Identity Theft: Laws, Regulations, And You

Identity theft is a type of crime that involves stealing and misusing another person's personal data, such as their Social Security number, credit card numbers, bank account numbers, date of birth, etc. It is typically done for economic gain. In the US, identity theft laws vary from state to state, and depending on the nature of the crime, it can be treated as a misdemeanor or a felony. For example, in Illinois, first-time offenders face misdemeanor charges. However, under federal law, identity theft is often treated as a felony. The federal government has passed several laws to address identity theft, including the Identity Theft and Assumption Deterrence Act in 1998, which made it a federal crime to steal or misuse someone's identity. Other laws include the Theft Penalty Enhancement Act of 2004, which increased penalties for aggravated identity theft, and the Identity Theft Enforcement and Restitution Act of 2008, which expanded the scope of prosecution and increased restitution for victims.

The Identity Theft and Assumption Deterrence Act, 1998

The Identity Theft and Assumption Deterrence Act of 1998 was introduced by Senator Jon Kyl on March 21, 1997, and later by Representative John B. Shadegg on March 30, 1998. The Act amends the Federal criminal code to make identity fraud a crime. It prohibits anyone from knowingly transferring or using, without lawful authority, another person's means of identification with the intent to commit or promote any unlawful activity that constitutes a violation of Federal law or a felony under State or local law.

The Act defines "means of identification" as any name or number that may be used to identify a specific individual, including social security numbers, dates of birth, driver's license numbers, passport numbers, and more. It imposes criminal penalties for first and subsequent offences involving fraud and related activity in connection with identification documents, including for offences committed in conjunction with other specified crimes.

The Act also provides for mandatory restitution for victims of identity fraud, which may include payment of costs incurred in clearing a credit history or rating, as well as any legal fees incurred in connection with civil or administrative proceedings resulting from the offence. It directs the United States Sentencing Commission to review and amend the Federal sentencing guidelines to provide appropriate penalties for such offences, taking into account specified factors such as the number of victims, the potential loss, and the range of conduct covered by the offence.

Additionally, the Act authorizes the United States Secret Service to investigate offences under this Act and directs the Secret Service, the Federal Bureau of Investigation, the Secretary of the Treasury, the Chairman of the Federal Trade Commission, the Attorney General, and the Postmaster General to study and report to Congress on the nature, extent, and causes of identity fraud, as well as the threat it poses to financial institutions, payment systems, and consumer safety and privacy.

The Theft Penalty Enhancement Act, 2004

The Identity Theft Penalty Enhancement Act, 2004, was signed into law by President Bush on July 15, 2004. The Act amends the Federal criminal code to establish penalties for aggravated identity theft. Identity theft occurs when someone uses your personal or financial information without your permission. This can include credit card or Social Security numbers, bank account numbers, and medical insurance account numbers.

The Act prescribes sentences of two years' imprisonment for knowingly transferring, possessing, or using, without lawful authority, the means of identification of another person during and in relation to specified felony violations. These violations include theft of public property, theft by a bank officer or employee, and various fraud and immigration offenses. The Act also prohibits a court from placing any person convicted of such a violation on probation and from reducing the sentence for the related felony.

Additionally, the Act expands the existing identity theft prohibition to cover the possession of another person's means of identification with the intent to commit specified unlawful activity. It increases penalties for violations and includes acts of domestic terrorism within the scope of prohibiting the facilitation of international terrorism.

The Act also modifies provisions regarding embezzlement and theft of public money, property, or records. It provides for combining the amounts from all counts for which the defendant is convicted in a single case to determine the applicable penalties. Furthermore, it directs the U.S. Sentencing Commission to review and amend its guidelines to ensure that the guideline offense levels appropriately punish identity theft offenses involving an abuse of position.

The Identity Theft Penalty Enhancement Act, 2004, is a crucial piece of legislation in combating identity theft and protecting individuals' personal and financial information. It provides clear penalties and guidelines for prosecuting and punishing those who engage in identity theft.

