Federal Identity Theft Laws: 18 U.S.C. § 1028 and § 1028A

Facing a federal identity theft investigation is an incredibly high-stakes situation.

Unlike state-level infractions, federal agencies like the FBI, Secret Service, and Postal Inspection Service spend months quietly gathering data, auditing digital records, and tracking IP addresses to build ironclad cases before making public contact.

Under 18 U.S.C. § 1028 and 18 U.S.C. § 1028A, federal identity theft involves knowingly producing, transferring, possessing, or using another person's unique identifying information without lawful authority to commit fraud or financial crimes.

While routine localized identity theft is handled by state courts, federal jurisdiction is triggered when a scheme crosses state lines, impacts financial institutions, involves multiple victims, or utilizes digital networks.

If you or your business are facing federal audits, grand jury subpoenas, or formal charges, securing early representation is critical to protecting your freedom.

The federal defense team at Esfandi Law Group in California can guide you through the process and build a proactive strategy. To arrange a free, confidential consultation, call (310) 274-6529.

Quick Reference: Federal Identity Theft Laws Summary

Legal Provision	Statutory Rule & Core Definition	Mandatory Sentences & Penalties
Basic Identity Theft (18 U.S.C. § 1028)	Knowingly producing, transferring, possessing, or using false identification documents or another person's means of identification with intent to defraud.	Up to 15 years in federal prison, substantial fines, asset forfeiture, and mandatory restitution. Caps can rise to 20 or 30 years if tied to drug trafficking, violent crimes, or international terrorism.
Aggravated Identity Theft (18 U.S.C. § 1028A)	Knowingly transferring, possessing, or using another person's identity during and in relation to a specified predicate federal felony (e.g., wire fraud, mail fraud, bank fraud).	Mandatory 2-year federal prison sentence (or 5 years for terrorism ties). This penalty must run consecutively (additively) to the sentence for the underlying felony.

Key Takeaways: Statutory Elements of Proof

To secure a conviction under federal identity theft statutes, the Department of Justice must prove three core criteria beyond a reasonable doubt:

1. Knowing and Unauthorized Use: The defendant deliberately possessed, transferred, or used a "means of identification" belonging to a real person without that person's valid legal consent.
2. Knowledge of a Real Person: Following a critical U.S. Supreme Court ruling (Flores-Figueroa v. United States), the government must prove the defendant affirmatively knew the stolen credentials belonged to an actual, living person, rather than being entirely fabricated or synthesized by an algorithm.
3. Intent to Defraud: The defense must show that the data was weaponized to advance a deceptive scheme. Honest administrative slip-ups, typos, or clerical data-entry errors do not meet the criminal thresholds of 18 U.S.C. § 1028.

What Constitutes a "Means of Identification"?

Under federal parameters, identifying data stretches far beyond physical driver's licenses. It includes:

Social Security numbers (SSNs) and Taxpayer Identification numbers (ITINs)
Driver's license, passport, or alien registration numbers
Unique biometric data (fingerprints, retina scans, or voiceprints)
Credit card numbers, bank routing codes, or digital access devices
Unique electronic serial numbers, IP addresses, or encrypted login credentials

Federal Penalties & Sentencing Factors

A conviction under federal identity theft laws results in strict penalties. Since the federal criminal justice system does not offer parole, the entire prison sentence must be served.

Core Statutory Penalties

Federal Prison Sentence: Up to 15 years for a standard violation under Section 1028. If the identity theft is carried out to facilitate a drug trafficking crime or a crime of violence, the maximum penalty increases to 20 years. If it is tied to international terrorism, the maximum penalty is 30 years.
Mandatory Consecutive Sentences (Section 1028A): Aggravated Identity Theft carries a mandatory flat 2-year prison term (or 5 years for terrorism-related predicate felonies). By law, federal judges are prohibited from allowing this sentence to run concurrently (at the same time) with the underlying fraud charge; it must be added on top of the principal sentence.
Criminal Fines: Individual defendants face fines of up to $250,000 per count, while corporate entities or institutional co-conspirators face fines of up to $500,000 per count.
Mandatory Restitution: Courts will mandate the defendant to compensate each victim, including financial institutions and individuals, for all out-of-pocket costs and expenses related to clearing their credit records.
Asset Forfeiture: The Department of Justice can seize real estate, cash, electronics, vehicles, or business structures that were directly involved in the identity theft scheme or obtained using its proceeds.

Factors That Influence Federal Sentencing

Federal judges calculate sentences utilizing the U.S. Sentencing Guidelines. The final penalty range is heavily influenced by specific offense characteristics:

The Intended Financial Loss: Sentences increase exponentially depending on the total dollar amount the defendant attempted to steal or compromise, not on the amount actually withdrawn or spent.
Number of Victims: If the scheme involved collecting personal data from a large database, the severity of the offense increases substantially depending on whether there were more than 5, 10, or 50 victims.
Sophistication of Means: Using sophisticated cyber tools, working on the dark web, establishing dummy corporations, or employing encrypted networks to hide data transfers will lead to substantial sentencing increases.

Aggravated Identity Theft (18 U.S.C. § 1028A) and the Consecutive Sentence Trap

The most dangerous weapon in a federal prosecutor's arsenal is 18 U.S.C. § 1028A (Aggravated Identity Theft). This statute is rarely charged alone; instead, it is appended to other white-collar counts like wire fraud or healthcare fraud.

The Stacking Rule: By law, a judge cannot run an aggravated identity theft sentence concurrently with the underlying crime; it must be served consecutively. For example, if a court sentences a defendant to 4 years for wire fraud, the mandatory 2-year enhancement under Section 1028A increases the total prison time to 6 years.

