18 U.S.C. § 1028A: Aggravated Identity Theft Sentence and Proof

Aggravated identity theft is a federal offense under 18 U.S.C. § 1028A that adds a mandatory two-year prison sentence on top of the punishment for a separate federal felony whenever the defendant knowingly used another real person’s identifying information during that felony. If the underlying crime is a federal act of terrorism, the mandatory add-on is five years instead of two. The sentence runs consecutively, cannot be reduced, and cannot be replaced with probation.¹

What the Government Has to Prove

A § 1028A conviction has four elements, each of which must be established beyond a reasonable doubt. The defendant transferred, possessed, or used a means of identification. That identification belonged to another actual person. The defendant acted without lawful authority. And the conduct occurred during and in relation to one of the specific federal felonies the statute lists.

The charge cannot stand on its own. It always rides on a separate federal felony conviction, and if the government loses on that predicate offense, the aggravated identity theft count falls with it. That structural dependency is often the first thing defense counsel targets.

One boundary worth naming up front: the general offense in subsection (a)(1) reaches only the use of a real person’s identifying information. Fabricated documents that do not correspond to any living individual are covered by the statute only in the terrorism track under subsection (a)(2).

The Mandatory Sentence and How It Stacks

The sentencing rules for this offense are unusually rigid. A general conviction adds a flat two years; a terrorism-linked conviction adds five. There is no range, no downward variance, and no probation.¹

Three features drive the punishment:

The add-on is strictly consecutive. It cannot run at the same time as the sentence for the underlying felony.
The court cannot shorten the predicate sentence to soften the total. A defendant sentenced to five years for wire fraud plus two years for aggravated identity theft serves seven; the judge cannot cut the fraud term to compensate.
Probation is off the table regardless of criminal history, personal circumstances, or cooperation.

Because the extra time is guaranteed upon conviction, prosecutors gain substantial leverage in plea talks, and defendants weighing trial risk have to price in the mandatory years no matter how the underlying case is resolved.

Multiple Counts: Concurrent or Consecutive

When a defendant faces more than one § 1028A count, the mandatory add-ons do not automatically stack against each other. Under subsection (b)(4), a court has discretion to run multiple aggravated identity theft sentences concurrently with one another, though never concurrently with the predicate felony sentence. The Sentencing Commission guidelines shape that decision, along with the seriousness of the underlying offenses and whether the counts arise from a single scheme or distinct episodes.¹

The practical difference is enormous. Five counts tied to one fraud scheme might add only two years if the court runs them concurrently. Five counts tied to five distinct victims or episodes can add ten.

What Counts as a “Means of Identification”

The statute defines “means of identification” broadly. Under 18 U.S.C. § 1028(d)(7), it covers any name or number that can identify a specific person, alone or combined with other data.² Four categories are included:

Standard personal identifiers such as name, Social Security number, date of birth, driver’s license number, alien registration number, passport number, and employer or taxpayer ID.
Biometric data including fingerprints, voiceprints, and retina or iris images.
Electronic identifiers such as unique electronic identification numbers, addresses, or routing codes.
Telecommunications and access devices, including account information and credit card numbers.

An email address tied to a specific person, a bank routing number, or a fingerprint scan can all qualify. Almost any personal data point used in a federal felony can support the charge.

Which Federal Felonies Trigger the Charge

Only certain federal crimes serve as predicates. Section 1028A(c) lists them:¹

Fraud offenses, including wire fraud, mail fraud, bank fraud, healthcare fraud, and other federal false-statement crimes under Chapter 47 of Title 18.
Theft of government funds, embezzlement by bank employees, and theft from employee benefit plans.
Immigration crimes such as false claims of citizenship, document fraud, illegal reentry, and alien smuggling.
Passport and visa violations, including forging or making false statements in applications.
Social Security fraud, including false claims tied to benefits, SSI, and Medicare.
False statements in connection with acquiring a firearm.
Obtaining customer financial information through false pretenses.

The terrorism track pulls from a separate list of federal crimes of terrorism under 18 U.S.C. § 2332b(g)(5)(B). If none of the listed predicates is proven, the § 1028A count cannot stand.

The Dubin “Crux” Limit

In 2023, the Supreme Court sharply narrowed the reach of this statute in Dubin v. United States. The Court held that a defendant “uses” another person’s identification “in relation to” a predicate crime only when that use is “at the crux of what makes the conduct criminal.”³

The Court rejected the government’s broader reading, which would have swept ordinary overbilling into aggravated identity theft. The line it drew turns on whether the fraud is about who was involved or about how or when services were provided. A pharmacist who steals a patient’s information to open a bank account in that patient’s name is at the heart of § 1028A: the misrepresentation about identity is what makes the conduct criminal. A healthcare provider who bills for real services to a real patient while inflating the mileage is not: the patient’s name on the bill is incidental to the fraud.³

After Dubin, simply including a real name or account number on a fraudulent document does not trigger the mandatory add-on. Defense counsel now routinely uses this standard to challenge § 1028A counts in healthcare fraud, overbilling, and financial cases where real clients or patients are involved.

The Flores-Figueroa Knowledge Requirement

A second Supreme Court decision limits the statute at the knowledge element. In Flores-Figueroa v. United States, the Court held that the government must prove the defendant knew the identification belonged to a real person.⁴ A string of numbers that happens to match a real Social Security number is not enough on its own.

That knowledge can still be inferred from circumstances. Someone who buys identity data from a dealer in stolen personal information plainly knows the identities are real. But a defendant who invents what they believe is a fictitious identity that turns out to match a living person has a viable defense to this specific charge.⁴

“Without Lawful Authority” Even With Permission

The phrase “without lawful authority” is broader than it sounds. Federal courts have consistently held that a person can act without lawful authority even when the identity holder gave permission. What matters is whether the use itself is lawful, not whether the defendant had access to the information.

A healthcare provider who legitimately holds patient data for billing crosses the line the moment that data is submitted in fraudulent claims. The authority to possess information is not the authority to use it for a crime. The same logic reaches family members: a spouse who uses their partner’s Social Security number for bank fraud cannot claim authorization as a defense, even if the partner freely shared the number. No one can grant another person the authority to commit a crime with their identity.

Fines and Restitution

Prison is not the only financial consequence. A conviction can carry a fine up to $250,000 under the general federal fine statute, and that ceiling applies even to a single count.⁵

Restitution often hits harder. Because the predicates typically involve fraud or property crimes, mandatory restitution under 18 U.S.C. § 3663A almost always applies. The court must order the defendant to compensate identifiable victims for their losses, which can include:⁶

Property losses, valued at whichever is greater between the date of loss and the date of sentencing.
Lost income directly caused by the offense.
Out-of-pocket costs such as child care and transportation tied to participating in the investigation or prosecution.

For identity theft victims specifically, restitution can cover the time and money spent repairing credit, disputing fraudulent accounts, and untangling the administrative damage of having their identity used. Cleaning up after identity theft routinely takes months and costs victims thousands of dollars in direct expenses and lost time, and courts can order the defendant to pay for that work.

1
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
2
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents
3
Legal Information Institute. Dubin v. United States
4
Legal Information Institute. Flores-Figueroa v. United States
5
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
6
Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes