18 USC 1029: Sentences, Fines, and Forfeiture Explained

A first conviction under 18 U.S.C. § 1029 carries up to 10 years in federal prison for most offenses and up to 15 years for the more serious ones, and any repeat conviction under the same statute pushes the ceiling to 20 years. Those are only the statutory maximums. The penalties under 18 U.S.C. 1029 also include fines that can reach twice the loss caused, mandatory forfeiture of equipment and proceeds, court-ordered restitution, and, when identity theft is charged alongside, a mandatory two-year prison term that runs consecutively to everything else.

Which Offenses Carry 10 Years and Which Carry 15

Section 1029 lists ten distinct offenses, and Congress split them into two penalty tiers. Which subsection you’re charged under determines the ceiling.

The 10-year offenses cover:

Producing, using, or trafficking in counterfeit access devices with intent to defraud.
Using or trafficking in unauthorized access devices to obtain $1,000 or more in value in any one-year period.
Possessing fifteen or more counterfeit or unauthorized access devices.
Soliciting a person by offering an access device or selling information about how to get one without the issuer’s authorization.
Possessing or trafficking in a telecommunications instrument that has been modified to obtain unauthorized use of telecom services.
Arranging for someone to present fraudulent transaction records to a credit card system member for payment.

The 15-year offenses target the infrastructure that makes large-scale fraud possible:

Producing, possessing, or trafficking in device-making equipment such as embossers, magnetic stripe encoders, and skimmers.
Using an access device issued to another person to receive $1,000 or more in payments or value within a year.
Possessing a scanning receiver.
Possessing hardware or software configured to alter or modify a telecommunications instrument’s identifying information.

The reason the second tier is heavier is that possession of skimming rigs, scanning receivers, or ID-modification tools tends to signal an organized operation rather than a single act of using someone else’s card.¹

The 20-Year Ceiling for Repeat Offenders

Anyone convicted under § 1029 who already has a prior conviction under the same statute faces up to 20 years in federal prison, no matter which specific subsection is charged the second time. The enhancement applies across the board: a prior 10-year offense followed by another 10-year offense still exposes the defendant to the 20-year maximum on the new count.¹

Fines and the Twice-the-Loss Alternative

Section 1029 doesn’t set its own fine amounts. It relies on the general federal fine statute, 18 U.S.C. § 3571, which caps individual felony fines at $250,000 and organizational fines at $500,000. But the same statute allows a different calculation when the offense produced a gain or caused a loss: the court can impose a fine of up to twice the gross gain or twice the gross loss, whichever is greater. In fraud rings that moved substantial money, this alternative pushes fines well past the standard caps.²

How the Sentencing Guidelines Shape the Actual Sentence

The statutory maximums set the ceiling. What a judge actually imposes is driven by the U.S. Sentencing Guidelines, and specifically by USSG § 2B1.1, which governs fraud offenses. Total financial loss is the biggest single driver: the offense level climbs as the loss climbs, and the guideline range climbs with it.

Enhancements stack on top of the loss calculation. A large number of victims raises the level. So does the use of sophisticated means, meaning especially complex planning or concealment tactics such as shell companies or offshore accounts. Abuse of a position of trust adds more. The result is that two defendants convicted of the same subsection can end up with very different sentences depending on how big the scheme was and how it was run.

The Mandatory Two-Year Add-On for Identity Theft

The most consequential penalty attached to many § 1029 cases isn’t in § 1029 at all. It’s aggravated identity theft under 18 U.S.C. § 1028A. When someone uses another person’s identifying information during and in relation to a felony violation of § 1029, the court must impose a two-year prison term that runs consecutively to the sentence for the underlying fraud.³

Section 1029 qualifies as a predicate because it sits inside Chapter 47 of Title 18, which § 1028A lists among the triggering felonies. The two-year term cannot be reduced. It cannot run concurrently with the fraud sentence. Probation is not available. If the identity theft was terrorism-related, the mandatory add-on rises to five years.

Practically, this means a defendant who used a stolen card number along with the cardholder’s name and personal details faces the 10-year (or 15-year) ceiling for the fraud plus an automatic additional two years on top. The stackability is why § 1028A shows up so often in plea negotiations involving access device charges.³

Forfeiture of Property and Proceeds

A conviction under § 1029 triggers mandatory forfeiture of any personal property used or intended to be used to commit the offense. That reaches computers, phones, skimmers, embossers, magnetic stripe encoders, and any other tools connected to the fraud. The forfeiture proceeds under the framework set by section 413 of the Controlled Substances Act, which lets the government seize property before trial and requires defendants to press their claims within the criminal case itself.⁴

Restitution to Victims

Federal courts routinely order restitution to banks, businesses, and individuals who lost money in the fraud. Under the Mandatory Victims Restitution Act, restitution in many federal fraud cases is required whether or not the defendant has the ability to pay. The order becomes a federal debt. It survives bankruptcy. It can be collected through wage garnishment, bank levies, property liens, and interception of tax refunds through the Treasury Offset Program. For someone convicted in a large-loss case, the restitution obligation can outlast the prison sentence by decades.

Supervised Release and Cybercrime Conditions

A federal sentence for access device fraud almost always includes supervised release after prison. For fraud built on digital tools, judges can attach cybercrime-specific conditions that go well beyond standard supervision.

Under the federal courts’ cybercrime supervision framework, conditions range from monitored computer use, with tracking software installed on every device the defendant touches, up to a complete ban on computer and internet access. Standard devices such as laptops, desktops, smartphones, and tablets running Windows, Mac OS, Android, or iOS can be monitored using commercially available software. Non-standard devices, including gaming consoles, smart home assistants, IoT hardware, and systems running Linux or Chromium, cannot be practically monitored and may be prohibited outright.⁵

How restrictive the conditions are depends on the offense and the defendant’s technical sophistication. A defendant who ran a skimming operation may face a total prohibition on unmonitored internet access. A less technical first offender may be permitted monitored device use. Violating any of these conditions can bring revocation and a return to prison.⁵

What the Government Must Prove Before Penalties Attach

None of these penalties apply unless the government proves the offense. Every § 1029 charge requires three elements: that the defendant acted knowingly and with intent to defraud, that the conduct fits one of the ten prohibited categories, and that the offense affected interstate or foreign commerce.¹

Intent to defraud is the element that most often drives sentencing exposure. Carelessness or mistake is not enough. The defendant has to have acted with a conscious purpose to deceive and to obtain something of value through that deception. Prosecutors typically prove it circumstantially: possession of multiple stolen credentials along with encoding equipment, communications about fraud schemes, patterns of unauthorized purchases, or steps taken to conceal transactions.

The interstate commerce element is rarely a real obstacle. Any transaction routed through a bank, card network, or online payment system crosses state lines by definition, which brings almost every access device case within federal jurisdiction.

Putting the Exposure Together

For a first-time defendant, the realistic worst case under § 1029 alone is 10 or 15 years depending on the subsection, plus a fine up to twice the loss, forfeiture of equipment, restitution that will follow them for years, and supervised release with digital restrictions after prison. Add an aggravated identity theft count, and two more years become mandatory on top. Add a prior § 1029 conviction, and the ceiling on the new count jumps to 20. Where a given defendant actually lands inside that range depends on the loss amount, the sophistication of the scheme, the number of victims, and whether prosecutors decide to stack § 1028A on top.