Federal Crime of Identity Theft – 18 U.S.C. § 1028

Under 18 U.S.C. § 1028, the federal government aggressively investigates and prosecutes identity theft involving the unlawful production, possession, transfer, or usage of false identification documents and stolen personal identifying information (PII).

Specialized federal agencies, including the FBI, the United States Secret Service, and the IRS Criminal Investigation Division (IRS-CI), investigate federal identity theft charges, which typically involve multi-state schemes, major financial losses, or cybercrime activity.

A conviction under 18 U.S.C. § 1028 carries severe penalties, including lengthy federal prison terms, massive fines, mandatory restitution, and mandatory consecutive prison time under related aggravated identity theft statutes.

Defending against these complex charges requires immediate, proactive legal action to challenge digital evidence, dispute intent, and disrupt federal prosecution strategies.

Legal Definition of 18 U.S.C. 1028

“Whoever knowingly and without lawful authority produces, transfers, possesses, or uses a means of identification of another person with the intent to commit, or to aid or abet, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law, shall be punished as provided in subsection (c) of this section.”

Key Statutory Definitions

Understanding these statutory definitions is essential because each term establishes the exact legal boundaries prosecutors must meet to build a valid federal identity theft case.

Means of Identification: Any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual (e.g., Social Security numbers, driver's license numbers, taxpayer identification numbers, bank account numbers, passports, or biometric data).
Produce: To manufacture, alter, authenticate, issue, or re-encode an identification document, authentication feature, or fake credential without authorization.
Without Lawful Authority: Operating without legal right, valid consent, or official authorization to use, possess, or transfer another individual's personal or financial identity credentials.

Elements Required for Conviction

To secure a conviction under 18 U.S.C. § 1028, federal prosecutors must prove each of the following elements beyond a reasonable doubt:

Knowing Action: You knowingly produced, transferred, possessed, or used a means of identification or false identification document.
Lack of Authority: You acted without lawful authority or legitimate consent from the person whose identity was used.
Unlawful Intent or Underlying Felony: You possessed or used the identity with the specific intent to commit, facilitate, or aid and abet a federal crime or state felony.

Penalties for Conviction

A conviction under 18 U.S.C. § 1028 triggers severe, life-altering federal sentencing outcomes determined by the judge under the United States Sentencing Guidelines.

Federal Imprisonment: Up to 15 years in federal prison for standard identity fraud, false document production, or stolen PII trafficking; up to 20 years if linked to drug trafficking or violent offenses; up to 30 years if connected to international or domestic terrorism.
Mandatory Consecutive Sentences (18 U.S.C. § 1028A): An additional mandatory 2-year prison sentence for Aggravated Identity Theft (or 5 years for terrorism connections) that must run consecutively to any underlying federal felony sentence.
Substantial Criminal Fines: Statutory criminal fines up to $250,000 for individuals (or up to $500,000 for corporate entities or organized groups).
Mandatory Restitution: Court-ordered repayment to individual victims, credit bureaus, and financial institutions to cover total economic losses, legal expenses, and credit repair costs.
Supervised Release & Forfeiture: Up to 5 years of federal supervised release following prison discharge, along with mandatory legal forfeiture of all computers, servers, hardware, and financial proceeds used in the commission of the crime.
Permanent Felony Record: Long-term loss of civil rights, including gun ownership rights, voting rights, and permanent damage to professional licensing and future employment opportunities.

Defense Strategies

Defending against 18 U.S.C. § 1028 charges requires dismantling the prosecution's case before or during trial by exploiting evidentiary weaknesses and asserting constitutional protections.

Lack of Knowledge or Fraudulent Intent: Proving you had no knowledge that credentials were stolen or altered, or demonstrating a complete absence of intent to commit an underlying fraud or unlawful act (e.g., possessing documents as part of authorized testing or an innocent mistake).
Authorized Consent & Good Faith Belief: Establishing that you reasonably believed in good faith that you had explicit permission or legal authorization from the owner to use or access the identifying information.
Fourth Amendment Suppression Motions: Challenging the admissibility of physical devices, hard drives, or document stashes obtained by federal agents through warrantless searches, illegal wiretaps, or defective search warrants.
Insufficient Evidence / Misidentification: Demonstrating that IP addresses, shared network logs, or compromised server credentials fail to prove that you personally conducted the identity theft transactions.
Duress or Coercion: Presenting evidence that you were forced to acquire, transfer, or process stolen credentials under immediate threats of violence or serious physical harm.

