Virginia Identity Theft Laws: Penalties and the Identity Theft Passport

Virginia's identity theft statute, Code section 18.2-186.3, ranges from a Class 1 misdemeanor for a small-scale first offense up to a Class 4 felony for large-scale trafficking in stolen identities. What sets Virginia apart from many states is not just the statute itself but a dedicated administrative benefit built around it: the Identity Theft Passport, a physical card a wrongly accused victim can carry and show to law enforcement to help prevent being detained or arrested for a crime someone else committed under their stolen identity. This page covers the statute's penalty structure, the Passport program, Virginia's own minor freeze law, and the breach notification and expungement rights that round out the state's protections.

This article addresses Virginia state law, primarily Code section 18.2-186.3 and related sections of Titles 18.2, 59.1, and 19.2, plus the federal layer that applies in every state. Some administrative details, including the exact statutory basis for the Identity Theft Passport, were not fully resolved during research and are flagged where relevant.

Virginia Code 18.2-186.3: The Core Offense

Code section 18.2-186.3 prohibits, without authorization and with intent to defraud, obtaining or accessing another person's non-public identifying information that would help access their financial resources, obtain identification documents, or obtain benefits in their name; obtaining money, credit, loans, goods, or services using someone else's identifying information; obtaining identification documents in another person's name; or obtaining that information while impersonating a law enforcement officer or Commonwealth official. A parallel set of prohibitions applies to obtaining identifying information with intent to sell or distribute it to a third party. A separate provision makes it unlawful to use another person's identification documents or information, whether that person is living, deceased, or fictitious, to avoid a summons, arrest, or prosecution, or to impede a criminal investigation.

"Identifying information" is defined broadly under the statute: name, date of birth, Social Security number, driver's license number, bank and credit and debit account numbers, PINs, electronic identification codes, signatures, biometric data, fingerprints, passwords, and any other information usable to access financial resources or obtain identification, money, credit, goods, or services.

Penalty Structure

A baseline violation of section 18.2-186.3 is a Class 1 misdemeanor. It rises to a Class 6 felony if the financial loss is $1,000 or more, and it is a Class 6 felony automatically on any second or subsequent conviction regardless of loss amount. For the sell-or-distribute version of the offense, touching 5 or more people's information in the same transaction or occurrence is a Class 5 felony, and touching 50 or more people's information is a Class 4 felony, Virginia's most serious felony category outside of murder and certain other violent crimes. A violation that results in the arrest or detention of the person whose identity was used to avoid a summons, arrest, or prosecution is a Class 5 felony. Notably, the crime is deemed committed wherever the victim resides, or wherever any part of the offense occurred, regardless of whether the defendant was ever physically present there, which gives Virginia prosecutors broad venue over out-of-state offenders targeting Virginia residents.

The Identity Theft Passport

Virginia's Attorney General offers an Identity Theft Passport through the office's Victim Notification Program. This is a physical card that a wrongly accused victim can carry and present to law enforcement or others who challenge their identity, designed specifically to help prevent wrongful detention or arrest for a crime someone else committed while using the victim's stolen identity. Eligibility generally requires having filed a police report as someone who believes they are a victim of identity crime, or having obtained a court order expunging a fraudulent record connected to the theft. To apply, a completed application is mailed to the Office of the Attorney General's Victim Notification Program in Richmond. The Attorney General also provides a downloadable Identity Theft Affidavit that a victim can use to alert businesses to the fraud in a single document rather than repeating the explanation to each creditor.

One clarification worth stating directly: the "victim assistance" language in section 18.2-186.3(F) does not itself create the Passport. That subsection is narrower and discretionary, letting the Attorney General assist a victim in obtaining information to correct credit report or identifying-information errors, but it explicitly does not provide legal representation, and no separate Virginia Code section creating the Passport by name was located. The Passport appears to rest on the Attorney General's general administrative authority rather than a dedicated statute.

Restitution and Civil Remedies

Section 18.2-186.3(E) requires that, upon conviction, a court order restitution as it deems appropriate to any person whose identifying information was appropriated, or to that person's estate. Restitution can specifically include the victim's actual expenses in correcting inaccuracies or errors in a credit report or other identifying information. No dedicated Virginia statutory civil cause of action with statutory damages against the identity thief specifically was located during this article's research; two narrower damages provisions exist but target different defendants: one preserves a victim's right to recover direct economic damages tied to a business's breach-notification failure, not against the thief, and another makes a person who fraudulently obtains a credit report or manipulates a security freeze liable to the credit reporting agency, not the consumer.

Police Reports and the CRA Blocking Right

Under Code section 18.2-186.3:1, a consumer may report a case of identity theft to law enforcement in the jurisdiction where they reside, but doing so is permissive under the statute's own text, not mandatory. Once a valid police report exists, a credit reporting agency must, within 30 days of receiving a copy, block reporting of information the consumer alleges resulted from an identity theft violation, and notify the business that furnished the disputed information that a report was filed and a block requested. A credit reporting agency may decline or rescind a block only on specific good-faith grounds, and must generally accept the consumer's version of disputed information absent a good-faith doubt.

Expungement for Fraudulent Criminal Charges

Virginia gives identity theft victims a distinct remedy when someone else's crime was charged or arrested under their stolen name: under Code section 19.2-392.2, a person whose name or identification was used without consent by someone who was then charged or arrested may petition the court that disposed of the charge for relief. No court fees or costs may be charged for filing this petition, and it must include a complete set of the petitioner's fingerprints obtained from a law enforcement agency.

Virginia's Minor and Protected Consumer Freeze Law

Virginia has maintained its own protected consumer security freeze statute since 2014, four years before the federal minor-freeze right took effect. A "protected consumer" is anyone under 16 at the time of the request, or an incapacitated person with a court-appointed guardian or conservator. Virginia's version goes beyond a bare federal baseline in several ways: a credit reporting agency must place the freeze within 30 days of a compliant request; if the agency has no existing file on the minor, it must create one solely for the freeze, and that file cannot be used to evaluate creditworthiness, insurance eligibility, or employment; no fee may be charged for any service under the statute; and enforcement is exclusively by the Attorney General, who can seek injunctive relief, damages for aggrieved consumers, and a civil penalty of up to $1,000 per willful violation.

Breach Notification

Virginia's breach notification statute, Code section 18.2-186.6, requires notice to affected residents describing the incident in general terms, what data was exposed, protective steps taken, a contact phone number if one exists, and advice to remain vigilant and monitor free credit reports. Notice must go without unreasonable delay to residents and the Attorney General, and breaches affecting 1,000 or more people also require notice to the nationwide credit bureaus. The Attorney General may seek a civil penalty of up to $150,000 per breach or series of breaches, and the statute preserves an individual's right to recover direct economic damages from a violation, specifically for notification failures.

The Federal Layer

Every Virginia identity theft victim can also draw on federal protections that apply regardless of state. The Fair Credit Reporting Act's section 605b lets a victim submit a police report or FTC Identity Theft Report to block fraudulent information from appearing on their credit file. IdentityTheft.gov, run by the Federal Trade Commission, remains the fastest way to generate the initial recovery plan most other steps build on.

Information last verified on 2026-08-13. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.