Texas Identity Theft Laws: Penalties and Victim Rights

Texas prosecutes identity theft as a felony under Penal Code section 32.51, with the severity tied directly to how many people's identifying information the offender obtained, possessed, transferred, or used. A single stolen identity can already mean prison time; possessing the identifying information of dozens of people pushes the charge to a first-degree felony. This page covers the statute's penalty structure, the court-order remedy Texas gives victims to formally establish their status, the state's own minor and protected consumer freeze law, and where the federal recovery process picks up.

This article addresses Texas state law, primarily Penal Code section 32.51 and related provisions of the Business and Commerce Code, plus the federal layer that applies in every state. It does not cover every Texas county's local reporting procedures; contact your local police department or sheriff's office for jurisdiction-specific filing steps.

Texas Penal Code 32.51: The Core Offense

Under Penal Code section 32.51, a person commits an offense by obtaining, possessing, transferring, or using another person's identifying information with the intent to harm or defraud, without that person's consent. The statute specifically extends to the identifying information of a deceased person and of a child under 18, closing off two categories of theft that are easy for an offender to assume carry no real victim. "Identifying information" is defined broadly: name and date of birth, biometric data, electronic identification numbers, financial account information, telecommunication access devices, and government-issued identification numbers all count.

The statute also builds in a presumption: possessing the identifying information of three or more people creates a presumption that the person intended to defraud, unless the person is a legitimate business or government entity handling the information in that capacity. That presumption matters practically, since it shifts the burden onto someone caught holding multiple people's identifying information to explain a lawful reason for having it.

How Penalties Scale With the Number of Records

Texas ties the severity of the charge to a numeric threshold rather than a dollar amount, which is a different approach from many states. The tiers are: fewer than 5 items of identifying information is a state jail felony; 5 to 9 items is a third-degree felony; 10 to 49 items is a second-degree felony; and 50 or more items is a first-degree felony, the state's most serious felony category short of capital offenses.

Two enhancements push the charge up one full category regardless of the item count. If the offense was committed against an elderly individual, or if it was committed to help the offender evade sex-offender registration requirements, the degree of the offense increases by one level. A prosecutor building a case around a handful of records against an elderly victim, for example, can reach a higher felony tier than the raw item count alone would suggest.

Restitution and the Attorney General's Civil Penalty

Section 32.51 authorizes a sentencing court to order the defendant to reimburse the victim for lost income and expenses resulting directly from the offense, though this does not extend to covering the victim's attorney's fees. Separately, Business and Commerce Code section 521.151 gives the Texas Attorney General authority to pursue a civil penalty of $2,000 to $50,000 per violation, with an additional penalty of up to $100 per individual per day for certain breach-notification failures, capped at $250,000 per breach. That civil penalty is enforceable only by the Attorney General's office, not through a private lawsuit under that specific section, and the proceeds are earmarked for further identity-theft enforcement rather than paid to the individual victim.

A related, narrower state-law consumer protection avenue may also apply to conduct that violates the state's unauthorized-use provisions, since Texas's Deceptive Trade Practices Act allows private lawsuits for certain deceptive practices. Whether that Act independently reaches an identity-theft offender was not independently confirmed against the Act's own text for this article, so treat it as a possibility worth raising with an attorney rather than a guaranteed remedy.

The Court-Order Remedy: Clearing Your Name

One of the most practically useful rights Texas gives identity theft victims sits in Business and Commerce Code section 521.101: the right to file an application in district court for a formal order declaring the applicant a victim of identity theft. This remedy does not require the victim to identify every person responsible for the theft. A court order of this kind is designed to help a victim correct fraudulent entries on a credit report or a criminal record that resulted from someone else using their identity, giving them a concrete document to present to creditors, credit bureaus, or law enforcement rather than relying on their word alone.

Texas's Minor and Protected Consumer Freeze Law

Texas maintains its own protected consumer security freeze statute, found in Business and Commerce Code Chapter 20, Subchapter E. Under section 20.21's definitions, a "protected consumer" is a Texas resident younger than 16 at the time a freeze is requested, and a "representative" is someone who can show proof of authority to act on that minor's behalf, such as a parent or legal guardian. Sections 20.25, 20.27, and 20.28 govern how a freeze is requested, how long it stays in place, and how it is removed. This state-law right exists independently of the federal free-freeze rule described below, giving Texas families a state-specific process to point to.

Reporting Identity Theft in Texas

The Texas Attorney General's office maintains a consumer protection function, but its identity-theft resource page could not be reached during the research for this article, so this page does not describe its specific content, hotline, or complaint process. Until that can be verified directly, the most reliable starting point for any Texas resident is the federal process: file a report at IdentityTheft.gov, which generates a personal recovery plan and pre-filled letters for disputing fraudulent accounts, and file a police report with your local Texas law enforcement agency to support the credit bureau and creditor disputes that typically follow.

The Federal Layer

Every Texas identity theft victim can also draw on federal protections that apply regardless of state. The Fair Credit Reporting Act's section 605b lets a victim submit a police report or FTC Identity Theft Report to block fraudulent information from appearing on their credit file. Since 2018, federal law has also required all three nationwide credit bureaus to offer security freezes and fraud alerts to any consumer, free of charge. IdentityTheft.gov, run by the Federal Trade Commission, is the fastest way to generate the initial recovery plan most other steps build on.

Staying Current

A review of the 89th Texas Legislature's 2025 session found no amendment to Penal Code section 32.51 in either the list of new criminal offenses or the list of amendments to existing offenses. The penalty structure described above reflects the statute as currently in force.

Information last verified on 2026-08-13. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.