Oregon Identity Theft Laws: ORS 165.800 and 165.803 Explained

Oregon treats identity theft as a flat Class C felony under ORS 165.800 regardless of dollar amount, but a separate aggravated version of the crime, ORS 165.803, escalates it to a Class B felony when any of four specific conditions apply. This page covers both statutes, Oregon's own protected-consumer credit freeze law for minors, the Oregon Department of Justice's reporting process, and the federal rights every Oregon resident also has.

This article addresses Oregon state law on identity theft alongside the federal framework under 18 U.S.C. Section 1028 and the Fair Credit Reporting Act. For the parent overview of identity theft law generally, see our identity theft laws hub.

Oregon's Two-Tier Identity Theft Statute

Oregon's base identity theft offense is defined at ORS 165.800: «A person commits the crime of identity theft if the person, with the intent to deceive or to defraud, obtains, possesses, transfers, creates, utters or converts to the person's own use the personal identification of another person.» «Personal identification» is defined broadly under the statute to include names, addresses, phone numbers, driving privileges, Social Security numbers, employment information, signatures, email accounts, photographs, dates of birth, and PINs. The statute also carries an affirmative defense for a person under 21 who uses another person's identification solely to purchase an age-restricted item such as alcohol.

Unlike many states, Oregon does not tier the base offense by dollar amount. Identity theft under ORS 165.800 is a Class C felony regardless of how much money or property is involved.

Aggravated Identity Theft: ORS 165.803

Oregon escalates identity theft to a Class B felony, aggravated identity theft under ORS 165.803, when a person's violation of ORS 165.800 meets any one of four specific conditions. First, the person's conduct involves 10 or more separate incidents within a 180-day period. Second, the person has a previous conviction for aggravated identity theft, in any state or federal court, at any prior time. Third, the losses from a single transaction or from transactions aggregated together total $10,000 or more within a 180-day period. Fourth, the person possesses 10 or more pieces of personal identification belonging to 10 or more different people. Any one of these four triggers is enough to raise the charge from a Class C to a Class B felony.

Oregon's Protected Consumer Credit Freeze

Oregon has its own security freeze statute specifically for minors and other protected consumers, part of the Oregon Consumer Identity Theft Protection Act, ORS 646A.600 through 646A.628. ORS 646A.602(14) defines a «protected consumer» as an individual not older than 16 at the time a representative requests a freeze on their behalf, or an individual who is incapacitated or under a court-appointed guardianship or conservatorship. Under ORS 646A.606, a representative, meaning a parent, guardian, or conservator, can freeze a protected consumer's credit report by submitting proof of their authority to act, such as a court order, a valid power of attorney, or a notarized affidavit describing the relationship. This state-law right sits alongside the separate federal minor-freeze right described below; whether Oregon's own law predates or postdates the 2018 federal statute was not independently confirmed this session.

Reporting Identity Theft to the Oregon DOJ

The Oregon Department of Justice's Consumer Protection Section directs identity theft victims to file with local law enforcement and with the FTC, either through its online complaint assistant or by calling 1-877-ID-THEFT. The DOJ's own site also provides guidance on free annual credit reports, security-freeze contact information for all three credit bureaus, and fraud-alert guidance covering the initial 90-day alert, the extended 7-year alert, and the active-duty military alert, along with an Identity Theft Affidavit for credit restoration. Oregon consumers can also reach the DOJ's general Consumer Hotline at 1-877-877-9392, listed on the Consumer Protection Section's main landing page, or file online through the department's consumer complaints portal.

Victim Rights and Remedies

Restitution in Oregon comes through the state's general criminal restitution statute, ORS 137.106. Under ORS 137.106(1)(a), when a person is convicted of a crime that has resulted in economic damages, the district attorney investigates and presents to the court evidence of the nature and amount of those damages. If the court then finds from that evidence that a victim suffered economic damages, ORS 137.106(2)(a) says the court «shall enter a judgment or supplemental judgment requiring that the defendant pay the victim restitution in a specific amount that equals the full amount of the victim's economic damages.» ORS 137.106(2)(b) carries the one exception: a court may order less than the full amount only if the victim, or an authorized representative of the victim, consents to the lesser amount, and that consent must be in writing when the conviction is for a person felony. This session's research did not find a restitution provision specific to ORS 165.800 or 165.803 themselves; the restitution right comes from Oregon's general criminal-restitution law, which applies to identity theft convictions the same as any other crime.

