What counts as an access device
The name of the charge misleads people. An access device is not only a credit card. The statute defines it to cover "any card, plate, code, account number," plus electronic serial numbers, personal identification numbers, telecommunications identifiers, and any "other means of account access" that can be used to get value or move funds. What ties them together is function: the thing can be used "to obtain money, goods, services, or any other thing of value" or "to initiate a transfer of funds." A debit card, a stolen credit card number typed into a website, a gift card code, a bank login, or a cloned phone identifier can each qualify. The one carveout in the definition matters for paper checks: it excludes "a transfer originated solely by paper instrument."
For the broader context of federal fraud and deception cases, start with the Federal White Collar Criminal Defense hub.
The ten paragraphs of § 1029(a)
Section 1029(a) lists ten kinds of conduct, numbered (1) through (10). Prosecutors charge the paragraph or paragraphs that fit what they say happened. The common ones in card cases are (a)(1), (a)(2), and (a)(3). Paragraph (a)(1) punishes anyone who "knowingly and with intent to defraud produces, uses, or traffics in one or more counterfeit access devices." Paragraph (a)(2) punishes trafficking in or using unauthorized devices over a one-year period where the conduct "obtains anything of value aggregating $1,000 or more during that period." Paragraph (a)(3) punishes anyone who "knowingly and with intent to defraud possesses fifteen or more devices which are counterfeit or unauthorized access devices." Notice the numbers built into the law: unauthorized use needs $1,000 in a year, and simple possession needs fifteen or more devices. Counts below those lines must be charged under a different paragraph or a different statute.
Two paragraphs reach the supply chain rather than the user. Paragraph (a)(4) punishes producing, trafficking in, controlling, or possessing device-making equipment, which the statute defines as "any equipment, mechanism, or impression designed or primarily used for making an access device or a counterfeit access device." Skimmers, embossers, blank-card stock with magnetic stripes, and encoding software fall under this language when they meet that definition. Paragraph (a)(6) punishes soliciting people to offer access devices or sell device information without the issuer's authorization. Paragraph (a)(5) reaches the merchant side: effecting transactions with devices issued to someone else to receive payment or value of $1,000 or more in a year. Paragraph (a)(10) punishes causing someone else to present transaction records to a credit card system member for payment "without the authorization of the credit card system member or its agent." The remaining paragraphs, (a)(7) through (a)(9), cover modified telecommunications instruments, scanning receivers, and hardware or software configured to insert or alter telecommunications identifying information.
The words counterfeit and unauthorized are legal terms here, not casual descriptions. A counterfeit access device is one that is "counterfeit, fictitious, altered, or forged," and the definition also sweeps in an identifiable component of such a device. An unauthorized access device is one that is "lost, stolen, expired, revoked, canceled, or obtained with intent to defraud." That distinction drives real cases: a real card used without permission is unauthorized, while a cloned or re-encoded card is counterfeit, and the evidence needed to prove each is different. Trafficking has its own definition too: "transfer, or otherwise dispose of, to another, or obtain control of with intent to transfer or dispose of." Simply handing a cloned card to someone, or picking one up in order to pass it along, can satisfy that definition.
Every paragraph closes with the same jurisdictional sentence: the conduct is punishable "if the offense affects interstate or foreign commerce." Card networks cross state lines by design, so this element is usually proven through the payment system itself, but it remains something the government must establish, not assume.
What the government must prove
Three threads run through nearly every paragraph. First, knowledge: the person knew what they were doing with the device. Second, intent: the person acted "with intent to defraud." That phrase appears in almost every paragraph, which makes the defendant's state of mind the center of most trials. Third, the commerce connection described above, plus any number the paragraph requires, such as the $1,000 aggregate or the fifteen-device minimum.
The Ninth Circuit's model jury instructions show how these elements are read to a jury in that circuit, and they should not be treated as a nationwide rule. For the paragraph (a)(10) charge of causing transaction records to be presented for payment, the Ninth Circuit's instruction lists four things the government must prove beyond a reasonable doubt: that the defendant knowingly caused or arranged the presentation of transaction records to a credit card system member or agent, that the defendant lacked authorization from that member or agent, that the defendant "acted with the intent to defraud," and that the conduct in some way affected commerce between states or between the United States and a foreign country. The instruction adds that a credit card system member means "a financial institution or other entity that is a member of a credit card system." Other circuits phrase their instructions differently, so the exact wording a jury hears depends on where the case is charged.
Attempts and conspiracies are punished alongside completed offenses, with a difference worth knowing. A person who attempts a section 1029 offense "shall be subject to the same penalties as those prescribed for the offense attempted." A person who conspires with one or more others faces a fine up to the maximum for the underlying offense but prison of "not longer than one-half the period provided as the maximum imprisonment for such offense," so long as someone took some step in furtherance of the plan.
Penalties for a § 1029 charge: prison maximums, fines, and forfeiture
Section 1029 sets ceilings, not floors. No paragraph carries a mandatory minimum prison term. On a first conviction, an offense under paragraph (1), (2), (3), (6), (7), or (10) is punishable by "a fine under this title or imprisonment for not more than 10 years, or both." An offense under paragraph (4), (5), (8), or (9), which includes device-making equipment, merchant-side transactions, scanning receivers, and configured hardware or software, is punishable by "a fine under this title or imprisonment for not more than 15 years, or both." An offense committed after a conviction for another section 1029 offense is punishable by "a fine under this title or imprisonment for not more than 20 years, or both." Every conviction also carries "forfeiture to the United States of any personal property used or intended to be used to commit the offense," which can include computers, phones, skimmers, and storage media.
The phrase "a fine under this title" points to the general fine statute. Under that provision, an individual convicted of a felony faces a fine of "not more than $250,000" where no higher amount is specified, and an organization faces "not more than $500,000." Where the offense produced gain or caused loss, the fine can instead be set at "not more than the greater of twice the gross gain or twice the gross loss," unless figuring that amount would unduly complicate or prolong sentencing. These are statutory maximums, not predictions. The sentence in any real case comes from the guideline calculation, the judge's judgment, and the facts, and the facts of a case change everything.
How the sentence is calculated under guideline section 2B1.1
The Statutory Index in the Guidelines Manual refers section 1029 offenses to guideline section 2B1.1, the guideline for theft, fraud, and deceit. That reference decides the starting framework for almost every access device case. The base offense level is 7 only where the offense of conviction is referenced to the guideline and carries a statutory maximum of 20 years or more; all other cases start at "6, otherwise." In practice that means a first-time section 1029 case starts at level 6, while a repeat-offender case with a 20-year maximum starts at level 7. From there, the specific offense characteristics add levels.
Loss is the engine of the guideline. The rule is short: "Loss is the greater of actual loss or intended loss." The loss table then adds levels as loss grows, from no increase at $6,500 or less up to 30 added levels above $550,000,000. Those are the current Manual's figures. For sentencings on or after November 1, 2026, Amendment 2 of the Sentencing Commission's 2026 amendments raises them to $9,000 and $750,000,000, unless Congress acts. For access device cases there is a special floor: where counterfeit or unauthorized devices are involved, loss includes the unauthorized charges and "shall be not less than $500 per access device." One hundred cloned cards therefore produce at least $50,000 of loss for guideline purposes even if most were never used. Where the device is only a telecommunications means that identifies a phone or account, and it was possessed but never used, the floor is instead $100 per unused means.
Two enhancements land on access device cases more than anywhere else. Subsection (b)(11) adds 2 levels, with a floor of level 12, where the offense involved possessing or using device-making equipment, or "the production or trafficking of any (i) unauthorized access device or counterfeit access device." The commentary ties each of those terms back to section 1029's own definitions. Subsection (b)(10) adds 2 levels with the same floor where the scheme was relocated to evade law enforcement, was run substantially from outside the United States, or involved sophisticated means the defendant intentionally engaged in or caused. Skimming rings that manufacture cards in one state and cash out in another, or operations run from abroad, are the cases where these levels stack.
Other enhancements apply when their facts are present. Ten or more victims, mass marketing, or substantial hardship to even one victim adds levels under subsection (b)(2), which quotes the trigger as conduct that "involved 10 or more victims." Where the defendant derived over $1,000,000 in gross receipts from financial institutions, the guideline adds 2 levels, using the test whether "the defendant derived more than $1,000,000 in gross receipts from one or more financial institutions as a result of the offense." Nobody's guideline range can be read off this page. Criminal history, role, acceptance of responsibility, and grouping with other counts all move the final number, and the judge must still weigh the statutory purposes of sentencing. To see how ranges work in general, read Federal Sentencing and try the inputs on the Federal Sentencing Guidelines Calculator.
The closest neighbours: wire fraud (18 U.S.C. § 1343) and aggravated identity theft
Access device cases often arrive alongside other charges, and two neighbours cause the most confusion. The first is wire fraud. Section 1343 punishes anyone who devises a scheme to defraud and, to carry it out, "transmits or causes to be transmitted by means of wire, radio, or television communication in interstate or foreign commerce" writings, signals, or sounds, with a maximum of "imprisoned not more than 20 years" per count. The difference is structural. Wire fraud needs a scheme plus a wire sent to execute it. Access device fraud needs the device conduct described in one of the ten paragraphs plus a commerce effect. Using a stolen card number online can violate both at once, which is why indictments sometimes charge both, but each statute demands proof of its own elements. Related card-skimming conduct charged as a scheme is covered on the Wire Fraud page.
The second neighbour is aggravated identity theft under section 1028A, and it is the more dangerous companion. That law punishes anyone who, "during and in relation to" certain listed felonies, knowingly uses another person's means of identification without lawful authority. The punishment is a flat two-year prison term "in addition to the punishment provided for such felony," and the law provides that "no term of imprisonment imposed on a person under this section shall run concurrently with any other term of imprisonment." In plain words, it stacks. Because the enumerated felonies include fraud provisions, an access device prosecution can become the predicate that triggers the extra two years. Section 1029 is the underlying device charge; section 1028A is the add-on that runs after it. How the two interact in a single indictment is explained further on the Federal Identity Theft page, and conduct involving unauthorized computer access is addressed on the Computer Fraud and the CFAA page.
Defenses that actually arise under this statute
Defenses in these cases are specific to the paragraph charged, and they start with authorization. Many cases turn on whether the cardholder, the issuer, or the credit card system member authorized the conduct. Shared family cards, employer cards with fuzzy spending permission, and merchants told to run a card one more time all raise the same question from different sides: who authorized what. Where the government cannot prove lack of authorization, the paragraph fails.
Knowledge and intent are the next battleground, because the statute demands both. Devices pass through many hands. A card found in a borrowed car, a package ordered on someone else's account, or a phone with other people's account numbers in it raises the question of what this person actually knew and intended. The government's favorite proof is usually the defendant's own words, which is why early interviews with agents decide more of these cases than anything that happens in court.
Characterization defenses attack the device labels. The government must prove the item was counterfeit or unauthorized as the statute defines those words, and the proof differs. A genuine card used without permission must be shown to be lost, stolen, expired, revoked, canceled, or obtained with intent to defraud. A re-encoded card must be shown to be counterfeit, fictitious, altered, or forged. An item that is neither, or that the government cannot place in either box, does not support the charge. Related threshold defenses test the numbers: fewer than fifteen devices defeats simple possession under paragraph (a)(3), and under $1,000 in a year defeats unauthorized use under paragraph (a)(2). Miscounted devices, double-counted cards, and inflated valuations are worth challenging.
Equipment cases raise a scope defense built into the definition. Device-making equipment means equipment "designed or primarily used for making an access device or a counterfeit access device." Ordinary tools, general-purpose computers, and phones are not device-making equipment unless the government proves that design or primary use. The commerce element can also be tested, particularly where every act happened inside one state and the government leans entirely on how card networks route payments.
Two statutory exceptions deserve mention. Law enforcement activity is expressly preserved: the section states that it does not prohibit lawfully authorized investigative, protective, or intelligence activity. And for the paragraph (a)(9) charge involving configured hardware or software, the statute provides an affirmative defense, which the defendant must prove by a preponderance of the evidence, where the conduct "was engaged in for research or development in connection with a lawful purpose." Security researchers and carrier employees fall into the neighboring provisions written for them, but anyone raising these exceptions needs counsel to build the record early.
If you are under investigation
Section 1029 gives the Secret Service investigative authority over these offenses in addition to any other agency with authority, so agents at the door may carry those credentials. They often arrive with transaction records, surveillance images, and device forensic reports already in hand. Do not try to talk your way out of it. Do not hand over your phone or passwords without legal advice. Preserve everything, including messages, receipts, and packaging, and do not destroy or wipe anything, because that creates new exposure. If charges follow, bank-fraud or money-laundering counts sometimes follow the money trail; those are addressed on the Bank Fraud and Money Laundering pages. Get a lawyer involved before the first interview, not after.