Georgia Identity Fraud Act Explained, O.C.G.A. § 16-9-121
O.C.G.A. § 16-9-121 — Quick Facts
If you’re reading this because you or someone you know was just charged under O.C.G.A. § 16-9-121, here’s the first thing to understand: that code section doesn’t set your sentence. It defines what conduct counts as identity fraud. The penalty — the actual years and dollar amount you’re facing — lives in a different section, § 16-9-126, which most people never think to look up separately. That gap trips up a lot of people trying to research their own charge, so this article walks through the whole statutory framework the way it’s actually built, not just the headline penalty numbers.
| Official Name | Part of the Georgia Identity Theft Law, enacted as the “Georgia Personal Identity Protection Act” (Ga. L. 2007) |
| Where It Lives | Title 16, Chapter 9, Article 8 of the Official Code of Georgia Annotated — §§ 16-9-120 through 16-9-132 |
| What § 16-9-121 Covers | Elements of the offense — the conduct that makes something identity fraud |
| Where the Penalty Actually Is | § 16-9-126, a separate section |
| Companion Offense | § 16-9-121.1 — aggravated identity fraud (employment use) |
| Attempt/Conspiracy | § 16-9-122 — same maximum penalty as the completed offense |
| Venue Rule | § 16-9-125 — county where the victim resides or is found |
| Merger | Does not merge with other offenses (§ 16-9-121(c)) |
| Last Updated | September 2026 |
What O.C.G.A. § 16-9-121 Actually Says
The statute is titled “Elements of Offense,” and it breaks into four parts.
Subsection (a) lists five ways a person commits identity fraud, each requiring that the person act “willfully and fraudulently”:
- Using or possessing, without authorization or consent, someone’s identifying information with intent to fraudulently use it
- Using the identifying information of a minor under 18 whom the person has custodial authority over — this covers parents and guardians who misuse a child’s Social Security number, most commonly to open credit in the child’s name
- Using or possessing, with intent to fraudulently use, the identifying information of a deceased person
- Creating, using, or possessing counterfeit or fictitious identifying information tied to a made-up person, with intent to use it to commit or facilitate a crime or fraud
- Without authorization, creating, using, or possessing counterfeit or fictitious identifying information tied to a real person, with the same fraudulent intent
Most identity fraud prosecutions in Georgia are charged under subsection (a)(1) — the broad “used or possessed with intent” language. Note what it doesn’t require: the fraud doesn’t have to succeed, and no one has to lose money. Possession with the right intent is enough on its own.
Subsection (b) creates a second, separate crime that a lot of people miss entirely: identity fraud by receipt of fraudulent identification information. This one applies to someone who willingly accepts information for identification purposes while knowing it’s fraudulent, stolen, counterfeit, or fictitious. Prosecutors don’t have to prove a conviction of whoever originally stole or counterfeited the information — the receiving party can be charged independently. This is the subsection that can reach someone who wasn’t the original thief but knowingly used or accepted stolen credentials passed along by someone else.
Subsection (c) is a single line with real consequences: the offenses under this section don’t merge with other offenses. In practice, that means a defendant convicted of identity fraud alongside forgery, theft, or financial transaction card fraud for the same conduct can be sentenced on all of them separately, rather than having the lesser charges absorbed into the greater one.
Subsection (d) carves out people under 21 who use a fake or borrowed ID to get into a bar or buy alcohol. That conduct is handled under separate underage-possession statutes, not identity fraud — a distinction worth knowing if that’s the fact pattern involved.
The Definitions That Control the Charge — § 16-9-120
Section 16-9-121 leans entirely on definitions set out one section earlier, in § 16-9-120. Two of them decide most cases.
“Identifying information” is defined broadly and by example, not by a closed list — names, Social Security numbers, driver’s license numbers, checking and savings account numbers, credit and debit card numbers, PINs, electronic signatures, medical ID numbers, birth dates, mother’s maiden name, tax ID numbers, and “any other numbers or information which can be used to access a person’s or entity’s resources or health care records.” That catch-all language is why Georgia courts have applied the statute to things like Facebook login credentials — see Libri v. State below.
“Resources” is equally broad: credit and credit history, currency, real and personal property, credit and loan accounts, safety deposit boxes, a person’s driving, criminal, medical, or employment history, and health insurance and benefit accounts. In Hernandez v. State, the Georgia Supreme Court held that “resources” reaches as far as the IRS itself — using a stolen Social Security number to get a job, and thereby gaining indirect access to the victim’s IRS account, was enough to satisfy the statute.
The statute also defines “business victim” (an entity that lost money or value because it gave something to the wrong person) and “consumer victim” (anyone whose information was obtained, compromised, used, or recorded without permission) — a distinction that matters later for who can sue civilly and who can file a report with the state administrator.
