Two statutes, not one
People use the phrase identity theft for many things. Federal law splits it into two related but different crimes, and knowing which one you face changes everything about exposure and defense. Section 1028 punishes fraud and related activity connected with identification documents, authentication features, and information. It is the base charge. Section 1028A punishes aggravated identity theft, which is an extra charge stacked on top of certain other felonies. An indictment often contains both a section 1028 count and a section 1028A count, plus a predicate felony such as wire fraud or a computer charge. Each count has its own elements, and the government must prove each one.
For the broader context of deception and document cases, start with the Federal White Collar Criminal Defense hub.
The eight paragraphs of § 1028(a)
Section 1028(a) lists eight kinds of conduct. Prosecutors charge the paragraph or paragraphs that fit what they say happened. Paragraph (a)(1) covers anyone who "knowingly and without lawful authority produces an identification document, authentication feature, or a false identification document." Paragraph (a)(2) covers knowingly transferring such a document or feature while knowing it "was stolen or produced without lawful authority." Paragraph (a)(3) covers anyone who "knowingly possesses with intent to use unlawfully or transfer unlawfully five or more identification documents (other than those issued lawfully for the use of the possessor), authentication features, or false identification documents." Notice the number built into the law. Simple possession needs five or more documents, and the documents the person lawfully holds for their own use do not count.
Paragraph (a)(4) covers knowingly possessing such a document or feature "with the intent such document or feature be used to defraud the United States." Paragraph (a)(5) reaches the supply chain. It covers producing, transferring, or possessing a document-making implement "with the intent such document-making implement or authentication feature will be used in the production of a false identification document or another document-making implement or authentication feature which will be so used." Paragraph (a)(6) covers possessing a United States identification document or authentication feature that was stolen or produced without lawful authority, while knowing that history. Paragraph (a)(8) covers "knowingly traffics in false or actual authentication features for use in false identification documents, document-making implements, or means of identification."
Paragraph (a)(7) is the one charged most often in cases built on personal information rather than physical cards. It covers anyone who "knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, or in connection with, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law." Three pieces matter here. The identification must belong to another person. The conduct must be without lawful authority. And it must connect to a crime, either a federal violation or a state or local felony. A paragraph (a)(7) case therefore always has a second crime in the picture, which is why these counts so often appear beside fraud charges.
What counts as a means of identification
The statute defines this term broadly. It means "any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual." The definition then lists examples: names, Social Security numbers, dates of birth, driver's license and passport numbers, alien registration numbers, employer and taxpayer identification numbers, biometric data such as fingerprints, electronic identification numbers and routing codes, and telecommunications identifying information and access devices. A single name plus a date of birth can qualify. So can a lone Social Security number.
Two related definitions drive document cases. An identification document is a document made or issued under government or certain organizational authority that, when completed with a particular person's information, is of a type commonly accepted to identify individuals. A false identification document is such a document that was not issued under government authority, or was issued but "was subsequently altered for purposes of deceit," and that appears to be government issued. A real driver's license with a swapped photograph is the classic example. A document-making implement is "any implement, impression, template, computer file, computer disc, electronic device, or computer hardware or software, that is specifically configured or primarily used for making an identification document, a false identification document, or another document-making implement." Ordinary tools and general purpose computers are not implements under this definition unless the government proves that design or primary use. Trafficking has its own definition too: "to transport, transfer, or otherwise dispose of, to another, as consideration for anything of value," or obtaining control with that intent. And so that counting disputes do not multiply charges, the law provides that "a single identification document or false identification document that contains 1 or more means of identification shall be construed to be 1 means of identification."
When federal law applies at all
Every paragraph of section 1028(a) opens with the same gate. The conduct must occur "in a circumstance described in subsection (c)." That circumstance is satisfied where the document is or appears to be United States issued, where the charge is the defraud-the-United-States variant, or where "the production, transfer, possession, or use prohibited by this section is in or affects interstate or foreign commerce, including the transfer of a document by electronic means." Mailing the document in the course of the offense also satisfies it. Online conduct that crosses state lines by design usually meets this test, but it remains something the government must establish, not assume.
Penalties under § 1028: four tiers plus forfeiture
Section 1028 sets ceilings, not floors. No paragraph carries a mandatory minimum prison term. The tiers work as follows. The serious variants carry "a fine under this title or imprisonment for not more than 15 years, or both." Those variants include producing or transferring a document that is or appears to be "an identification document or authentication feature issued by or under the authority of the United States," producing or transferring "a birth certificate, or a driver's license or personal identification card," "the production or transfer of more than five identification documents, authentication features, or false identification documents," document-making implement offenses, and paragraph (a)(7) conduct where the offender "obtains anything of value aggregating $1,000 or more during any 1-year period." Note that dollar line. A paragraph (a)(7) case below $1,000 in a year falls into the lower tier.
Ordinary production, transfer, or use counts, and offenses under paragraph (a)(3) or (a)(7), carry "a fine under this title or imprisonment for not more than 5 years, or both." The ceiling rises to "a fine under this title or imprisonment for not more than 20 years, or both," where the offense is committed "to facilitate a drug trafficking crime," "in connection with a crime of violence," or "after a prior conviction under this section becomes final." It rises again to "a fine under this title or imprisonment for not more than 30 years, or both," where the offense is committed "to facilitate an act of domestic terrorism" or an act of international terrorism. Every offense also carries "forfeiture to the United States of any personal property used or intended to be used to commit the offense," which can include computers, printers, phones, and storage media, and courts must order the destruction or other disposition of the illicit documents and implements on conviction. Attempts and conspiracies face the same penalties as the completed offense. The law states that "Any person who attempts or conspires to commit any offense under this section shall be subject to the same penalties as those prescribed for the offense, the commission of which was the object of the attempt or conspiracy."
The phrase "a fine under this title" points to the general fine statute. Under that provision, an individual convicted of a felony faces "for a felony, not more than $250,000," and an organization faces "for a felony, not more than $500,000." Where the offense produced gain or caused loss, the fine can instead be set at "not more than the greater of twice the gross gain or twice the gross loss," unless figuring that amount would unduly complicate or prolong sentencing. These are statutory maximums, not predictions. The sentence in any real case comes from the guideline calculation, the judge's judgment, and the facts, and the facts of a case change everything.
Aggravated identity theft under § 1028A: the consecutive 2-year term
Section 1028A is short and severe. It punishes anyone who, "during and in relation to any felony violation enumerated in subsection (c), knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person." The punishment is that the person "shall, in addition to the punishment provided for such felony, be sentenced to a term of imprisonment of 2 years." For terrorism predicates the term is 5 years. Three features make this charge unusually harsh. First, "a court shall not place on probation any person convicted of a violation of this section." Second, "no term of imprisonment imposed on a person under this section shall run concurrently with any other term of imprisonment imposed on the person under any other provision of law, including any term of imprisonment imposed for the felony during which the means of identification was transferred, possessed, or used." In plain words, the 2 years stack on top of everything else. The one exception is that multiple section 1028A counts sentenced at the same time "may, in the discretion of the court, run concurrently, in whole or in part," with each other. Third, when the judge sentences the underlying felony, "a court shall not in any way reduce the term to be imposed for such crime" to compensate for the consecutive term. The 2 years cannot be quietly absorbed.
The enumerated predicates are a closed list. It includes theft of public money, false personation of citizenship, false statements tied to firearm acquisition, and then broad categories: provisions of the fraud chapter other than section 1028(a)(7), provisions of the mail, bank, and wire fraud chapter, nationality and citizenship offenses, passport and visa offenses, immigration offenses, and several Social Security Act false-statement offenses. Because the mail and wire fraud chapter is on the list, a fraud indictment built on false billings or online transfers can become the predicate that triggers the extra 2 years. Whether it should is exactly what the Supreme Court addressed in Dubin, discussed below.
How the sentence is calculated: guideline sections 2B1.1 and 2B1.6
The Statutory Index in the Guidelines Manual refers section 1028 offenses mainly to guideline section 2B1.1, the guideline for theft, fraud, and deceit. Counts involving naturalization, citizenship, or passport documents can instead map to sections 2L2.1 or 2L2.2 under the same index entry, so counsel should confirm which guideline the count of conviction actually calls for. For the ordinary fraud rooted identity case, section 2B1.1 controls. Its base offense level is "7, if (A) the defendant was convicted of an offense referenced to this guideline; and (B) that offense of conviction has a statutory maximum term of imprisonment of 20 years or more," and "6, otherwise." In practice that means a routine section 1028 case starts at level 6, while a case charged under one of the 20-year or 30-year variants starts at level 7. From there, the specific offense characteristics add levels.
Loss is the engine of the guideline. The rule is short: "Loss is the greater of actual loss or intended loss." The loss table then adds levels as loss grows, from no increase at $6,500 or less up to 30 added levels above $550,000,000. Those are the current Manual's figures. For sentencings on or after November 1, 2026, Amendment 2 of the Sentencing Commission's 2026 amendments raises them to $9,000 and $750,000,000, unless Congress acts. Where access devices are part of the conduct, a special floor applies: loss "shall be not less than $500 per access device," and where an unused telecommunications means was only possessed, "loss shall be not less than $100 per unused means." Victim counts move the range too. The guideline adds levels where the offense "involved 10 or more victims" or "resulted in substantial financial hardship to one or more victims," and in a case involving means of identification the word victim also covers "any individual whose means of identification was used unlawfully or without authority." That means every person whose information was misused can count even if that person lost no money.
The enhancement written specifically for this crime is subsection (b)(11)(C). It adds 2 levels, with a floor of level 12, for "the unauthorized transfer or use of any means of identification unlawfully to produce or obtain any other means of identification," or possession of 5 or more such produced or obtained means. The Manual's background explains that this targets an aggravated form known as breeding, in which a defendant uses one person's name or Social Security number to "produce or obtain) new or additional forms of identification," such as a driver's license, a credit card, or a bank loan. The floor exists in part because the bred documents sit in the defendant's control while the victim stays unaware, often until a damaged credit rating or a denied loan reveals the theft. Related enhancements land where their facts fit: device-making equipment and authentication features, production or trafficking of counterfeit or unauthorized devices, schemes that relocated to evade law enforcement or ran from abroad, sophisticated means the defendant intentionally engaged in, over $1,000,000 in gross receipts from financial institutions, and computer offenses involving an intent to obtain personal information. To see how ranges work in general, read Federal Sentencing and try the inputs on the Federal Sentencing Guidelines Calculator.
Section 1028A cases use a different and much simpler guideline. Section 2B1.6 provides that "the guideline sentence is the term of imprisonment required by statute," meaning 2 years, or 5 for terrorism predicates. Chapters Three and Four "shall not apply to that count of conviction," so adjustments and criminal history do not move that count. And to prevent double counting, where the 1028A sentence sits beside the underlying felony sentence, the judge must "not apply any specific offense characteristic for the transfer, possession, or use of a means of identification when determining the sentence for the underlying offense." The means-of-identification factor is accounted for once, in the consecutive term, not twice.
The closest neighbours: section 1028A, access device fraud, and wire fraud
Identity cases often arrive with companion charges, and three neighbours cause the most confusion. The first is the relationship between section 1028 and section 1028A itself. Section 1028 is the underlying document or information charge. Section 1028A is the add-on that runs after it. Section 1028A needs a listed predicate felony, while section 1028 needs only its own paragraph plus the jurisdictional circumstance. Conduct charged only under section 1028 is sentenced through the loss-driven guideline. Conduct that also draws section 1028A gets the flat consecutive term on top. Defending the predicate felony can therefore matter as much as defending the identity count, because without the predicate the add-on has nothing to attach to.
The second neighbour is access device fraud under section 1029. That law targets cards, codes, and account numbers as devices: producing or using counterfeit devices, trafficking in or using unauthorized devices to obtain $1,000 or more in a year, possessing fifteen or more counterfeit or unauthorized devices, and making or holding device-making equipment. Its definitions draw the lines. A counterfeit device is one that is "counterfeit, fictitious, altered, or forged," while an unauthorized device is one that is "lost, stolen, expired, revoked, canceled, or obtained with intent to defraud." The difference is structural. Section 1029 needs the device conduct described in one of its paragraphs plus a commerce effect. Section 1028 needs the document or information conduct described in one of its paragraphs plus its own jurisdictional circumstance. Using a stolen card number online can violate both at once, which is why indictments sometimes charge both, but each statute demands proof of its own elements. Device-heavy cases are covered on the Access Device Fraud page.
The third neighbour is wire fraud. Section 1343 punishes anyone who, "having devised or intending to devise any scheme or artifice to defraud, or for obtaining money or property by means of false or fraudulent pretenses, representations, or promises," then "transmits or causes to be transmitted by means of wire, radio, or television communication in interstate or foreign commerce" writings, signals, or sounds to carry it out, with a maximum of "imprisoned not more than 20 years" per count. Wire fraud needs a scheme plus a wire sent to execute it. Identity theft needs the document or information conduct plus its circumstance. A single course of conduct, such as opening accounts with stolen Social Security numbers and moving the proceeds online, can support both, and prosecutors often charge the scheme as wire fraud or bank fraud with the identity counts beside it. Related scheme cases are addressed on the Wire Fraud and Bank Fraud pages, and conduct involving unauthorized computer access is covered on the Computer Fraud and the CFAA page.
Defenses that actually arise under these statutes
Defenses here are specific to the paragraph charged, and they start with lawful authority. Many cases turn on who authorized what. Shared family information, employer data with fuzzy permission, and merchants or preparers told to use a number one more time all raise the same question from different sides. The government must prove the conduct was without lawful authority, and where it cannot, the count fails.
Knowledge is the next battleground. Section 1028 demands knowledge throughout, and for aggravated identity theft the Supreme Court requires proof that the defendant knew the identification belonged to another real person. As the Court later restated the rule, a defendant must know "that the 'means of identification' he or she unlawfully transferred, possessed, or used, in fact, belonged to 'another person.'" Made-up numbers that happen to match no one, and genuine confusion about whose information was used, go to this element. The government's favorite proof is usually the defendant's own words, which is why early interviews with agents decide more of these cases than anything that happens in court.
The Dubin limit is the most important recent defense to the aggravated charge. The government once argued that section 1028A applies automatically whenever a name or number "happens to be part of the payment or billing method" of a predicate offense, on the theory that any such employment facilitates or furthers the crime "in some way." The Supreme Court rejected that automatic reading. It held that a defendant uses another person's means of identification in relation to a predicate offense "when the use is at the crux of what makes the conduct criminal." In Dubin itself, the trial court viewed "the crux of the case was fraudulent billing, not identity theft," yet let the aggravated count stand under then-binding circuit precedent. After Dubin, overbilled claims that merely contain a patient's information are far harder to package as identity theft. Counsel should test every section 1028A count against that line: was the misuse of the other person's identity the heart of the crime, or just part of the paperwork around a different fraud?
Threshold and counting defenses test the numbers. Fewer than five documents defeats simple possession under paragraph (a)(3). Under $1,000 in a year moves a paragraph (a)(7) case from the 15-year tier to the 5-year tier. More than five documents moves production or transfer into the higher tier, so miscounted or double-counted documents are worth challenging. Equipment cases raise a scope defense built into the definition, since only equipment "specifically configured or primarily used" for making documents qualifies. The commerce circumstance can also be tested where every act happened inside one state and the government leans entirely on how networks route data.
Two statutory exceptions deserve mention. Law enforcement activity is expressly preserved: "This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity." And paragraph (a)(7) itself demands the crime connection, so conduct tied to no federal violation and no state or local felony falls outside it. Anyone raising these points needs counsel to build the record early.
If you are under investigation
Identity investigations often start quietly, with subpoenas to banks, phone carriers, or agencies that issued the documents, before any agent makes contact. By the time agents appear, they may already hold transaction records, surveillance images, and forensic reports on devices. Do not try to talk your way out of it. Do not hand over your phone or passwords without legal advice. Preserve everything, including messages, receipts, and packaging, and do not destroy or wipe anything, because that creates new exposure. If charges follow, money laundering counts sometimes follow the money trail; those are addressed on the Money Laundering page. Get a lawyer involved before the first interview, not after.