Aggravated Identity Theft (18 U.S.C. § 1028A)

Aggravated Identity Theft

Statute:	18 U.S.C. § 1028A
U.S. Code:	Title 18, Chapter 47
Max Prison:	2 years mandatory consecutive (5 years for terrorism)
Max Fine:	$250,000
Guidelines:	USSG §2B1.6
Base Level:	N/A (mandatory consecutive)
Agencies:	FBI, USSS, FTC, SSA-OIG
Related:	Wire Fraud, Bank Fraud, False Statements

Aggravated identity theft is a serious federal crime codified at 18 U.S.C. § 1028A. It punishes anyone who uses another person's identification while committing certain enumerated federal felonies. The statute is notable in that the sentencing judge has no discretion: a mandatory 2-year prison term attaches, and it runs separately from whatever sentence the defendant receives for the underlying crime.

Congress passed the Identity Theft Penalty Enhancement Act of 2004 because identity theft was growing rapidly and fueling countless other crimes. The legislation reflected serious concern about criminals combining stolen identities with fraud schemes to amplify both their gains and the harm suffered by victims. That mandatory consecutive approach transformed how federal sentencing works for these cases, and the law has since become one of the most frequently charged statutes in white-collar prosecutions.

Elements of the Offense

Prosecutors must prove all four elements beyond a reasonable doubt. First, the defendant must have knowingly transferred, possessed, or used a means of identification belonging to another person. Second, that use must have occurred without lawful authority. Third, it must have taken place during and in relation to an enumerated felony offense. Fourth, the defendant must have known the identification belonged to an actual, living person rather than a fictitious one.

Means of Identification

The statute defines the term broadly. Under 18 U.S.C. § 1028(d)(7), a "means of identification" includes any name, Social Security number, date of birth, driver's license number, passport number, alien registration number, or government-issued identification number. The definition also reaches unique biometric data such as fingerprints, voice prints, and retina images, as well as unique electronic identification numbers or addresses, routing codes, and telecommunication identifying information or access devices. That breadth means prosecutors can charge the statute across a wide range of factual scenarios, from traditional document fraud to sophisticated digital identity crimes.

Knowledge Requirement

This element matters more than it might first appear. In Flores-Figueroa v. United States (2009), the Supreme Court held that prosecutors must prove the defendant knew the identity belonged to a real, actual person. The Court rejected the government's argument that knowledge of the victim's real identity was unnecessary. For example, if a defendant created a fictitious Social Security number and it happened by chance to match a number assigned to a real person, that would not constitute aggravated identity theft if the defendant genuinely had no knowledge a real person held that number. Still, circumstantial evidence is enough. Evidence that a defendant purchased data from an identity theft marketplace, for instance, strongly supports the inference that the defendant knew real victims existed behind the numbers. Courts applying Flores-Figueroa since 2009 have consistently held that the knowledge requirement can be satisfied through circumstantial proof, and acquittals on this ground remain uncommon.

Enumerated Predicate Offenses

Aggravated identity theft only applies when the identity theft occurs "during and in relation to" a specific list of federal crimes set out in 18 U.S.C. § 1028A(c). The predicate offenses span several categories. Fraud and related crimes include mail fraud (18 U.S.C. § 1341), wire fraud (18 U.S.C. § 1343), bank fraud (18 U.S.C. § 1344), healthcare fraud (18 U.S.C. § 1347), access device fraud (18 U.S.C. § 1029), and computer fraud (18 U.S.C. § 1030). Immigration offenses covered include illegal reentry (8 U.S.C. § 1326) and document fraud (18 U.S.C. § 1546). Social Security fraud under 42 U.S.C. § 408 also qualifies. Additional predicates include theft of public money (18 U.S.C. § 641), false statements (18 U.S.C. § 1001), passport fraud (18 U.S.C. § 1542), and nationality fraud (18 U.S.C. § 1015). The "during and in relation to" requirement is not merely technical. Courts have held that the identity theft must be genuinely connected to the predicate crime, not merely incidental or tangentially related.

Statutory Penalties

Category	Mandatory Minimum	Maximum Fine	Consecutive Requirement
Standard aggravated identity theft	2 years	$250,000	Must run consecutive
Terrorism-related identity theft	5 years	$250,000	Must run consecutive

The penalties under § 1028A are genuine mandatory minimums with no judicial escape valve. The 2-year or 5-year sentence runs consecutively, meaning it follows any other sentence rather than running at the same time. Probation is not an option. Each identity stolen can become a separate count, and those counts can stack. A defendant charged with using five stolen identities during a wire fraud scheme faces at minimum 10 years of mandatory time on the identity theft counts alone, before any sentence for the underlying fraud.