Oregon's data breach notification law, ORS 646A.604, works alongside the criminal statute as a companion victim protection: a company that suffers a breach must notify affected Oregon consumers within 45 days of discovering it, and must notify the Attorney General if the number of consumers it has to notify exceeds 250. The required notice itself must include advice on reporting suspected identity theft, giving breach victims an early, actionable warning rather than a bare notification.

This session's research did not find an Oregon-specific private civil cause of action for identity theft written directly into ORS Chapter 165. Oregon's general Unlawful Trade Practices Act may theoretically reach identity theft in some circumstances, but that was not independently confirmed against a specific case or provision this session. A business that deceived you directly is a different situation, and our guide to Oregon scam and fraud laws covers how a UTPA lawsuit works and its short deadline. Whether Oregon has a mandatory police-report-acceptance statute or an identity-theft-passport victim-certification program, both features some other states have, was also not confirmed either way this session.

Federal Rights That Apply Regardless of State Law

Every Oregon identity theft victim also has rights under federal law that apply on top of anything ORS Chapter 165 or 646A provides. A credit freeze and a fraud alert are both free under 15 U.S.C. Section 1681c-1, added by the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018. A free report at IdentityTheft.gov unlocks the right under FCRA Section 605B, 15 U.S.C. Section 1681c-2, to have fraudulent information blocked from a credit report. For the full mechanics, see our guides on how to report identity theft and credit freeze vs. fraud alert.

Information last verified on 2026-08-13, drawing directly on the live text of ORS 165.800, ORS 165.803, ORS 646A.602, ORS 646A.606, ORS 646A.604, and ORS 137.106, plus the Oregon Department of Justice's Consumer Protection Section page. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.

Frequently Asked Questions

What is the penalty for identity theft in Oregon?

Identity theft under ORS 165.800 is a flat Class C felony regardless of dollar amount. Aggravated identity theft under ORS 165.803, a Class B felony, applies when there are 10 or more incidents within 180 days, a prior aggravated identity theft conviction, losses of $10,000 or more within 180 days, or possession of 10 or more pieces of identification from 10 or more people.

What counts as personal identification under Oregon's identity theft law?

Oregon defines personal identification broadly to include names, addresses, phone numbers, driving privileges, Social Security numbers, employment information, signatures, email accounts, photographs, dates of birth, and PINs.

Can I freeze my child's credit report under Oregon law?

Yes. Oregon's own protected-consumer freeze statute, ORS 646A.606, lets a parent, guardian, or conservator freeze the credit report of a protected consumer, defined as anyone not older than 16, or an incapacitated person under guardianship or conservatorship, by submitting proof of authority.

Is restitution mandatory for identity theft convictions in Oregon?

In most cases, yes, but it is not automatic. Under ORS 137.106(1)(a) the district attorney investigates and presents evidence of the victim's economic damages, and if the court finds from that evidence that the victim suffered damages, ORS 137.106(2)(a) requires an order for the full amount. ORS 137.106(2)(b) lets a court order less than the full amount only if the victim or an authorized representative consents to the lesser amount, in writing if the conviction is for a person felony.

How do I report identity theft in Oregon?

File with your local law enforcement agency and with the FTC, either online or by calling 1-877-ID-THEFT. The Oregon Department of Justice's Consumer Protection Section also takes complaints at 1-877-877-9392 or through its online consumer complaints portal.

Does Oregon's data breach law require companies to help victims of identity theft?

Oregon's breach notification law, ORS 646A.604, requires companies to notify affected consumers within 45 days of discovering a breach, and the notice itself must include advice on reporting suspected identity theft.