The Identity Theft Enforcement and Restitution Act, 2008

In 2008, the growing threat of identity theft prompted Congress to pass the Identity Theft Enforcement and Restitution Act, a federal law that strengthens the efforts to prosecute identity theft and enhances restitution for victims. This Act amends the federal criminal code in several significant ways:

Firstly, it authorises criminal restitution orders, empowering courts to issue orders that require payments to victims for the time spent remediating the harm caused by identity theft, in addition to compensating for the actual harm incurred. This provision ensures that victims can recover not just their financial losses but also the time invested in repairing the damage done.

Secondly, the Act expands the scope of identity theft and aggravated identity theft crimes. Initially, only natural persons were protected under the law, but now organisations are included as well. Additionally, conspiracy to commit a felony is now encompassed within the definition of "felony violation" for aggravated identity theft crimes.

Thirdly, the Act broadens the range of predicate offences for aggravated identity theft. Making, uttering, or possessing counterfeited securities, mail theft, and tax fraud are now included as underlying crimes that can lead to aggravated identity theft charges.

Furthermore, the Act enables the prosecution of computer fraud offences without the previous requirement of involving interstate or foreign communication. It also lowers the threshold for damage caused to a victim's computer, eliminating the previous mandate of aggregating at least $5,000 in damages before a prosecution could be pursued.

Additionally, the Act makes it a felony to damage ten or more protected computers used by the federal government or financial institutions within a one-year period. The definition of "cyber-extortion" has been expanded to include a demand for money in relation to such damage, and conspiracies to commit computer fraud are now prohibited.

Lastly, the Act expands the jurisdiction for prosecuting computer fraud offences, giving more leeway for interstate and foreign prosecution. It also imposes criminal and civil forfeitures of property used to commit computer fraud offences, aiming to deter and punish these crimes more effectively.

The Fair and Accurate Credit Transactions Act

The act also contains provisions to help reduce identity theft, such as the ability for individuals to place alerts on their credit histories if identity theft is suspected or if they are deploying overseas with the military. This makes it more difficult for fraudulent credit applications to be approved. The act also requires the secure disposal of consumer information and the truncation of credit and debit card numbers on receipts.

Creditors or financial institutions that violate the Fair and Accurate Credit Transactions Act rules are subject to fines. The act is enforced by the Federal Trade Commission (FTC), which performs audits of credit bureaus and some financial institutions.

The Red Flag Program Clarification Act

• Obtains or uses consumer reports, directly or indirectly, in connection with a credit transaction
• Furnishes information to certain consumer reporting agencies in connection with a credit transaction
• Advances funds to or on behalf of a person, based on the person's obligation to repay the funds or on repayment from specific property pledged by or on the person's behalf

The Act also includes in the definition any other type of creditor as determined appropriate by the federal agency (banking agency, National Credit Union Administration, or the Federal Trade Commission) that has authority over that creditor, if the creditor offers or maintains accounts subject to a reasonably foreseeable risk of identity theft.

However, the Act excludes from the definition of creditor any creditor that advances funds on behalf of a person for expenses incidental to a service the creditor provides to that person.

The Red Flags Rule defines a "financial institution" as a state or national bank, a state or federal savings and loan association, a mutual savings bank, a state or federal credit union, or a person that, directly or indirectly, holds a transaction account belonging to a consumer. The Rule defines a "creditor" based on conduct. To determine if a business or organization is a creditor under the Red Flags Rule, ask the following questions:

• Does the business or organization regularly defer payment for goods and services or bill customers?
• Does the business or organization grant or arrange credit?
• Does the business or organization participate in the decision to extend, renew, or set the terms of credit?

If the answer to all of the above is "no", the Rule does not apply. If the answer to one or more is "yes", ask the following:

• Does the business or organization regularly and in the ordinary course of business get or use consumer reports in connection with a credit transaction?
• Does the business or organization give information to credit reporting companies in connection with a credit transaction?
• Does the business or organization advance funds to or for someone who must repay them, either with funds or pledged property (excluding incidental expenses in connection with the services provided)?

If the answer to all of the above is "no", the Rule does not apply. If the answer to one or more is "yes", the business or organization is a creditor covered by the Rule.

Frequently asked questions