What Is the Identity Theft Enforcement and Restitution Act?

The Identity Theft Enforcement and Restitution Act is a federal law signed on September 26, 2008 that rewrote key parts of the Computer Fraud and Abuse Act (18 U.S.C. § 1030) to make federal cybercrime cases easier to bring, added cyber extortion and conspiracy as chargeable offenses, and for the first time allowed courts to order offenders to repay victims for the hours spent cleaning up after identity theft.¹

What the Act Changed About Federal Jurisdiction

Before 2008, federal prosecutors bringing a CFAA charge for unauthorized access to a protected computer had to show that the offense involved “an interstate or foreign communication.” The Act deleted that language from 18 U.S.C. § 1030(a)(2)(C). Prosecutors no longer need to prove the crime crossed state lines or moved over interstate networks.¹

The Act also removed a prior requirement that prosecutors show at least $5,000 in damages before bringing certain federal charges. That change opened the door to federal prosecution of smaller identity theft cases that still cause real harm to individual victims. The $5,000 figure did not disappear entirely; it still matters for private civil lawsuits under the CFAA, covered further down.

New and Expanded Criminal Offenses

The Act added conspiracy to the list of punishable conduct under the CFAA. Earlier federal law reached the people who actually broke into systems or stole data but gave prosecutors limited tools against the organizers behind a scheme. Under the amended statute, a person who conspires to commit a computer fraud offense faces the same penalties as the person who carried it out.²

The Act also clarified that intentionally damaging a protected computer without authorization is a federal crime and created a specific aggravating factor when the damage affects 10 or more protected computers in any one-year period. That provision targets large-scale attacks in which malware spreads across networks and compromises many systems at once.²

Cyber Extortion

One of the Act’s most forward-looking pieces expanded the CFAA to cover cyber extortion. Under 18 U.S.C. § 1030(a)(7), it is a federal crime to transmit a communication in interstate or foreign commerce containing any of the following:

A threat to damage a protected computer.
A threat to steal or expose data obtained without authorization.
A demand for money or something of value related to damage the offender already caused to facilitate the extortion.

A first cyber extortion conviction carries up to five years in prison. A second conviction doubles the maximum to ten years.² This provision anticipated the ransomware wave that followed in the next decade.

Criminal Penalties

The amended CFAA does not set a single sentencing range. Different categories of conduct carry different maximum prison terms:

Up to 1 year for a first offense involving unauthorized access to information from a protected computer, unauthorized access to a government computer, or trafficking in passwords.
Up to 5 years for a first offense involving unauthorized access for commercial advantage or private financial gain, obtaining information worth more than $5,000, fraud through unauthorized computer access, or cyber extortion.
Up to 10 years for a second conviction on any of the offenses above, or a first offense involving unauthorized access to restricted government data related to national defense or foreign relations.
Up to 20 years for a second conviction involving restricted government data, or for knowingly causing serious damage to a protected computer in certain circumstances.
Up to life imprisonment when an offense under § 1030(a)(5)(A) knowingly or recklessly causes or attempts to cause death.

These maximums come directly from the statute.² Fines follow the general federal fine schedule at 18 U.S.C. § 3571: up to $250,000 for an individual felony conviction and up to $500,000 for an organization. If the offense produced financial gain or caused financial loss, the fine can reach twice the gross gain or twice the gross loss, whichever is greater.³

Organizations sit within reach of these penalties because the CFAA defines “person” to include corporations, firms, educational institutions, financial institutions, and government entities.²

Restitution for the Time Victims Spend Recovering

The Act’s most significant change for identity theft victims sits in 18 U.S.C. § 3663(b). Before 2008, federal restitution generally covered direct financial losses: money stolen, fraudulent charges paid. It did not cover the hours victims spend on the phone with credit bureaus, disputing charges, filing reports, and reassembling their financial identity. The Act amended the restitution statute to authorize courts to order the defendant to pay “an amount equal to the value of the time reasonably spent by the victim in an attempt to remediate the intended or actual harm.”⁴

The statute uses “value of the time reasonably spent” without prescribing a formula. Federal courts have generally looked at the victim’s opportunity cost: whether the time caused the victim to miss paid work, turn down clients, or lose other income. Hours the victim would not otherwise have spent earning carry less compensable value. Attorney fees and costs paid to credit repair professionals can be included in a restitution order, though costs of pursuing a separate civil lawsuit against the defendant typically cannot.