Hypothetical Examples

An individual obtains stolen Social Security numbers from a corporate data breach and uses them to open fraudulent bank accounts and submit fake online loan applications.
A technician uses specialized software to re-encode stolen credit card data onto blank magnetic-stripe cards to purchase luxury electronics at retail stores.
An authorized security researcher accesses system files containing personal identifiers under explicit contractual authorization, lacking any criminal intent to defraud or misuse the information.

Related Federal Laws

Understanding related federal statutes is critical because federal prosecutors rarely charge 18 U.S.C. § 1028 in isolation, frequently stacking ancillary statutory offenses to stack mandatory penalties and leverage plea bargains.

18 U.S.C. § 1028A (Aggravated Identity Theft): Mandates an additional, non-concurrent 2-year prison term for using stolen identities while committing predicate offenses like bank fraud or wire fraud.
18 U.S.C. § 1343 (Wire Fraud): Penalizes schemes to defraud or obtain money using electronic communications across state lines (up to 20 years in prison, or 30 years if affecting a financial institution).
18 U.S.C. § 1344 (Bank Fraud): Prohibits executing schemes to defraud financial institutions or obtain property under bank custody (up to 30 years in prison).
18 U.S.C. § 1030 (Computer Fraud and Abuse Act - CFAA): Criminalizes accessing protected computer systems without authorization or exceeding authorized access to obtain financial or identifying data (up to 10 to 20 years in prison).
18 U.S.C. § 1029 (Fraud in Connection with Access Devices): Penalizes producing, using, or trafficking in counterfeit access devices, credit card numbers, or telecommunication credentials (up to 10 to 20 years in prison).
18 U.S.C. § 1341 (Mail Fraud): Prohibits sending, receiving, or delivering stolen identity materials or fraudulent documents through the U.S. Postal Service or private commercial carriers (up to 20 to 30 years in prison).

Frequently Asked Questions

What is the difference between standard identity theft and aggravated identity theft?

Standard identity theft under 18 U.S.C. § 1028 covers the unauthorized creation, possession, or transfer of false identities, whereas Aggravated Identity Theft under 18 U.S.C. § 1028A requires using another person's identity during specific predicate felonies and imposes a mandatory, consecutive 2-year prison term.

Can I be prosecuted in federal court if the identity theft occurred entirely within one state?

Yes, federal jurisdiction applies if the offense affected interstate commerce, involved internet communications or servers located in other states, used the U.S. mail, or violated federal predicate statutes.

Is it considered federal identity theft if I use a fake name that does not belong to a real person?

No, 18 U.S.C. § 1028 and § 1028A specifically require using a means of identification belonging to an actual, living or deceased person; using a completely fabricated alias may constitute document fraud or forgery, but not identity theft.

What should I do if federal law enforcement executes a search warrant at my home or business?

Remain calm, do not consent to searches beyond the warrant, exercise your Right to Remain Silent under the Fifth Amendment, and contact an experienced federal criminal defense lawyer immediately before answering any questions.

What federal agencies are responsible for investigating identity theft schemes?

The Federal Bureau of Investigation (FBI), the United States Secret Service, the IRS Criminal Investigation Division (IRS-CI), and the Postal Inspection Service primarily conduct identity theft investigations.

Can business entities or corporations be victimized or charged under federal identity theft laws?

While means of identification generally refer to individual persons, stealing corporate credentials or using employee credentials to defraud financial institutions can lead to related charges of corporate fraud, wire fraud, and conspiracy.

Eisner Gorin LLP is available to assist you. To schedule a consultation, call (818) 781-1570 or fill out the contact form.

Identity Theft