Virginia Identity Theft Laws: Penalties and the Identity Theft Passport

Virginia's identity theft statute, Code section 18.2-186.3, ranges from a Class 1 misdemeanor for a small-scale first offense up to a Class 4 felony for large-scale trafficking in stolen identities. What sets Virginia apart from many states is not just the statute itself but a dedicated administrative benefit built around it: the Identity Theft Passport, a physical card a wrongly accused victim can carry and show to law enforcement to help prevent being detained or arrested for a crime someone else committed under their stolen identity. This page covers the statute's penalty structure, the Passport program, Virginia's own minor freeze law, and the breach notification and expungement rights that round out the state's protections.

This article addresses Virginia state law, primarily Code section 18.2-186.3 and related sections of Titles 18.2, 59.1, and 19.2, including Code section 18.2-186.5, which creates the Identity Theft Passport by name, plus the federal layer that applies in every state.

Virginia Code 18.2-186.3: The Core Offense

Code section 18.2-186.3 prohibits, without authorization and with intent to defraud, obtaining or accessing another person's non-public identifying information that would help access their financial resources, obtain identification documents, or obtain benefits in their name; obtaining money, credit, loans, goods, or services using someone else's identifying information; obtaining identification documents in another person's name; or obtaining that information while impersonating a law enforcement officer or Commonwealth official. A parallel set of prohibitions applies to obtaining identifying information with intent to sell or distribute it to a third party. A separate provision makes it unlawful to use another person's identification documents or information, whether that person is living, deceased, or fictitious, to avoid a summons, arrest, or prosecution, or to impede a criminal investigation.

"Identifying information" is defined broadly under the statute: name, date of birth, Social Security number, driver's license number, bank and credit and debit account numbers, PINs, electronic identification codes, signatures, biometric data, fingerprints, passwords, and any other information usable to access financial resources or obtain identification, money, credit, goods, or services.

Penalty Structure

A baseline violation of section 18.2-186.3 is a Class 1 misdemeanor. It rises to a Class 6 felony if the financial loss is $1,000 or more, and it is a Class 6 felony automatically on any second or subsequent conviction regardless of loss amount. For the sell-or-distribute version of the offense, touching 5 or more people's information in the same transaction or occurrence is a Class 5 felony, and touching 50 or more people's information is a Class 4 felony, Virginia's most serious felony category outside of murder and certain other violent crimes. A violation that results in the arrest and detention of the person whose identity was used to avoid a summons, arrest, or prosecution, or to impede a criminal investigation, is a Class 5 felony. That enhancement is conjunctive: an arrest without detention, or detention without an arrest, does not trigger it. Notably, the crime is deemed committed wherever the victim resides, or wherever any part of the offense occurred, regardless of whether the defendant was ever physically present there, which gives Virginia prosecutors broad venue over out-of-state offenders targeting Virginia residents.

The Identity Theft Passport

Virginia's Attorney General offers an Identity Theft Passport through the office's Victim Notification Program. This is a physical card that a wrongly accused victim can carry and present to law enforcement or others who challenge their identity, designed specifically to help prevent wrongful detention or arrest for a crime someone else committed while using the victim's stolen identity. The program is created by Code section 18.2-186.5, which sets two independent paths to it. Under subsection A, the Attorney General may issue the Passport after receiving a certified copy of a court order obtained under Code section 19.2-392.2, the expungement remedy described below. Under subsection B, a police report alone is enough: the Attorney General may issue the Passport on receipt of a copy of a police report showing that the person reported to a law enforcement agency that their name or other identification was used without their consent. No court order is required on that second path. To apply, a completed application is mailed to the Office of the Attorney General's Victim Notification Program in Richmond. The Attorney General also provides a downloadable Identity Theft Affidavit that a victim can use to alert businesses to the fraud in a single document rather than repeating the explanation to each creditor.

One distinction worth stating directly: the "victim assistance" language in section 18.2-186.3(F) is a separate, narrower provision and is not the source of the Passport. That subsection is discretionary, letting the Attorney General help a victim obtain information needed to correct inaccuracies in a credit report or other identifying information, and it expressly affords no legal representation. The Passport itself rests on section 18.2-186.5.

Restitution and Civil Remedies

Section 18.2-186.3(E) requires that, upon conviction, a court order restitution as it deems appropriate to any person whose identifying information was appropriated, or to that person's estate. Restitution can specifically include the victim's actual expenses in correcting inaccuracies or errors in a credit report or other identifying information. No dedicated Virginia statutory civil cause of action with statutory damages against the identity thief specifically was located during this article's research; two narrower damages provisions exist but target different defendants: one preserves a victim's right to recover direct economic damages tied to a business's breach-notification failure, not against the thief, and another makes a person who fraudulently obtains a credit report or manipulates a security freeze liable to the credit reporting agency, not the consumer.

Police Reports and the CRA Blocking Right

Under Code section 18.2-186.3:1, a consumer may report a case of identity theft to law enforcement in the jurisdiction where they reside, but doing so is permissive under the statute's own text, not mandatory. Once a valid police report exists, a credit reporting agency must, within 30 days of receiving a copy, block reporting of information the consumer alleges resulted from an identity theft violation, and notify the business that furnished the disputed information that a report was filed and a block requested. A credit reporting agency may decline or rescind a block only on specific good-faith grounds, and must generally accept the consumer's version of disputed information absent a good-faith doubt.

Expungement for Fraudulent Criminal Charges

Virginia gives identity theft victims a distinct remedy when someone else's crime was charged or arrested under their stolen name: under Code section 19.2-392.2, a person whose name or identification was used without consent by someone who was then charged or arrested may petition the court that disposed of the charge for relief. No court fees or costs may be charged for filing this petition, and it must include a complete set of the petitioner's fingerprints obtained from a law enforcement agency.

Virginia's Minor and Protected Consumer Freeze Law

Virginia has maintained its own protected consumer security freeze statute since 2014, four years before the federal minor-freeze right took effect. A "protected consumer" is anyone under 16 at the time of the request, or an incapacitated person with a court-appointed guardian or conservator. Virginia's version goes beyond a bare federal baseline in several ways: a credit reporting agency must place the freeze within 30 days of a compliant request; if the agency has no existing file on the minor, it must create one solely for the freeze, and that file cannot be used to evaluate creditworthiness, insurance eligibility, or employment; no fee may be charged for any service under the statute; and the Attorney General holds exclusive authority to bring an action over a violation of that 30-day placement duty, seeking an injunction, damages for aggrieved protected consumers, costs and attorney fees, plus a civil penalty of up to $1,000 per violation where the court finds the violation willful. That exclusivity is scoped to the placement duty rather than to the statute as a whole: a separate provision makes anyone who obtains a consumer report or requests, lifts, or removes a freeze under false pretenses liable to the credit reporting agency for its damages.

Breach Notification

Virginia's breach notification statute, Code section 18.2-186.6, requires notice to affected residents describing the incident in general terms, what data was exposed, protective steps taken, a contact phone number if one exists, and advice to remain vigilant and monitor free credit reports. Notice must go without unreasonable delay to residents and the Attorney General, and breaches affecting 1,000 or more people also require notice to the nationwide credit bureaus. The Attorney General may seek a civil penalty of up to $150,000 per breach or series of breaches, and the statute preserves an individual's right to recover direct economic damages from a violation, specifically for notification failures.

The Federal Layer

Every Virginia identity theft victim can also draw on federal protections that apply regardless of state. The Fair Credit Reporting Act's section 605b lets a victim submit a police report or FTC Identity Theft Report to block fraudulent information from appearing on their credit file. IdentityTheft.gov, run by the Federal Trade Commission, remains the fastest way to generate the initial recovery plan most other steps build on.

Information last verified on 2026-08-13. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.

Frequently Asked Questions

What is the penalty for identity theft in Virginia?

A baseline violation is a Class 1 misdemeanor. It becomes a Class 6 felony if the financial loss is $1,000 or more, or automatically on a second or subsequent conviction. Selling or distributing information touching 5 or more people is a Class 5 felony, and 50 or more people is a Class 4 felony.

What is Virginia's Identity Theft Passport?

It is a physical card issued by the Attorney General's Victim Notification Program that a wrongly accused victim can present to law enforcement to help prevent detention or arrest for a crime someone else committed under their stolen identity. Code section 18.2-186.5 sets two paths: a certified copy of an expungement order under section 19.2-392.2, or a copy of a police report alone, with no court order required.

Do I have to file a police report before a Virginia credit bureau will block fraudulent information?

Filing a police report is optional under Virginia law, but once you have a valid police report, the credit bureau must block the disputed information within 30 days of receiving a copy.

Can a Virginia identity theft victim clear a criminal charge filed under their stolen name?

Yes. Code section 19.2-392.2 lets a victim petition the court that disposed of the charge for relief, with no filing fees, and the petition must include a full set of the petitioner's fingerprints.

Does Virginia have a credit freeze law for minors?

Yes, since 2014, covering anyone under 16 and incapacitated persons with a court-appointed guardian. No fee may be charged, and only the Attorney General may bring an action over a credit bureau's failure to place the freeze within 30 days.

Where should a Virginia resident report identity theft?

The Virginia Attorney General recommends notifying your bank and a credit bureau, contacting local police to file a report, filing with IC3.gov if the theft happened online, and applying for an Identity Theft Passport through the Victim Notification Program.