Texas identity theft defense

What is identity theft under PC § 32.51?

Texas Penal Code § 32.51 — Fraudulent Use or Possession of Identifying Information — criminalizes obtaining, possessing, transferring, or using another person's identifying information with intent to harm or defraud. The offense is graded by item count: state-jail felony (under 5), 3rd-degree (5-9), 2nd-degree (10-49), 1st-degree (50+).

Item count under 5 — State-jail felony

Punishment under § 12.35: 180 days to 2 years in a state jail facility plus a fine up to $10,000. A state-jail-felony conviction does not carry parole eligibility in the traditional sense — under Government Code § 508.146, state-jail-felony sentences are served day-for-day with limited good-conduct credits. Community supervision is available under Code Crim. Proc. ch. 42A for defendants without a disqualifying prior record. The state-jail-felony grade is the floor of § 32.51 prosecutions, and Article 42A.551 supplies "12.44" reduction options that can move the offense effectively to a Class A misdemeanor at punishment.

Item count 5 to 9 — 3rd-degree felony

Punishment under § 12.34: 2 to 10 years in TDCJ plus a fine up to $10,000. Community supervision is generally available (the offense is not a 3g aggravated offense under Code Crim. Proc. art. 42A.054), and deferred adjudication is available under art. 42A.101. Parole eligibility runs under Government Code § 508.145(f) — the lesser of one-quarter of the sentence imposed (with good-conduct credit) or 15 calendar years. The 5-9 item threshold most often arises in single-victim cases where the defendant possessed several items of one person's information (e.g., name, SSN, date of birth, account number, and address) — five qualifying items will pull the offense from state-jail to 3rd-degree.

Item count 10 to 49 — 2nd-degree felony

Punishment under § 12.33: 2 to 20 years in TDCJ plus a fine up to $10,000. The 10-49 threshold most often arises in multi-victim cases — a defendant alleged to possess identifying information of three or four victims with several items each is rapidly into 2nd-degree territory. Community supervision and deferred adjudication remain available subject to the standard eligibility rules. This is the most common grade for identity theft prosecutions involving stolen wallets, mail theft rings, data-breach proceeds, and dark-web purchase chains in DFW courtrooms.

Item count 50 or more — 1st-degree felony

Punishment under § 12.32: 5 to 99 years or life in TDCJ plus a fine up to $10,000 — identical to the murder sentencing range. The 50+ threshold typically appears in large-scale data-breach cases, organized fraud rings, and tax-return fraud schemes involving dozens of victims. Despite the severe exposure, the offense is not a 3g aggravated offense — community supervision can be ordered where the defendant has no prior felony and the sentence is 10 years or less. Federal companion charges under 18 U.S.C. § 1028 are virtually inevitable at this scale, and federal prosecutors frequently pursue parallel cases against the same conduct.

Texas Penal Code § 32.51 — Fraudulent Use or Possession of Identifying Information — is the workhorse identity-theft statute in Texas state practice. The structure is deceptively simple: with intent to harm or defraud, a person obtains, possesses, transfers, or uses an item of identifying information of another person without consent. But three statutory levers reshape the offense based on the surrounding facts. First, the verb list is broad — "obtains, possesses, transfers, or uses" — and even passive possession qualifies. Second, the "item" count drives the grade, and the definition of "item" is broad enough that a single stolen wallet can contain a dozen items. Third, the elderly-victim enhancement under § 32.51(c-1) raises every grade by one degree, sometimes producing 1st-degree exposure from what would otherwise be a 2nd-degree case.

The intent element is the dispositive contest in many § 32.51 trials. The State must prove that the defendant — at the time of obtaining, possessing, transferring, or using the identifying information — acted with intent to harm or defraud. Mere possession of identifying information, without the harmful or fraudulent intent, is not the offense. Cortez v. State, 469 S.W.3d 593 (Tex. Crim. App. 2015), is the workhorse decision: the Court emphasized that the prosecution must connect the possession to the intent through evidence permitting a rational juror to find the intent element beyond a reasonable doubt. A defendant who legitimately came into possession of identifying information (a forgotten wallet, an inherited document, a misdelivered mail piece) and was in the process of returning or destroying it has a strong defense to the intent element.

Elements and mens rea — intent to harm or defraud

Section 32.51(b) requires proof that the defendant — with intent to harm or defraud another — obtained, possessed, transferred, or used identifying information of another without consent. Each verb is independently sufficient; the intent element is the most often contested at trial.

The actus reus of § 32.51 is satisfied by any of four discrete verbs: obtain, possess, transfer, or use. The drafters cast the net broadly. "Obtain" covers acquisition by any means — theft, deceit, social engineering, dumpster diving, dark-web purchase. "Possess" requires care, custody, control, or management of the identifying information, and applies even where the defendant did not acquire the information himself. "Transfer" covers passing identifying information to a third party, whether for value or gratuitously. "Use" covers any application of the information toward harmful or fraudulent ends, including applying for credit, opening accounts, filing tax returns, obtaining medical services, or impersonating the victim in any setting where the identifying information matters.

The mens rea — intent to harm or defraud — is the contested element. Texas Penal Code § 6.03(a) defines intentional conduct as acting with the conscious objective or desire to engage in the conduct or cause the result. To prove § 32.51, the State must show that the defendant's conscious objective at the time of the act was to harm or defraud another person. The harm need not be financial — though it usually is — and the fraud need not be successfully completed; intent at the time of obtaining or possessing is enough. Defense challenges to the intent element are common where the defendant came into possession of identifying information through legitimate means (a stored medical record, an old employer's file, a family member's document) and where the State's circumstantial proof of harmful or fraudulent purpose is thin.

The "without consent" element matters where the defendant claims authorized possession or use. Some categories of identifying information are routinely shared with limited consent — a credit-card account number provided for a single transaction, a SSN provided to one institution, biometric data captured for one purpose. Where the defendant's use exceeded the scope of consent, the State must prove that the actual use was unconsented. Where the defendant had broader consent than the State acknowledges (a domestic partner with authorized account access, a business partner with credentials, an heir with rights to a deceased relative's records), the consent issue can defeat the prosecution outright.

Cortez v. State, 469 S.W.3d 593 (Tex. Crim. App. 2015), is the contemporary workhorse decision on § 32.51 elements. The Court held that the State must connect possession of the identifying information to the harmful or fraudulent intent through evidence supporting a rational inference — possession alone, without circumstantial indicia of fraudulent purpose, is not enough. Espinosa v. State, 463 S.W.3d 887 (Tex. App.—Houston [14th Dist.] 2015, pet. ref'd), addressed the item-counting methodology — clarifying that each discrete piece of qualifying information counts separately even where multiple items relate to one victim. Together these decisions establish the core framework: prove possession or use, prove the intent at the time of the act, and prove each item separately for grading purposes.

What counts as identifying information ?

Section 32.51(a)(1) defines "identifying information" broadly — name and date of birth, biometric data, electronic identification numbers, account numbers, telecommunication identifiers, Social Security numbers. Each discrete piece counts as one "item" for grading purposes.

The breadth of § 32.51(a)(1) is striking. The statute defines "identifying information" as "information that alone or in conjunction with other information identifies a person, including: (A) name and date of birth; (B) unique biometric data, including fingerprint, voice print, or retina or iris image; (C) unique electronic identification number, address, routing code, or financial institution account number; (D) telecommunication identifying information or access device; and (E) Social Security number or other government-issued identification number." The catch-all phrase — "information that alone or in conjunction with other information identifies a person" — captures essentially any data point that links to a real individual.

The breadth of the definition makes item-counting a strategic battleground. The defense routinely challenges the State's item count by arguing that certain pieces of data do not qualify as "identifying information" in their own right, or that closely related pieces should be counted together rather than separately. For example, a person's name and date of birth jointly identify the person, but each is separately listed in § 32.51(a)(1)(A) — does the State count them as one item or two? The case-law answer in Espinosa and similar decisions is that they count separately. But the defense can still argue counting issues where the State has aggregated minor data points to inflate the grade.

Practical examples of item counting in real cases: a defendant possesses a stolen wallet containing a driver's license (one item — the government-issued ID number); a Social Security card (one item — the SSN); a debit card (one item — the account number); a health-insurance card with a member number (one item); and a business card with the cardholder's phone number (this may or may not count, depending on whether the phone number is treated as "telecommunication identifying information"). A single wallet can easily contain 5-9 items, pulling the offense from state-jail to 3rd-degree felony. A defendant who possesses identifying information of multiple victims accumulates items rapidly — five items of one victim and five items of another is 10 items total, pushing the offense to 2nd-degree.

Cortez v. State, 469 S.W.3d 593 (Tex. Crim. App. 2015), is the lead Texas Court of Criminal Appeals decision on what evidence proves the identifying-information element. The Court held that the State must prove each item of identifying information separately — bald conclusions in police reports do not substitute for evidentiary proof. Espinosa v. State, 463 S.W.3d 887 (Tex. App.—Houston [14th Dist.] 2015, pet. ref'd), refined the analysis with attention to duplicate items, partial items, and items pertaining to multiple victims. The defense develops the item-count record in pretrial motions and at the indictment-quashing phase where the State has overreached on item counting; at trial, the defense cross-examines the State's witnesses on each claimed item, and the jury instruction reflects the item count that the evidence actually supports.

Elderly enhancement and aggregation

Section 32.51(c-1) raises the offense one degree if the victim was elderly (65+). Section 32.51(b-1) supplies the aggregation rule — each item counts separately. The combined effect can promote a state-jail floor to a 3rd-degree, or a 2nd-degree to a 1st-degree with a 15-year minimum.

The elderly enhancement under § 32.51(c-1) is the most consequential single statutory lever in § 32.51 prosecutions. The subsection provides that the offense is increased to the punishment for the next higher category if it is shown on the trial of the offense that the victim was an elderly individual. "Elderly individual" is defined by Penal Code § 22.04(c)(2) as a person 65 years of age or older. The enhancement applies regardless of whether the defendant knew the victim's age — strict-liability on that element, as Texas courts have consistently held in analogous contexts. The State proves the victim's age through documentation (driver's license, identification card, birth certificate, hospital records) and through victim testimony at trial.

The enhancement ladder cascades: a state-jail felony (default for under 5 items) becomes a 3rd-degree felony (2-10 years); a 3rd-degree becomes a 2nd-degree (2-20 years); a 2nd-degree becomes a 1st-degree (5-99 years or life); and a 1st-degree becomes a 1st-degree with a 15-year minimum under § 32.51(c-1)(4). The 15-year-minimum tier at the top is the most severe single enhancement structure in Texas property-offense law — it tracks the murder sentencing range with an elevated floor. Defense work in cases with elderly victims focuses heavily on the enhancement: confirming the victim's actual age (driver's license records, birth records), challenging the State's proof if any element is contested, and developing a punishment-phase strategy that accounts for the elevated exposure.

The aggregation rule under § 32.51(b-1) — each item counts separately — combines with the elderly enhancement in particularly damaging ways. A defendant alleged to possess 50 or more items of identifying information of an elderly victim is staring at a 1st-degree felony with a 15-year mandatory minimum. The defense response is item-by-item, challenging each claimed item, contesting duplicate or borderline items, and pushing the item count below the next tier threshold wherever possible. Moving the count from 50 to 49 drops the offense from § 32.51(c-1)(4) (1st-degree with 15-year minimum) to § 32.51(c-1)(3) (1st-degree, 5-99 with no statutory floor above the ordinary 1st-degree 5-year minimum) — a 10-year difference at sentencing. Moving the count from 10 to 9 drops the offense from § 32.51(c)(3) + enhancement (2nd-degree promoted to 1st-degree under elderly) to § 32.51(c)(2) + enhancement (3rd-degree promoted to 2nd-degree) — five years saved in maximum exposure.

Other Texas enhancement provisions can also stack. The § 12.42 repeat-offender provisions apply to identity-theft convictions — a defendant with one prior felony faces enhanced punishment, and a defendant with two or more prior felonies of the relevant categories faces habitual-offender exposure (25-99 years or life on any conviction at 2nd-degree or higher). The federal forum supplies its own enhancement structure under 18 U.S.C. § 1028 and § 1028A — § 1028A imposes a mandatory consecutive two-year sentence regardless of the predicate offense's sentencing range, and the federal Sentencing Guidelines include item-count enhancements and victim-count enhancements that can materially elevate the advisory range above the statutory floor.

Defense strategies for identity theft cases

Identity theft defense centers on the intent element, possession knowledge, item-count challenges, identification disputes, and Fourth Amendment suppression of digital evidence. Federal companion charges add Flores-Figueroa knowledge defenses for § 1028A.

The intent-to-harm-or-defraud element is the most contested ground in § 32.51 trials. Mere possession of identifying information is not the offense — the State must prove the defendant's harmful or fraudulent intent at the time of obtaining, possessing, transferring, or using the information. The defense develops record evidence supporting an alternative explanation: lawful possession (an inherited document, a misdelivered piece of mail in the process of being returned, an old employer's record that the defendant never destroyed), educational purpose (a privacy researcher studying breach data, a journalist investigating fraud), satirical or expressive use (an obvious joke, a parody, a fictional character), or simple ignorance that the items were identifying information (electronic files received from a third party whose contents the defendant never reviewed).

Possession-knowledge defenses also matter. To possess an item of identifying information for § 32.51 purposes, the defendant must have care, custody, control, or management of the item with knowledge of what the item is. A defendant who received a sealed envelope containing identifying information without knowledge of the contents has a strong knowledge defense. A defendant whose computer or storage device contained identifying information loaded by another user without his knowledge has a similar defense. Forensic-computing analysis of the device — examining file metadata, access logs, user accounts, and last-modified timestamps — often supports the knowledge defense by showing that the defendant did not access or use the data after receipt.

Item-count challenges are the workhorse defense at the grading level. Even where the State can prove the underlying offense, the defense can often reduce the grade by challenging individual items. Duplicate items (two photographs of the same SSN card), partial items (a name without a date of birth, a routing number without an account number), questionable items (information that does not in fact identify a person without supplementation), and items pertaining to fictional or non-existent persons (where the State must prove the items belong to an actual person under Flores-Figueroa for federal companion charges) all give the defense room to push the count below the next tier threshold. Moving from 50 to 49 items saves a decade of maximum exposure; moving from 10 to 9 saves five years.

Identification challenges remain available. The State must prove that the defendant — this defendant, not someone else — committed the offense. In digital cases, this often means proving who was at the keyboard, whose account was used, and who had access to the device at the relevant time. Eyewitness identification is rare in identity-theft cases; the State usually relies on circumstantial evidence connecting the defendant to the digital footprint. The defense challenges that connection through forensic-computing analysis, alternative-user theories, and where applicable, alibi evidence placing the defendant elsewhere at the time of the relevant electronic transaction.

Fourth Amendment suppression is often dispositive. Identity-theft cases routinely involve searches of computers, phones, cloud accounts, email, and online services — each governed by Fourth Amendment standards specific to the medium. Riley v. California, 573 U.S. 373 (2014), held that cell phone searches incident to arrest require a warrant; Carpenter v. United States, 138 S. Ct. 2206 (2018), extended Fourth Amendment protection to historical cell-site location information. State v. Granville, 423 S.W.3d 399 (Tex. Crim. App. 2014), applied Riley to Texas state practice. Where the State's evidence flows from a digital search executed without a valid warrant, in violation of warrant scope, or based on stale or facially deficient affidavits, suppression can eliminate the State's case.

Federal companion charges under 18 U.S.C. § 1028 add another defense layer. The federal aggravated-identity-theft statute § 1028A requires that the defendant "knowingly" use a means of identification "of another person." Flores-Figueroa v. United States, 556 U.S. 646 (2009), held that "knowingly" modifies "of another person" — the government must prove the defendant knew the means of identification actually belonged to another real person. A defendant who used a fabricated SSN believing it was made up — and not connected to any real person — has a Flores-Figueroa defense to § 1028A even where the SSN turned out to coincidentally belong to someone. The two-year mandatory consecutive sentence on § 1028A makes this defense a critical lever when both state and federal forums are in play.

Charge-bargaining between state and federal forums is its own defense lever. Where conduct could be charged under both § 32.51 and § 1028/§ 1028A, defense counsel evaluates the comparative exposure: state 1st-degree (5-99) versus federal predicate plus mandatory consecutive § 1028A two years. The forums have different sentencing structures, different parole/supervised-release rules, different cooperation incentives (federal § 5K1.1 substantial-assistance departure versus state plea negotiations), and different collateral consequences. In appropriate cases, counsel works to resolve the matter in one forum to eliminate exposure in the other — a state plea that resolves the conduct can sometimes preclude later federal prosecution under double-jeopardy principles or DOJ Petite policy, and vice versa.

Federal companion charges — § 1028 and § 1028A

Federal identity theft under 18 U.S.C. § 1028 and aggravated identity theft under § 1028A both criminalize use of another person's identifying information. Section 1028A adds a mandatory consecutive 2-year prison term. Flores-Figueroa requires proof the defendant knew the identification belonged to a real person.

Federal prosecution under 18 U.S.C. § 1028 (Identity Theft and Assumption Deterrence Act) is increasingly common in DFW federal practice, particularly in cases involving interstate or international fraud, data-breach proceeds, and federal benefits fraud. Section 1028(a) criminalizes a range of conduct: producing identification documents, transferring them, possessing them in connection with unlawful activity, possessing document-making implements, and trafficking in authentication features. The standard offense carries up to 15 years in federal prison, with enhanced exposure for terrorism, drug trafficking, or organized criminal enterprise predicates.

The companion aggravated-identity-theft statute under 18 U.S.C. § 1028A is the more important federal lever in identity-theft cases. The statute imposes a mandatory consecutive two-year prison term — meaning two years on top of whatever sentence is imposed on the underlying predicate offense, and not eligible for concurrent service. The list of predicate offenses is enumerated in § 1028A(c) and includes mail fraud, wire fraud, bank fraud, immigration document fraud, Social Security fraud, and a dozen others. To trigger § 1028A, the defendant must, "during and in relation to" the predicate offense, knowingly transfer, possess, or use, without lawful authority, a means of identification of another person.

Flores-Figueroa v. United States, 556 U.S. 646 (2009), is the dispositive Supreme Court decision on § 1028A scienter. The defendant, a Mexican national, had used another person's name and SSN to obtain employment in the United States. He argued that he had not known the SSN belonged to a real person — he believed the number had been fabricated. The Government argued that "knowingly" in § 1028A modified only the verbs (transfer, possess, use) and not the phrase "of another person." A unanimous Supreme Court held the opposite: "knowingly" modifies every element that follows, including "of another person." To convict, the Government must prove the defendant knew the means of identification actually belonged to a real person.

The Flores-Figueroa defense is one of the most useful single levers in federal identity-theft practice. A defendant who used a fabricated identifier — believing it to be made up, even if the number happened to belong to a real person — has a complete defense to the § 1028A two-year mandatory sentence. The defense develops the knowledge issue through evidence about how the defendant obtained the identifier (from a fake-ID vendor, from a website selling random number generators, from a co-conspirator who said the numbers were fabricated), through evidence of the defendant's subjective belief, and through cross-examination of the Government's witnesses on how they identified the underlying victim. The case can still proceed on the predicate offense, but defeating the § 1028A two-year add-on materially changes the sentencing exposure.

Federal sentencing on § 1028 cases also runs under the U.S. Sentencing Guidelines § 2B1.1 framework for economic crimes, with enhancements for loss amount, number of victims, sophisticated means, abuse of position of trust, and use of identification documents. The Guidelines also include § 2L2.1 for unlawful production of identification documents and § 2L2.2 for fraudulent procurement of identification documents. Federal defense counsel develops the Guidelines analysis carefully — a § 1028 case with a 6-level loss enhancement, a 2-level enhancement for ten or more victims, and a 2-level enhancement for sophisticated means rapidly produces advisory Guidelines ranges in the 24-37 month range or higher, before any departures or variances. Sentencing strategy in federal identity-theft cases is its own significant subspecialty within federal criminal defense.

Local DFW identity-theft practice

DFW identity-theft prosecutions cluster in three patterns — data-breach proceeds purchased through dark-web markets, mail-theft and dumpster-diving rings, and tax-return fraud schemes. Collin and Dallas DA offices both have dedicated identity-theft units; federal prosecutors in TXED and TXND share parallel jurisdiction.

Identity-theft prosecutions in the four-county DFW metroplex (Collin, Dallas, Denton, Tarrant) cluster around a recognizable set of fact patterns. The first is data-breach-derived possession: a defendant arrested with credit-card numbers, SSNs, or full identity packages purchased from dark-web marketplaces (Genesis Market, Joker's Stash, Russian Market, and successor sites) that resell breach proceeds. These cases routinely involve identifying-information of 50+ victims and naturally trigger 1st-degree felony grading. Federal companion charges under § 1028 and § 1028A are nearly automatic in these cases because of the interstate-commerce element implicit in dark-web purchases.

The second pattern is mail-theft and dumpster-diving — a defendant or small group steals mail from residential or business locations, harvests bank statements, credit-card offers, tax documents, and similar items, and then uses or transfers the identifying information. These cases tend to be locally generated, often involving suspects with prior theft or fraud convictions, and frequently resolve at the state level under § 32.51 without federal involvement. Collin County and Dallas County DA offices both have dedicated identity-theft units that handle these cases — Collin County's consumer-protection division and Dallas County's economic-crimes division each have specialist prosecutors who track local patterns.

The third pattern is tax-return fraud — a defendant uses stolen identifying information to file fraudulent federal tax returns and divert refunds to accounts under the defendant's control. These cases are almost always federally prosecuted because of the IRS-victim nexus and the wire-fraud / mail-fraud predicates. The aggravated-identity-theft enhancement under § 1028A applies to nearly every tax-fraud case involving stolen identifiers, adding the mandatory two-year consecutive prison term to the underlying wire-fraud or mail-fraud sentence. DOJ-Tax and the local U.S. Attorney's Offices in TXND (Dallas) and TXED (Plano/Sherman) handle these cases through Operation Mass Marketing Fraud and similar initiatives.

Defense counsel familiar with each forum's practices, judges, and prosecutors makes a measurable difference in case outcomes. Collin County state court — Plano and surrounding — operates under specific local rules and discovery practices that differ from Dallas County and Tarrant County. Federal practice in TXND-Dallas and TXED-Plano involves different judges, different magistrate procedures, and different U.S. Attorney's Office practices. The Federal Public Defender's Office for the Northern District of Texas (FPD-NDTX) and the Court-Appointed Counsel Panel for TXED both maintain experienced identity-theft and fraud defenders; retained counsel familiar with these forums can navigate the local culture effectively and identify resolution paths that out-of-area counsel might miss.

When to retain counsel

Identity-theft investigations often begin long before arrest — through bank fraud alerts, IRS audits, credit-bureau disputes, and federal investigative subpoenas. Retain counsel as soon as you have any indication of an identity-theft investigation, even before charges are filed.

Identity-theft investigations often run for months or years before charges are filed. The investigative footprint includes IRS audit notices, bank fraud-alert calls, credit-bureau dispute correspondence, federal investigative subpoenas served on banks or financial institutions, and informal contacts from federal agents (Secret Service, FBI, U.S. Postal Inspection Service, IRS-CI). Each of these is a meaningful signal that an investigation is open, and the appropriate response is to retain defense counsel before responding to any of them — particularly before any in-person interview, written statement, or document production.

Counsel's early work includes asserting the Fifth Amendment at any interview opportunity, declining voluntary subpoena compliance where applicable, evaluating proffer-letter (or "queen for a day") opportunities carefully, and preserving exculpatory evidence on the defendant's own devices and accounts. Bank statements, employment records, communications with alleged co-conspirators, device-access logs, and similar material can become critical to the intent-element defense — but only if preserved before normal retention periods expire. Counsel also evaluates joint-defense or common-interest agreements with other potential defendants where appropriate, and works the prosecutor relationship to understand whether the defendant is a target, a subject, or merely a witness.

At the post-charge phase, counsel's work includes bond posture (Texas identity-theft bonds range from $10,000 for state-jail felony cases to $100,000+ for 1st-degree cases involving elderly victims; federal bond depends on Bail Reform Act factors and the magistrate's findings), Article 39.14 (state) or Rule 16 (federal) discovery, motion-to-suppress practice on digital evidence and other Fourth Amendment grounds, item-count challenges at the indictment-quashing or charge-conference phases, and plea-negotiation positioning. Federal cases additionally involve Sentencing Guidelines analysis under § 2B1.1, departure and variance posture, and cooperation evaluation under § 5K1.1 where appropriate.

Time is the single most valuable asset in identity-theft defense. Cases handled early — with prompt evidence preservation, prompt motion practice, and prompt forensic-computing analysis — produce materially better outcomes than cases where the defense entered late. A 50-item 1st-degree felony case that the defense reduces to a 9-item 3rd-degree felony through aggressive item-count challenges and Fourth Amendment suppression has dropped the maximum exposure from 99 years to 10 years, and probability of community supervision has risen from negligible to substantial. Early counsel is the single most consequential decision a defendant facing identity-theft exposure can make.