Beyond the time-based restitution the 2008 Act added, the broader federal restitution framework at 18 U.S.C. § 3663A also requires defendants to reimburse victims for lost income, medical and psychological treatment costs, and necessary expenses tied to participating in the investigation or prosecution, including transportation and child care.⁵

Collecting Restitution in Practice

Getting a restitution order and actually receiving the money are two different things. Many identity thieves hold few legitimate assets, and a victim can end up with a court order that produces little in the short term. Federal law does provide enforcement mechanisms, but they take patience.

Under 18 U.S.C. § 3664, the court sets a payment schedule based on the defendant’s financial resources, projected earnings, and obligations to dependents. The court can order a lump sum, installment payments, or in-kind restitution. When a defendant genuinely cannot pay, the court may order nominal periodic payments that keep the obligation alive.⁶

You can ask the court clerk to issue an abstract of judgment, which functions as a lien on the defendant’s property in the state where the court sits. The defendant must notify the court and the Attorney General of any material change in economic circumstances that could affect the ability to pay, and the court can raise the payment schedule if the defendant’s finances improve.⁶ The federal government can also collect unpaid restitution through the Treasury Offset Program, which intercepts the defendant’s federal tax refunds and certain other government payments.

Civil Lawsuits Under the CFAA

The CFAA is not only a criminal statute. Under 18 U.S.C. § 1030(g), a person who suffers damage or loss from a CFAA violation can file a civil suit for compensatory damages and injunctive relief. The plaintiff must show the conduct involved at least one qualifying factor, such as aggregate losses of $5,000 or more during a one-year period, a threat to public health or safety, or damage to a computer used by the government for national defense or the administration of justice.²

“Loss” is defined broadly to include the cost of responding to the offense, conducting a damage assessment, restoring systems to their prior condition, and any revenue lost or consequential damages from service interruptions. A civil action must be filed within two years of the act or the date the victim discovered the damage, whichever is later. Claims based on negligent hardware or software design are excluded.

If You Are a Victim of Identity Theft

File a report at IdentityTheft.gov, the federal government’s centralized reporting portal run by the Federal Trade Commission. Filing generates an official FTC Identity Theft Report and a personalized recovery plan, and the FTC enters the report into Consumer Sentinel, a secure database used by criminal and civil law enforcement agencies to identify patterns and build cases.⁷

A federal report does not guarantee a federal investigation. The FTC collects reports and makes them available to law enforcement but does not resolve individual cases. Also file a police report with your local law enforcement agency. That creates an official record for disputing fraudulent accounts and may be required by creditors or credit bureaus. Under the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018, every consumer can place and lift credit freezes at the three major bureaus for free, whether or not they have been victimized.⁸ Placing a freeze as soon as you spot the theft is one of the most effective ways to keep further damage from stacking up.

1
United States Congress. Public Law 110-326 – Identity Theft Enforcement and Restitution Act of 2008
2
Office of the Law Revision Counsel. 18 U.S.C. 1030 – Fraud and Related Activity in Connection With Computers
3
Office of the Law Revision Counsel. 18 U.S.C. 3571 – Sentence of Fine
4
Office of the Law Revision Counsel. 18 U.S.C. 3663 – Order of Restitution
5
Office of the Law Revision Counsel. 18 U.S.C. 3663A – Mandatory Restitution to Victims of Certain Crimes
6
Office of the Law Revision Counsel. 18 U.S.C. 3664 – Procedure for Issuance and Enforcement of Order of Restitution
7
Federal Trade Commission. IdentityTheft.gov
8
Federal Trade Commission. Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts