7 Types of Identity Theft and Their Penalties: What the Law Actually Says
[UPDATED September 19, 2026 — This article previously organized its 7 sections around penalty categories instead of the 7 recognized types of identity theft. It’s been rebuilt around the actual types: financial, medical, tax, employment, child, criminal, and synthetic. Unverifiable case citations and quotes from the prior version have been removed and replaced with sourced examples.]
There isn’t one identity theft law. There are seven different kinds of identity theft, and each one gets prosecuted under a different statute — with wildly different penalties attached. Someone who files a fake tax return faces different exposure than someone who uses a stolen Social Security number to get a job, which is different again from someone who fabricates a person out of thin air.
Here’s how each type actually gets charged, and what the law says about punishment for each one.
Identity Theft Penalties — Quick Facts
| Type | Primary Statute | Maximum Penalty |
| Financial | 18 U.S.C. § 1028 | Up to 15 years |
| Medical | 42 U.S.C. § 1320d-6 (HIPAA) | Up to 10 years |
| Tax | 26 U.S.C. §§ 7201, 7206 | Up to 5 years |
| Employment | 42 U.S.C. § 408 | Up to 5 years (10 if position of trust) |
| Child | 18 U.S.C. § 1028 + state enhancements | Varies by state |
| Criminal | State false personation laws | Misdemeanor to felony |
| Synthetic | 18 U.S.C. § 1344 (bank fraud) | Up to 30 years |
| Aggravated (any type) | 18 U.S.C. § 1028A | +2 years, mandatory, consecutive |
| Last Updated | September 19, 2026 |
1. Financial Identity Theft
This is the one most people picture: someone opens a credit card, drains a bank account, or takes out a loan using your information. It’s the most common type, and it’s the one the base federal statute was written for.
Federal identity theft charges under 18 U.S.C. § 1028 carry penalties of up to fifteen years in prison for a first conviction. There’s no mandatory minimum for the base charge — a first-time offender with a small loss can get probation. But if the fraud rises to wire fraud or bank fraud, prosecutors can stack an aggravated identity theft charge under 18 U.S.C. § 1028A on top, adding a mandatory 2 years that runs consecutively, not concurrently.
Curious how “identity theft” and “mistaken identity” differ legally? Our breakdown of the distinction covers where the line sits.
2. Medical Identity Theft
This happens when someone uses your information to get medical treatment, prescriptions, or insurance reimbursement in your name. Because medical records fall under HIPAA, the penalty structure looks nothing like a stolen credit card case.
Criminal penalties for violating HIPAA apply when someone knowingly obtains or discloses protected health information unlawfully, and they escalate in tiers:
- Knowing violation: up to $50,000 and 1 year in prison
- Obtained under false pretenses: up to $100,000 and 5 years
- Intent to sell, transfer, or use the information for personal gain: up to $250,000 and 10 years
Medical identity theft is uniquely dangerous because the damage doesn’t show up on a credit report. It shows up as a wrong diagnosis in your chart or a bill for a procedure you never had — and medical records are far harder to correct than a disputed credit line.
3. Tax Identity Theft
Someone files a fraudulent return using your Social Security number before you file yours, and collects your refund. These penalties run through the tax code, not the general identity theft statute.
Filing a false return falls under 26 U.S.C. § 7206, carrying up to 3 years in prison and a $100,000 fine. If the conduct rises to willful tax evasion, 26 U.S.C. § 7201 pushes that to 5 years and up to $100,000 in fines ($500,000 for a corporation). And because using someone else’s SSN to file is itself identity theft, prosecutors can add the 2-year aggravated identity theft enhancement on top of whichever tax charge applies. Real cases show how this stacks — one Virginia man who filed fraudulent returns using stolen identities was sentenced to 54 months for combined wire fraud and aggravated identity theft charges.
4. Employment Identity Theft
Someone uses your Social Security number to get a job — often to work around immigration status, a bad credit history, or a criminal record. It sounds like the least harmful type, but it can leave you owing taxes on income you never earned.
Using a false or stolen Social Security number with intent to deceive is a felony under 42 U.S.C. § 408, carrying up to 5 years in prison. That maximum doubles to 10 years if the person committing the fraud holds a position of trust — an SSA employee, a claims representative, or a healthcare provider submitting false information in a benefits determination.
5. Child Identity Theft
A child’s Social Security number gets used to open credit, rent an apartment, or apply for utilities — usually going undetected for years, since kids don’t check their credit reports. There’s no separate federal statute specifically for child identity theft; it’s prosecuted under the same 18 U.S.C. § 1028 framework as adult cases. Where it differs is at the state level, where many states classify identity theft involving a minor victim as an aggravating factor that pushes the charge into a higher felony tier and adds restitution obligations covering years of undetected damage.
If your child’s SSN has been compromised, our guide to checking every account tied to an SSN walks through where to look first.