Real-World Case Example: A Digital Account Takeover

The Scenario

A person acquires a set of leaked employee records from a dark web forum. The database includes names, Social Security numbers, and personal email addresses.

Using this data, he sets up an automated phishing script that resets the passwords on the victims' retail and bank accounts.

He successfully logs into three separate profiles, updates the mailing addresses, and orders luxury electronics to be shipped across state lines to a drop location in Los Angeles.

Why This Triggers Federal Prosecution

The Federal Nexus: Using the internet to transmit data across state borders automatically activates federal wire jurisdiction.
18 U.S.C. § 1028 Exposure: He intentionally possessed and shared someone else's identification details, including stolen logins and SSNs, to support a fraud scheme.
18 U.S.C. § 1028A Enhancement: Because he used these stolen identities during and in relation to an underlying felony (Wire Fraud under 18 U.S.C. § 1343), prosecutors will append the aggravated identity theft charge, guaranteeing a mandatory, non-negotiable 2-year consecutive prison term if convicted.

Related Federal Crimes

Federal identity theft indictments rarely include just single charges. Prosecutors often combine Section 1028 counts with related federal violations to strengthen their position during plea negotiations.

18 U.S.C. § 1343 (Wire Fraud): Charged whenever a scheme uses electronic transmissions, emails, or internet networks to execute a fraud. Carries up to 20 years in prison (or 30 years if it targets a financial institution).
18 U.S.C. § 1341 (Mail Fraud): Triggered when fraudulent credit cards, checks, or identity documents are sent via the U.S. Postal Service or commercial carriers such as FedEx or UPS.
18 U.S.C. § 1029 (Access Device Fraud): Prohibits the unauthorized creation, use, or sale of counterfeit credit cards, account numbers, and login tokens.
18 U.S.C. § 1030 (Computer Fraud / Hacking): This applies if personal identifying data was collected through malware, hacking into secure databases, or exceeding authorized network access.
42 U.S.C. § 408 (Social Security Fraud): Specifically targets the misuse, purchase, sale, or modification of a Social Security card or number for fraudulent purposes.

Strategic Defenses for Identity Theft Charges

Defending a federal identity theft case demands careful analysis of electronic evidence, adherence to compliance policies, and respect for constitutional limits.

Lack of Knowledge of a Real Person: If the defense can show that the identification data used was part of a synthetic identity scheme (a blend of real and completely fabricated information) and that the defendant had no knowledge that a real person was associated with the numbers, the mandatory 2-year aggravated enhancement under Section 1028A cannot legally stand.
Authorized Use or Valid Consent: In corporate or healthcare settings, a person might have had explicit, implied, or historical approval to sign documents or use their employer's or relative's credentials for processing paperwork.
Absence of Intent to Defraud: If data-entry staff or billing administrators mistakenly enter a wrong sequence of digits that corresponds to someone else's account, it is considered an administrative error rather than a federal crime. Criminal liability only arises if there is an intentional scheme to deceive.
Challenging Digital Attribution: IP addresses, device logs, and MAC addresses may be spoofed or compromised by malware. An effective defense includes digital forensics to assess whether the government can definitively link the keystrokes to the accused individual.
Fourth Amendment Suppression: If federal agents seize phones, hard drives, or cloud accounts under an overly broad or invalid search warrant, a skilled defense lawyer can challenge and suppress that digital evidence, making it impossible for the prosecution to prove its case.

Frequently Asked Questions (FAQs)

What differentiates federal identity theft from state-level identity theft?

While state charges generally focus on localized, single-victim incidents (such as using a stolen wallet at a local grocery store), federal charges under 18 U.S.C. § 1028 apply when the scheme involves interstate operations, digital infrastructure, large financial scale, or targets federal programs such as Medicare or the IRS.

Can I be charged under 18 U.S.C. § 1028A if I did not know the stolen data belonged to a living person?

No. The U.S. Supreme Court decided that the government needs to demonstrate you knew the credentials belonged to a real, living person. If you genuinely thought the data was entirely fake or computer-generated, you cannot be convicted of Aggravated Identity Theft.

What does it mean that an aggravated identity theft sentence is "consecutive"?

A consecutive sentence requires serving prison time one after the other. For example, if you are sentenced to 3 years for wire fraud and also found guilty of aggravated identity theft, your total prison time becomes a fixed 5 years. These sentences cannot be served at the same time.

Are electronic login details and passwords considered a "means of identification"?

Yes. According to modern federal standards, unique electronic user IDs, routing numbers, access codes, IP addresses, and biometric markers are all considered part of a person's identity under the law.

Can an identity theft charge be dismissed if no financial loss actually occurred?

Yes, this depends on the evidence. Under federal law, a crime is considered complete once the attempt or conspiracy begins with fraudulent intent.

Although not experiencing actual financial loss can help reduce your sentence, it does not prevent prosecutors from pursuing charges.

What should I do if federal investigators show up with a search warrant for my electronics?

Avoid explaining your version of events, deleting files, or clearing browser history, as this may lead to separate charges of obstruction of justice.

Stay polite, request a copy of the warrant, explicitly state that you wish to remain silent until your lawyer arrives, and contact a federal defense firm without delay.

Secure a Proactive Defense Strategy Today

If you face a federal white-collar investigation or indictment, acting swiftly is crucial to safeguard your future. While federal agencies dedicate extensive effort to building their cases, identifying weaknesses in their evidence early can give you an advantage.

The legal team at Esfandi Law Group is prepared to review your documentation, interface with federal investigators on your behalf, and build a defense tailored to your situation.

Schedule your completely free, confidential case review today by calling (310) 274-6529 or reaching out through our direct office channels.

Federal Identity Theft