or gaining commercial or political benefit. «Identifying information» covers name, address, telephone number, e-mail address, Social Security number, driver's license number, birth date, personal identification number or code, unique biometric data, and any other information that could identify the person.

The statute carves out two specific exceptions. It does not apply to a minor who misrepresents their age to obtain alcohol, tobacco, or another age-restricted privilege, and it does not apply to credit or debit card fraud, which Kentucky addresses separately under KRS §§ 434.550 through 434.730. A person convicted forfeits any lawful claim to the identifying information, property, or other benefit realized from the violation.

Theft of identity is a Class D felony. Two independent readings of the current official statute text found no dollar-value tiers, no victim-count tiers, and no enhancement for repeat offenses or elderly or vulnerable victims anywhere in the section, which sets Kentucky apart from states that scale the offense to the amount involved or the number of people affected.

Kentucky's Minor Credit Freeze Law

Kentucky has its own protected-person security freeze statute, KRS § 367.3645, predating the 2018 federal baseline. It defines a «protected person» as an individual under sixteen years of age at the time a freeze request is made, and bars a consumer reporting agency from releasing the protected person's consumer report, derived information, or records while the freeze is active.

Unlike Iowa's or Kansas's fee-free statutes, Kentucky's own statute as written permits the reporting agency to charge a fee of up to $10 for placement or removal of a protected-person freeze. Whether that fee provision is displaced in practice by the federal free-freeze mandate for protected consumers under 15 U.S.C. § 1681c-1(j) was not independently confirmed during this page's research. Willful noncompliance by a reporting agency exposes it to actual damages, liquidated damages of $100 to $1,000, punitive damages, and attorney's fees; obtaining a protected person's report under false pretenses exposes the requester to actual damages or $1,000, whichever is greater. A separate statute, KRS § 367.365, covers the general (adult) security freeze process, including placement, duration, removal, and temporary lifting.

Reporting Identity Theft to the Kentucky Attorney General

The Kentucky Attorney General's Office of Consumer Protection offers an online complaint and scam form at ag.ky.gov/scams, a dedicated Data Breach Hotline (1-855-813-6508), and a separate Identity Theft Hotline (1-877-438-4338), plus a mailing address at 1024 Capital Center Drive, Suite 200, Frankfort, KY 40601. The office provides an «Identity Theft: The Name Game» recovery brochure and can mail a hard copy of the FTC's ID Theft Booklet on request (502-696-5389).

The Attorney General's page advises victims to act quickly, report to the FTC at identitytheft.gov, monitor credit reports, place fraud alerts, and obtain a police report, and specifically notes that a police report helps secure a seven-year extended fraud-alert protection. Separately, the office flags unemployment-insurance identity fraud for reporting to Kentucky's Office of Unemployment Insurance and to the U.S. Department of Justice's National Center for Disaster Fraud (866-720-5721).

Civil Remedies in Kentucky

Kentucky has no identity-theft-specific civil cause of action comparable to what some other states provide. The closest available private civil remedy is the general Kentucky Consumer Protection Act, KRS § 367.220. It allows a person who purchases or leases goods or services primarily for personal, family, or household purposes and suffers an ascertainable loss to sue for actual damages, equitable relief, and, as the statute preserves, punitive damages, plus attorney's fees and costs at the court's discretion, within one year after the Attorney General's action terminates or two years after the violation, whichever is later. Its reach is narrower than a dedicated identity-theft statute, since it only covers losses tied to a covered personal, family, or household consumer transaction, not identity-theft harm generally.

Whether Kentucky's general criminal restitution provisions apply automatically to a theft-of-identity conviction was not independently confirmed against the official statutory text during this page's research.

The Federal Layer

Kentucky's own protections sit alongside the federal baseline available to every state. Since 2018, federal law has required free credit freezes and free freeze removals nationwide. A fraud alert placed with one credit bureau is shared with the other two, lasts one year by default, and extends to seven years once you have filed an FTC Identity Theft Report, the same extended-alert benefit the Kentucky Attorney General's own page points victims toward. Under FCRA § 605B (15 U.S.C. § 1681c-2), a victim with an identity theft report can get specific fraudulent information blocked from a credit report. IdentityTheft.gov, the FTC's free recovery site, builds a personalized recovery plan and, for account holders, pre-fills the letters and forms most victims need. See our guide to reporting identity theft and our comparison of credit freezes versus fraud alerts for more.

If You Are a Victim of Identity Theft in Kentucky

File a police report first, since Kentucky's own Attorney General notes it helps secure the seven-year extended fraud alert. Call the Identity Theft Hotline at 1-877-438-4338 or file online at ag.ky.gov/scams. Report to the FTC through IdentityTheft.gov, and place a freeze with all three major credit bureaus. If the theft involves a child's information, use Kentucky's protected-person freeze process under KRS 367.3645, and confirm the current fee, if any, directly with the credit bureau before paying it.

Information last verified on 2026-08-13, drawn directly from KRS §§ 514.160, 367.3645, 367.365, and 367.220, and the Kentucky Attorney General's identity theft page. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert
• Child Identity Theft: Warning Signs, Credit Checks, and the Minor Freeze Right

---

Last updated: 2026-08-13.