6. Criminal Identity Theft
This is when someone gives your name to police during a stop or an arrest, meaning a criminal record — or even a bench warrant — ends up attached to your name instead of theirs. This category is prosecuted almost entirely at the state level, under false personation statutes rather than a federal identity theft charge, and the penalty range is wide.
Under statutes like California’s false personation law, the charge is a “wobbler” — prosecutors can file it as a misdemeanor or a felony depending on what happened next. Giving a false name during a traffic stop with no further consequence is typically a low-level misdemeanor. But if a warrant gets issued in the victim’s name, or the victim suffers an economic loss because of it, several states escalate the charge to a felony carrying several years in prison.
7. Synthetic Identity Theft
This is the newest and hardest-to-prosecute category. Instead of stealing one person’s full identity, the thief combines a real Social Security number — often a child’s or a deceased person’s — with a fabricated name and birthdate to build an identity that doesn’t fully belong to anyone. A financial services industry survey found that 72% of firms consider synthetic identities harder to detect and address than ordinary identity theft, largely because there’s no single real victim watching their credit report for warning signs.
Because these schemes typically defraud banks and lenders rather than one specific person, they’re often charged as bank fraud (18 U.S.C. § 1344, up to 30 years) rather than as identity theft directly. In one nationwide synthetic identity fraud case, a defendant who stole more than $1 million from financial institutions was sentenced to 4 to 12 years in prison.
Whether the 2-year aggravated identity theft add-on even applies to these cases has actually been narrowed by the Supreme Court. In Dubin v. United States (2023), the Court held that § 1028A only applies when misusing someone’s identity is “at the crux” of what makes the underlying crime illegal — not just an incidental detail in the paperwork. That case involved medical billing fraud, not synthetic identities, but the same logic has made the aggravated identity theft charge harder for prosecutors to sustain in fabricated-identity cases where no single real victim’s identity was truly central to the fraud.
Frequently Asked Questions
Which type of identity theft carries the harshest penalty?
Synthetic identity theft, when charged as bank fraud, carries the highest statutory maximum at 30 years. But actual sentences depend far more on dollar loss and number of victims than on which category the fraud falls into.
Can someone be charged with more than one type at once?
Yes. A single scheme often touches multiple categories — someone might commit tax identity theft and employment identity theft using the same stolen SSN, and each can be charged separately.
Does the aggravated identity theft 2-year add-on apply to every type?
No. It only applies when the underlying crime is one of the roughly 60 federal predicate felonies listed in the statute, and after Dubin v. United States, only when the identity misuse is central to that crime, not incidental to it.
Is child identity theft treated more harshly than adult identity theft?
There’s no separate federal statute, but many states apply sentencing enhancements when the victim is a minor, since the fraud typically goes undetected for years and causes compounding damage.
Can criminal identity theft result in an actual criminal record for the victim?
The record attaches to whoever’s name was given to police, which is the identity thief, not automatically the victim — but the victim has to actively get the record corrected, and until that happens it can surface in background checks tied to their name.
Is synthetic identity theft actually illegal if the identity isn’t a real person?
Yes. Even though the identity is partly fabricated, it typically incorporates a real, valid Social Security number belonging to someone else, which is what makes it prosecutable as fraud and often as identity theft.
Sources Used in This Article
- 18 U.S.C. § 1028 — Identity Theft: https://www.law.cornell.edu/uscode/text/18/1028
- 18 U.S.C. § 1028A — Aggravated Identity Theft: https://www.law.cornell.edu/uscode/text/18/1028A
- HIPAA Journal — Criminal Penalties for HIPAA Violations: https://www.hipaajournal.com/what-are-the-penalties-for-hipaa-violations-7096/
- 26 U.S.C. §§ 7201, 7206 — Tax Evasion and False Statements: https://www.law.cornell.edu/uscode/text/26/7206
- 42 U.S.C. § 408 — Social Security Fraud: https://www.law.cornell.edu/uscode/text/42/408
- Dubin v. United States, 599 U.S. ___ (2023): https://www.supremecourt.gov/opinions/22pdf/22-10_ifjn.pdf
- U.S. Attorney’s Office, Eastern District of Virginia — Man Sentenced to 54 Months for Wire Fraud and Aggravated Identity Theft: https://www.justice.gov/usao-edva/pr/man-sentenced-54-months-wire-fraud-and-aggravated-identity-theft
- Suffolk County District Attorney’s Office — Defendant Sentenced to 4 to 12 Years for Nationwide Synthetic Identity Fraud Scheme: https://www.suffolkcountyda.org/2023/01/20
- California Penal Code § 529 — False Impersonation: https://www.keglawyers.com/false-impersonation-penal-code-529
Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against federal statutes, HIPAA criminal penalty guidance, DOJ and state prosecutor press releases, and U.S. Supreme Court opinion in Dubin v. United States on September 19, 2026. Last Updated: September 19, 2026.
This article is for informational purposes only and does not constitute legal advice. Laws vary by state and individual circumstances differ. For advice about your specific situation, consult a qualified attorney.
thank you for this I am just being to see what has been going on
Our Pleasure, Let us know if you want us to cover more topics