Where the Penalties Actually Live — § 16-9-126
This is the section most searches for “16-9-121 penalty” actually need. Under § 16-9-126(a), a violation of Article 8 — other than an attempt or conspiracy charge under § 16-9-122 — carries 1 to 10 years in prison, a fine of up to $100,000, or both. A second or later offense carries 3 to 15 years and a fine of up to $250,000.
Two more pieces of § 16-9-126 matter beyond the headline numbers:
Restitution (subsection b): A court may order a convicted defendant to pay restitution to any consumer victim or business victim of the fraud, independent of the fine.
Separate offenses (subsection c): Each violation of Article 8 is its own separate offense. This is the statutory basis for multi-count indictments — a defendant who used one victim’s information across five separate transactions can face five counts, each carrying its own penalty exposure.
Aggravated Identity Fraud — § 16-9-121.1
Georgia carves out one fact pattern into its own, separately numbered offense: using counterfeit or another person’s identifying information — real, fictitious, or deceased — specifically to get a job. This is aggravated identity fraud, and it carries 1 to 15 years in prison and a fine of up to $250,000. Like § 16-9-121(c), this offense does not merge with other charges, so it’s typically charged as an addition to, not a substitute for, standard identity fraud counts when a stolen SSN shows up on an employment application or I-9 form.
Attempt and Conspiracy — § 16-9-122
Georgia doesn’t treat an attempted or conspired identity fraud scheme as a lesser crime with its own separate penalty scale. Under § 16-9-122, attempting or conspiring to commit any offense in Article 8 is punishable up to the maximum penalty for the completed offense that was the object of the attempt. In other words, getting caught before the fraud is completed doesn’t cap your exposure the way it might for other crimes — the ceiling is the same as if you’d finished the scheme.
Who Investigates and Who Prosecutes — §§ 16-9-123, 16-9-124, 16-9-127
Three sections divide up institutional authority. Section 16-9-123 gives the administrator appointed under the Fair Business Practices Act (functionally, the consumer protection division of the Georgia Attorney General’s office) power to investigate consumer complaints of identity fraud, using the same investigative tools available under that Act. Section 16-9-124 gives the Attorney General and local prosecuting attorneys concurrent authority to criminally prosecute identity fraud cases — meaning a case can be brought by a district attorney locally or picked up by the Attorney General’s office, which matters most for large or multi-county schemes. Section 16-9-127 rounds out the Attorney General’s specific authority under the article.
Venue: Where You Can Be Charged — § 16-9-125
Section 16-9-125 sets a rule that trips up prosecutors more than almost any other part of this statute: for purposes of Article 8, the crime is considered to occur in the county where the consumer or business victim resides or is found — not necessarily where the defendant was physically located when the fraud happened.
This isn’t just a technicality. In Middlebrooks v. State, 277 Ga. App. 551 (2006), an identity fraud conviction was reversed outright because the state failed to establish the victim’s residence or where a stolen credit card was actually taken — meaning the prosecution literally could not prove it had brought the case in the right county. The Georgia Supreme Court upheld the constitutionality of this venue framework in State v. Mayze, 280 Ga. 5 (2005), holding that because identity fraud is a continuing offense, prosecution properly extends into the county where the victim resides or is found, regardless of where the defendant acted. Two different appellate cases confirm that even a technically strong case can fail if the state skips proving this element.
Civil Remedies for Victims — §§ 16-9-129 and 16-9-130
Article 8 isn’t purely criminal. Section 16-9-129 gives a business victim a right to actual and punitive damages against the person responsible. Section 16-9-130 gives a consumer victim a separate civil damages right — and specifically states that it’s not a defense that other people or businesses engage in comparable practices. These civil provisions run independently of any criminal prosecution, meaning a victim doesn’t have to wait for — or rely on — a criminal conviction to pursue a civil claim for what the fraud cost them.
How Courts Have Actually Applied This Statute
Appellate decisions fill in what the bare text doesn’t spell out:
Possession alone is enough. In Hernandez v. State, 281 Ga. 559 (2007), the court held the statute wasn’t unconstitutionally vague as applied to someone who used a stolen Social Security number to get a job — even though the “victim” in that case was arguably the IRS system the defendant gained access to, not a person directly defrauded of money.
Digital accounts count as “resources.” In Libri v. State, 346 Ga. App. 420 (2018), a defendant who used a missing child’s personal information — obtained from the child’s mother — to alter the child’s Facebook page and lock the child out by changing the password was convicted of identity fraud. No money changed hands; controlling someone’s account was enough.
Corporations aren’t covered. In Martinez v. State, 325 Ga. App. 267 (2013), the court held that the version of § 16-9-121(a)(1) at issue didn’t make fraudulent use of a corporation’s identifying information punishable as identity fraud — the statute protects individual people’s information, not business entities’ identities, in that specific subsection.
Sufficiency of evidence is fact-intensive. Courts have upheld convictions built on falsified credit cards used at store registers (Epps v. State, 262 Ga. App. 113 (2003)), attempts to open bank accounts with a stolen SSN (Vicks v. State, 289 Ga. App. 495 (2008)), and using a victim’s credit to co-sign a car purchase through a third party (Powell v. State, 293 Ga. App. 442 (2008)) — but reversed a conviction where the state couldn’t show the defendant knew their conduct would require accessing a specific victim’s resources at all (Jones v. State, 285 Ga. App. 822 (2007)).
Aiding and abetting counts. In Manhertz v. State, 317 Ga. App. 856 (2012), a defendant who supplied tenants’ identifying information to a third party — without knowing the full scope of the scheme — was still convicted because providing the information was enough to show the defendant intentionally aided and abetted the underlying fraud.
Successive prosecutions aren’t automatically barred. In Summers v. State, 263 Ga. App. 338 (2003), the court rejected a double-jeopardy-style challenge to a second prosecution in a different county for related but distinct conduct already charged elsewhere.
How This Differs From an Ordinary Theft Charge
Two structural features set Article 8 apart from Georgia’s general theft statutes. First, the no-merger rule in § 16-9-121(c) and § 16-9-121.1(b) means identity fraud counts stack on top of related charges rather than folding into them — a defendant facing forgery, theft, and identity fraud charges arising from the same conduct can be sentenced on each independently. Second, unlike general theft crimes in Georgia, which grade based on the dollar value stolen, identity fraud under § 16-9-121 has no dollar threshold and no misdemeanor grade at all. The statute cares about the conduct — unauthorized use or possession with fraudulent intent — not the amount involved.
What to Do If You’re Charged Under § 16-9-121
If you’re facing an identity fraud charge, a few statutory features specifically matter for how the case will likely proceed:
Check the county. Given how often venue trips up these cases, it’s worth confirming the case was filed in the county where the alleged victim resides or was found, not simply where you live or were arrested.
Expect multiple counts. Because each use of someone’s information is a separate offense under § 16-9-126(c), review whether the state has charged one incident as several counts, which affects both sentencing exposure and plea negotiations.
Understand what doesn’t merge. If you’re also charged with forgery, financial transaction card fraud, or theft for the same underlying conduct, know that a conviction on the identity fraud count won’t absorb those other charges — each can carry its own sentence.
Ask whether it’s (a) or (b). Whether you’re charged under the “use or possess with intent” language of subsection (a) or the “knowing receipt” language of subsection (b) changes what the state actually has to prove about your state of mind.
For the fuller picture on sentencing ranges, defenses, and what happens after a conviction, see our companion guide, Is Identity Theft a Felony in Georgia? Charges, Penalties, and What You Need to Know.
Frequently Asked Questions
Does O.C.G.A. § 16-9-121 set the prison sentence for identity fraud in Georgia?
No. Section 16-9-121 defines the elements of the offense — the conduct that qualifies as identity fraud. The actual penalty range, 1 to 10 years for a first offense and 3 to 15 years for a second or later offense, is set out in a separate section, § 16-9-126.
What’s the difference between § 16-9-121(a) and § 16-9-121(b)?
Subsection (a) covers using or possessing someone’s identifying information with fraudulent intent — the core identity fraud offense. Subsection (b) is a separate crime for knowingly accepting fraudulent, stolen, counterfeit, or fictitious identification information for identification purposes, and it doesn’t require the state to prove who the original thief or counterfeiter was.
Can I be charged with identity fraud in Georgia even if the information was never actually used?
Yes. The statute criminalizes possession with intent to fraudulently use identifying information, not just completed use. Intent, not outcome, is the operative element.
Does a corporation’s stolen information count as identity fraud under this statute?
Not under § 16-9-121(a)(1) specifically — Georgia courts have held that subsection protects individual people’s identifying information, not a corporation’s. Fraud involving a business’s identity may fall under other statutes depending on the facts.
What county can I be prosecuted in for identity fraud in Georgia?
Under § 16-9-125, venue lies in the county where the victim resides or is found — regardless of where the defendant was physically located when the fraud occurred. Georgia courts have reversed convictions where the state failed to establish this properly.
Is attempted identity fraud a lesser charge in Georgia?
No. Under § 16-9-122, attempting or conspiring to commit identity fraud carries the same maximum penalty as the completed offense — there’s no separate, lower penalty scale for an unsuccessful attempt.
Can identity fraud charges be combined with other charges like forgery in Georgia?
Yes, and they typically are sentenced separately rather than merged. Section 16-9-121(c) specifically states that identity fraud offenses don’t merge with other offenses, so related forgery, theft, or credit card fraud charges can each carry independent sentences.
Legal Disclaimer: This information is for educational purposes only and does not constitute legal advice. Statutory text and case citations reflect the Official Code of Georgia Annotated as most recently amended; always confirm current wording against the official code and consult a Georgia criminal defense attorney about a specific charge.
Related Articles: