Identity Theft and CFAA Overlap

The overlapping statutory framework for identity theft and CFAA

Federal identity theft is criminalized under 18 U.S.C. Section 1028 and aggravated identity theft under 18 U.S.C. Section 1028A. The provisions reach the use of another person identifying information without authorization in connection with various federal offenses. The Computer Fraud and Abuse Act at 18 U.S.C. Section 1030 reaches unauthorized access to protected computers. The two frameworks overlap substantially in cases where unauthorized access produces identity theft, and prosecutors typically charge both statutes when both elements are present.

Identity theft under Section 1028(a)(7) reaches knowingly transferring, possessing, or using a means of identification of another person without lawful authority with the intent to commit, aid, or abet, or in connection with any unlawful activity that constitutes a violation of federal law or a state law felony. The provision has broad reach because it applies to identification used in connection with virtually any federal or felony state offense. The penalty structure includes up to fifteen years for the most serious offenses.

Aggravated identity theft under Section 1028A imposes a mandatory two-year consecutive sentence when the defendant knowingly uses another person identification in connection with enumerated felony offenses. The mandatory consecutive nature means that the two-year sentence is added to whatever underlying sentence the defendant receives for the connected offense. The Section 1028A enhancement can substantially increase the total sentencing exposure and is a frequent focus of plea negotiations.

The Dubin decision and the connection requirement

The Supreme Court decision in Dubin v. United States, 599 U.S. 110 (2023), substantially narrowed the application of Section 1028A. The Court held that the use of another person identification must be in connection with the predicate offense in a specific way involving the identification being at the crux of the offense. Mere incidental use of identification in connection with an offense does not trigger the mandatory consecutive sentence.

The Dubin framework requires the identification use to be central to the offense rather than merely related to it. A medical provider who fraudulently bills for services using a patient identification number engages in central use of the identification because the billing depends on the identification. A defendant who uses a name to identify himself during a crime does not engage in central use because the identification is incidental to the underlying offense.

The Dubin defense application requires careful analysis of the specific role the identification played in the alleged offense. The defense should identify the specific identification at issue, the specific use the defendant made of it, and the specific connection between the use and the predicate offense. The defense can challenge the centrality of the identification through factual development and legal argument. The Dubin defense can eliminate the mandatory consecutive sentence even where the underlying offense is otherwise established.

Identity theft enabled by CFAA violations

The combination of CFAA and identity theft charges is common in cases involving database breaches, account takeover schemes, and other forms of computer-enabled identity theft. The CFAA charges address the unauthorized access component, and the identity theft charges address the use of obtained identification. The combined charges can produce substantial sentencing exposure that exceeds the exposure under either statute alone.

The Van Buren framework affects the CFAA portion of these cases substantially. Cases involving insider access to identification databases for improper purposes may have CFAA defenses under Van Buren even where the identity theft charges are clearly established. The defense should evaluate the CFAA charges under the Van Buren framework while also developing the identity theft defenses on their own merits.

The defense strategic considerations include the relative importance of defeating each category of charge. The CFAA charges typically carry lower base sentencing exposure than the identity theft charges, but the CFAA conviction can have substantial collateral consequences including effects on technology industry employment. The identity theft charges carry higher base sentencing exposure and the Section 1028A mandatory consecutive sentence. The defense should prioritize the charges that drive the overall exposure while preserving defenses to all charges.

State-law identity theft and the federal-state coordination

Texas state law on identity theft is codified at Texas Penal Code Chapter 32, particularly Section 32.51 (fraudulent use or possession of identifying information). The state framework parallels the federal framework in many respects but has distinct elements and penalty structures. The state provisions can be charged in cases that do not have substantial federal interest or where the federal authorities decline prosecution.

The federal-state coordination in identity theft cases typically involves the federal authorities handling cases with substantial interstate elements, multiple victims, or large losses, while the state authorities handle cases with primarily local impact. The dual-sovereignty principles allow prosecution under both, but coordinated practice typically avoids duplicative prosecution. The defense should understand which forum is likely to handle the case and should develop strategy accordingly.

The negotiated disposition options in identity theft cases include pleas to lesser-included offenses, charge concentration where multiple charges can be reduced to a single count, and elimination of the Section 1028A consecutive sentence in federal cases. The defense should pursue negotiated dispositions that minimize the total exposure across all charges. The Dubin defense provides additional negotiation leverage because the government may agree to drop Section 1028A charges to avoid Dubin litigation. The defense should be familiar with the Dubin application to the specific case and should use the Dubin leverage strategically in the negotiation.

The Identity Theft Enforcement and Restitution Act implications

The Identity Theft Enforcement and Restitution Act of 2008 expanded federal identity theft authority and created specific provisions for restitution to identity theft victims. The Act amended 18 U.S.C. Section 3663(b)(6) to include a broader category of victim losses recoverable through restitution including the value of the time reasonably spent by the victim attempting to remediate the intended or actual harm. The expanded restitution framework substantially affects the long-term financial exposure of defendants in identity theft cases. Restitution can include not only direct losses but also the substantial time and effort that victims spend recovering from identity theft including contacting credit bureaus, freezing accounts, and addressing fraudulent transactions. The defense should evaluate the realistic restitution exposure as part of any plea negotiation, recognizing that the restitution obligation can extend for decades beyond the criminal sentence.