Terrorism Enhancement

Section 1028A(b) provides a separate, enhanced penalty for aggravated identity theft committed in connection with terrorism offenses. Where the predicate felony is a federal crime of terrorism as defined in 18 U.S.C. § 2332b(g)(5), the mandatory consecutive term rises from 2 years to 5 years. The terrorism enhancement has been charged in a smaller subset of cases but carries severe consequences given its fully mandatory nature and the likelihood that the underlying terrorism-related conviction will itself carry a substantial sentence.

Federal Sentencing Guidelines

USSG §2B1.6 addresses aggravated identity theft cases. The guideline is unusually brief because the statute leaves nothing to the judge's discretion. It directs courts to impose the mandatory consecutive sentence required by law, with no offense level calculation, no enhancements, and no downward adjustments. Application Note 2 to §2B1.6 clarifies that no Chapter Three adjustments apply to a § 1028A count.

Relationship to Underlying Offense

The underlying predicate offense is sentenced under its own guideline first. The aggravated identity theft sentence then attaches consecutively. To illustrate: a defendant convicted of wire fraud with a guideline range of 24 to 30 months who also faces an aggravated identity theft count might receive 27 months for the fraud. The court then adds 24 mandatory consecutive months for the identity theft. Total sentence: 51 months, with no judicial authority to reduce the 24-month add-on.

An important development came from the Supreme Court's 2017 decision in Dean v. United States, 581 U.S. 341 (2017). The Court held that sentencing judges may consider the mandatory consecutive § 1028A term when crafting the sentence for the predicate offense. In practice, this means a judge who believes 51 total months is too harsh can sentence the defendant to, say, 20 months on the wire fraud count rather than 27, knowing that the mandatory 24 months will attach regardless. The predicate sentence itself remains subject to guidelines discretion; only the identity theft add-on is truly fixed.

Multiple Counts

When multiple identity theft counts are charged, courts must decide whether each mandatory 2-year term runs consecutively to the others or whether some run concurrently. Where victims differ or the offenses occurred on different occasions, courts typically impose consecutive terms. Where the same victim appears across closely related conduct on a single occasion, concurrent treatment of the identity theft counts may be appropriate. Judges retain some discretion in structuring how multiple § 1028A counts relate to each other, though each individual term must still be consecutive to the predicate sentence.

Common Scenarios

Financial Fraud

Financial fraud represents the most common context for § 1028A charges. Defendants steal Social Security numbers, names, and birth dates and then use that information to open credit card accounts, apply for loans, file false tax returns claiming refunds, or drain existing bank accounts. Because each use of a distinct identity can be charged as a separate count, defendants in large-scale financial fraud cases often face many identity theft counts stacked on top of their fraud convictions.

Government Benefits Fraud

Stolen identities are frequently used to obtain government benefits. Unemployment compensation, Social Security payments, Medicare and Medicaid funds, and various federal relief programs have all been targeted. During the COVID-19 pandemic, § 1028A became a standard charge in prosecutions involving fraudulent applications for Paycheck Protection Program loans and enhanced unemployment benefits, as defendants routinely submitted applications bearing other people's personal information.

Immigration-Related Identity Theft

Foreign nationals who use another person's documents to work without authorization, obtain state identification, or reenter the country after deportation are frequently charged under § 1028A alongside the relevant immigration offenses. This category forms a substantial portion of overall § 1028A prosecutions, particularly in jurisdictions with high volumes of immigration cases.

Tax Refund Fraud

Tax refund fraud is a straightforward but damaging scheme. Criminals file fraudulent tax returns using stolen Social Security numbers, collecting refunds before the real taxpayer has even filed. Organized rings have filed thousands of false returns in a single season, using information obtained from data breaches, healthcare providers, or employer records. The scheme is especially attractive because the IRS typically issues refunds quickly, making recovery difficult.

Notable Cases and Recent Enforcement

PPP and COVID Relief Fraud

The COVID-19 pandemic created a significant wave of § 1028A prosecutions. Federal prosecutors charged thousands of defendants with using stolen identities on fraudulent Paycheck Protection Program applications, pandemic unemployment claims, and other federal relief programs. The combination of large dollar amounts, easily traceable electronic submissions, and readily available victim identity data made these cases straightforward for investigators. Defendants in multi-count PPP fraud indictments frequently faced 10 or more years of mandatory identity theft time stacked on top of their fraud sentences.

Data Breach Cases

Major data breaches have consistently created downstream § 1028A prosecutions. Defendants who purchase stolen data on dark web markets and then use it to commit fraud qualify for the mandatory enhancement. Hackers who breach corporate systems and monetize the stolen data also face exposure. Federal prosecutors have charged entire networks devoted to converting breach data into fraudulent financial accounts, with each participant potentially facing separate counts for each identity used.

Tax Fraud Rings

Organized tax fraud operations represent some of the largest § 1028A prosecutions by victim count. These groups steal identities from hospitals, employers, and tax preparation firms, then file thousands of fraudulent returns and collect refunds deposited to prepaid debit cards. Ringleaders in such cases have faced mandatory identity theft sentences running into decades when courts imposed consecutive terms across hundreds of counts.

Statistics

The U.S. Sentencing Commission publishes annual data on § 1028A prosecutions. Between roughly 2,000 and 3,000 federal cases annually have involved aggravated identity theft charges in recent years, though the COVID-19 relief fraud wave significantly elevated those numbers through 2021 and 2022. The offense is nearly always charged alongside wire fraud, bank fraud, or access device fraud rather than as a standalone charge. The mandatory consecutive requirement produces a measurable effect on total sentences: defendants convicted of § 1028A receive substantially longer sentences than those convicted of comparable underlying offenses alone. Immigration-related cases involving stolen work authorization documents represent a major category within the overall caseload.

Defenses

No Knowledge of Real Person

Flores-Figueroa created a meaningful defense. The government must prove the defendant knew an actual person owned the identity at issue. A defendant who genuinely believed they were using a fabricated or invented number, and had no reason to think it corresponded to a real person, can contest this element. That said, circumstantial evidence works against defendants in most real-world cases. Purchasing data from an identity theft marketplace, receiving files labeled with victim names and addresses, or participating in a scheme targeting real account holders all support the inference of knowledge.

No "During and In Relation To" Nexus

The identity theft must genuinely occur as part of the predicate crime, not merely alongside it. If the use of a stolen identity was incidental to, or entirely separate from, the enumerated felony, this element may not be satisfied. Courts have examined the nexus requirement carefully, and defendants have successfully argued in some cases that the identity use was not sufficiently tied to the predicate offense to trigger the statute.

No Predicate Felony

Without a conviction for an enumerated offense, § 1028A does not apply. Acquittal on the underlying predicate charge, or a charging decision that omits any enumerated felony, leaves the identity theft count without a legal foundation. This dynamic makes the choice of predicate charges at indictment a significant strategic decision for prosecutors and defense counsel alike.

Lawful Authority

A defendant may argue they possessed lawful authority to use the identification in question. This defense typically arises in professional or employment contexts where the defendant claims permission from the owner or authorization from an employer. It is a fact question for the jury and succeeds in narrow circumstances.

Impact on Plea Negotiations

The mandatory 2-year add-on reshapes plea negotiations substantially. Prosecutors use the threat of multiple stacked identity theft counts to encourage cooperation and guilty pleas to reduced charge packages. Dismissal of identity theft counts in exchange for a guilty plea to the predicate offense represents one of the most common forms of negotiated resolution in these cases. A defendant facing five identity theft counts faces 10 mandatory years on those counts alone before any sentence for the underlying fraud. That certainty shifts the calculus. Many defendants accept deals that carry longer predicate sentences in exchange for elimination of the guaranteed stacking.

Civil and Administrative Consequences

Beyond the criminal sentence, a § 1028A conviction carries significant collateral consequences. Non-citizen defendants face mandatory deportation under 8 U.S.C. § 1227 following conviction for aggravated felonies, and aggravated identity theft qualifies. Professional licenses in law, medicine, finance, and other regulated fields are typically revoked or suspended following federal felony convictions. Restitution obligations under 18 U.S.C. § 3663A are mandatory in cases involving identifiable victims, requiring defendants to compensate victims for financial losses flowing from the offense. The FTC, listed among the agencies with enforcement interest in identity theft cases, operates primarily on the civil side through consumer protection proceedings, data broker regulation, and the Consumer Sentinel Network, which aggregates identity theft complaints and shares data with law enforcement partners.<ref