Federal aggravated identity theft under 18 U.S.C. § 1028A carries a mandatory two-year consecutive sentence that stacks on top of the underlying offense, with no judicial discretion to run it concurrently. When paired with wire fraud or healthcare fraud, a single case can produce 15 to 20 years in mandatory federal time.
Federal identity theft cases are rarely just identity theft cases. In the Southern District of Florida, § 1028A is the charge prosecutors add to wire fraud indictments, healthcare fraud cases, immigration prosecutions, and access device fraud conspiracies. It is the mechanism by which a case that might otherwise resolve at 24 months becomes a 26-month sentence, or a case resolving at 5 years becomes 7, or 10 years becomes 12.
The mandatory consecutive nature of § 1028A has no parallel in federal sentencing. Every other sentence can be varied, reduced by cooperation, or addressed through the guidelines, but the § 1028A mandatory two years runs after everything else, cannot be suspended, and cannot be avoided without defeating the charge outright. This is why the fight against § 1028A must happen at the charging stage or at trial, not at sentencing.
Healthcare fraud cases are the most common vehicle. When a physician, billing company, or clinic submits false Medicare or Medicaid claims using real patient identifying information, prosecutors add § 1028A counts based on each patient whose information appeared on a fraudulent claim. A single healthcare fraud scheme involving 50 patients could generate 50 § 1028A counts, 100 mandatory years stacked on top of the fraud sentence.
BEC and wire fraud cases frequently involve spoofed email addresses, fabricated executive identities, and vendor impersonation using real employees' names. Each email or financial transaction using a real person's identifying information is a potential § 1028A count.
Immigration cases involving unauthorized workers using borrowed or purchased Social Security numbers. Post-2024, SDFL prosecutions have specifically targeted employers who knowingly benefited from workforce identity fraud.
Access device fraud involving credit card skimming, dark web card trading, and account takeover schemes, all federal felonies that trigger § 1028A when a real cardholder's account information is used.
Dubin analysis first. The Supreme Court's 2023 decision in Dubin v. United States is the most significant narrowing of § 1028A in the statute's history. We evaluate every § 1028A count against the Dubin standard: was the use of the victim's identity truly at the crux of the crime, or was it merely incidental to the predicate offense? When Dubin applies, entire batteries of counts fall away, and with them, years of mandatory consecutive time.
Challenging the predicate offense. If the underlying felony is defeated, § 1028A cannot stand. We pursue full acquittal on predicate charges, wire fraud, healthcare fraud, access device fraud, which eliminates the aggravated identity theft counts entirely.
Contesting the "real person" element. Section 1028A requires that the means of identification belong to another actual person. Synthetic identities, fabricated composites, and deceased individuals' information raise genuine legal questions about whether this element is satisfied. We litigate these issues aggressively.
Negotiating § 1028A dismissal in plea agreements. Even when the predicate case will resolve through a plea, we negotiate specifically for the dismissal of § 1028A counts as part of the agreement. Avoiding even one § 1028A count saves two mandatory years. In cases with multiple counts, the difference can be a decade.
Identity fraud under 18 U.S.C. § 1028 is the base offense, unlawfully producing, possessing, or using identification documents or authentication features. It carries up to 15 years and allows judicial discretion in sentencing. Aggravated identity theft under 18 U.S.C. § 1028A is triggered when a defendant knowingly uses, without lawful authority, a means of identification belonging to another real person during the commission of a predicate felony. The § 1028A sentence is two years, mandatory, and must run consecutively, the judge has no power to reduce it, run it concurrently, or apply a variance. It is one of the most mechanically severe sentencing provisions in federal law.
Section 1028A applies when the identity theft occurs in connection with certain enumerated federal felonies, including wire fraud, bank fraud, healthcare fraud, mail fraud, access device fraud, immigration offenses, theft from the government, and terrorism-related offenses. Prosecutors routinely add § 1028A counts to wire fraud, healthcare fraud, and immigration cases because it is easy to prove and forces a minimum 2-year add-on with no judicial relief available. A defendant facing wire fraud plus 10 § 1028A counts could be looking at 20 mandatory consecutive years before the fraud sentence is even calculated.
The Supreme Court's 2023 decision in Dubin v. United States significantly narrowed the scope of § 1028A. The Court held that aggravated identity theft requires more than merely using a victim's information in connection with a predicate offense, the use of the means of identification must be at the crux of the underlying crime, not a minor or incidental element. This ruling has opened new defense arguments in healthcare fraud cases where patient information was used in billing, but the use was not central to the fraud itself. We evaluate Dubin arguments in every § 1028A case.
Undocumented individuals who use another person's Social Security number, name, or other identifying information to obtain employment or government benefits are frequently charged with both § 1028A and immigration offenses. Federal prosecutors in SDFL have brought these cases aggressively since 2024. A conviction on § 1028A is an aggravated felony under immigration law, meaning mandatory removal, permanent bar from re-entry, and no relief in immigration court. The criminal defense strategy in these cases must account for immigration consequences from the first meeting.
Synthetic identity fraud involves creating a new identity by combining a real Social Security number (often belonging to a child, elderly person, or deceased individual) with fabricated name and date of birth information. It is the fastest-growing type of financial fraud in the United States. Whether § 1028A applies to synthetic identity fraud is contested, because the identity is partially fabricated, courts have divided on whether a 'real person' victim exists within the meaning of the statute. We have successfully argued that § 1028A does not apply to synthetic identity cases in appropriate circumstances.
Base identity fraud under 18 U.S.C. § 1028 carries up to 15 years per count, with guidelines sentencing under USSG § 2B1.1 driven by the loss amount and number of victims. The mandatory minimum sentence comes from § 1028A: every § 1028A count adds 2 years consecutive (5 years if terrorism-related), with no judicial discretion to reduce, suspend, or run concurrently. A defendant with five § 1028A counts is facing a minimum 10 years before the underlying offense (wire fraud, healthcare fraud) is sentenced. In SDFL, the typical aggravated identity theft case involves 5 to 20 § 1028A counts, producing mandatory minimum exposures of 10 to 40 years that prosecutors use as charging leverage. Negotiating dismissal of even one or two § 1028A counts can save years of mandatory time.
Section 1028A requires that the defendant 'knowingly transferred, possessed, or used, without lawful authority, a means of identification of another person.' The Supreme Court's 2009 decision in Flores-Figueroa v. United States held that 'knowingly' modifies every element, including knowledge that the means of identification belonged to another real person. This is the critical defense theory: where the defendant believed the identifying information was fabricated, fictitious, or assigned to no one in particular (the typical fact pattern in synthetic identity cases), the knowing element is not satisfied. Prosecutors prove knowledge through circumstantial evidence: the defendant's payment for stolen PII, communications with sellers, or use of the information in ways that confirm awareness of real-person status. Defense work focuses on building the alternative narrative of inadvertent or unwitting use.
18 U.S.C. § 1029 prohibits trafficking in or using counterfeit, unauthorized, or stolen access devices, credit cards, debit cards, account numbers, PINs, electronic serial numbers, mobile authentication codes, and similar credentials. Penalties run from 10 to 20 years per count depending on subsection, with multiple counts for each transaction. Section 1029 frequently appears in indictments alongside identity theft and wire fraud in cases involving credit card fraud, dark-web marketplace activity, BIN attacks, and account takeover schemes. The aggravated identity theft enhancement (§ 1028A) applies to § 1029 violations, adding 2 mandatory consecutive years for each victim whose information was used. § 1029 prosecutions are increasing in SDFL, particularly in cases involving crypto-funded purchases of stolen PII from dark-web vendors.
Several recur. **Flores-Figueroa knowledge challenges** target the § 1028A 'knowingly belongs to another real person' element, particularly in synthetic identity cases. **Dubin v. United States (2023)** narrows § 1028A to cases where the use of the means of identification was at the crux of the underlying offense, not merely incidental, frequently dispositive in healthcare and tax fraud cases. **Authorization defenses** apply where the defendant had explicit or apparent authority to use the identifying information, joint account holders, family members managing accounts of relatives, business partners. **Identity attribution challenges** contest whether the defendant, rather than someone else with access to the relevant devices or accounts, performed the alleged conduct. **Loss calculation challenges** attack the multiplier effect of victim counts and aggregated loss in determining the guidelines range.
No. Identity theft and access device fraud are jurisdictionally split between the Secret Service (financial crimes, credit card fraud) and the FBI (broader identity fraud, cyber-enabled fraud). By the time either agency approaches you, they have typically already obtained the financial records, IP logs, transaction histories, and dark-web marketplace data that support the case. The interview's purpose is to capture admissions about whose information you knew you were using, where you obtained credentials, and your understanding of the victim's status, all of which become direct evidence of the knowing element required under § 1028A. Decline politely, take the agents' contact information, and call counsel before responding to any further requests. Federal identity theft cases are document-heavy, and the documents have already been collected; what the government wants from you is admissions to add to the file.
Stolen Identity Refund Fraud (SIRF) involves filing fraudulent federal tax returns using real taxpayers' names and Social Security numbers to claim refunds, which are then deposited to prepaid debit cards, controlled bank accounts, or cryptocurrency wallets. The IRS Criminal Investigation division and DOJ Tax Division prosecute SIRF cases jointly. Typical charges include 18 U.S.C. § 286 (conspiracy to defraud the United States), 18 U.S.C. § 287 (false claims), 18 U.S.C. § 1028A (aggravated identity theft, 2 years mandatory consecutive per victim), and 18 U.S.C. § 1343 (wire fraud). SDFL is one of the top three SIRF prosecution districts because of the volume of stolen PII processed through South Florida and the historical concentration of refund-fraud rings in Miami-Dade. Loss calculation under USSG § 2B1.1 drives the guidelines, and the § 1028A counts produce massive mandatory exposure. Dubin v. United States (2023) provides defense leverage where the use of identifying information was incidental to the tax fraud rather than central to it.
Federal restitution in identity theft cases is mandatory under the Mandatory Victim Restitution Act, 18 U.S.C. § 3663A. Courts must order restitution covering: actual financial losses sustained by each victim, costs of credit monitoring and credit restoration, attorney fees incurred by victims to clear their records, time lost from work addressing the consequences, and any other expenses reasonably necessary to remediate the identity theft. In multi-victim cases, restitution can reach hundreds of thousands of dollars per defendant and is joint and several with co-conspirators. Restitution survives bankruptcy under 11 U.S.C. § 523(a)(7) and accrues post-judgment interest. The Bureau of Prisons enforces collection through the Inmate Financial Responsibility Program, and unpaid restitution affects supervised release conditions for years. Defense work focuses on contesting victim loss claims, challenging causation, and identifying losses better attributed to other actors in the scheme.
Yes. 18 U.S.C. § 1028(a)(3) prohibits the knowing possession, with intent to use unlawfully, of five or more identification documents or means of identification belonging to other persons. The threshold of five triggers federal jurisdiction. Mere possession with criminal intent, even without any actual use, is the completed offense. Dark-web purchases of PII, 'fullz' packages containing name, SSN, date of birth, and account credentials, are routinely charged under § 1028(a)(3) along with conspiracy and access device fraud. The Secret Service and FBI build cases through marketplace infiltration, undercover purchases, and seizure of forum servers. The defense battle is over the 'intent to use unlawfully' element: prosecutors infer intent from quantity, organization, payment method, and surrounding communications, but ambiguous possession by individuals not yet active in fraud can be litigated as research, curiosity, or untested acquisition.
Insider data theft is one of the fastest-growing federal identity theft prosecution categories. Bank tellers, hospital billing staff, government clerks, call center employees, and IT contractors who access and exfiltrate customer or patient PII from authorized systems face stacked charges: 18 U.S.C. § 1028(a)(7) (transferring or using means of identification without authority), 18 U.S.C. § 1028A (aggravated identity theft, 2 years mandatory consecutive), 18 U.S.C. § 1030(a)(2) (CFAA, obtaining information from a protected computer), and frequently HIPAA criminal violations (42 U.S.C. § 1320d-6) when health information is involved. Post-Van Buren v. United States (2021), CFAA exposure is limited where the employee had technical authorization to the underlying database, but the identity theft, fraud, and HIPAA charges remain. Sentencing is driven by victim count and downstream fraud loss, which prosecutors aggressively aggregate under USSG § 2B1.1.
Pandemic-era unemployment fraud and ongoing EBT/SNAP benefits fraud have produced a wave of federal identity theft prosecutions. Schemes typically involve filing benefits applications using stolen PII, routing payments to prepaid cards or controlled accounts, and laundering proceeds through retail purchases or cash withdrawals. Federal charges stack quickly: 18 U.S.C. § 641 (theft of government property), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1028A (aggravated identity theft, 2 years mandatory consecutive per real victim), and 18 U.S.C. § 1956 (money laundering). SDFL benefits fraud indictments since 2022 have alleged losses ranging from hundreds of thousands to tens of millions, with USSG § 2B1.1 sentencing driven by total loss and victim count. The Dubin v. United States (2023) holding has narrowed § 1028A application where the use of victims' identities was a peripheral mechanism rather than central to the fraud, we evaluate Dubin viability in every benefits fraud case.
AI voice-clone scams make headlines, but charging papers rarely allege AI. What 18 U.S.C. 1343, 1028A and Florida law mean for people under investigation.
DOJ charged 27 people in 18 days for voting or registering as noncitizens. Most held green cards. Florida referred 170 names. The window is pre-indictment.
Medicare scam calls are surging. Buying one beneficiary ID number is a 10-year federal felony even if no claim is billed. Here is where the charges land.
An Ohio clinic lost its drug license over orders placed on nurse practitioners' NPI numbers. Two findings are federal, and one adds two mandatory years.
FLHSMV never texts drivers demanding payment. If you moved money or opened an account for someone you met online, the federal exposure lands on you first.
A Miami federal grand jury has charged the sale of Medicare beneficiary identifiers as a standalone crime. If you work inside a clinic, billing company, or provider network, this case is a direct warning.
Wire fraud under 18 U.S.C. § 1343 is one of the most frequently charged federal crimes, and one of the most flexible tools in a federal prosecutor's toolkit. Any scheme to defraud that uses a wire communication crosses into federal jurisdiction. The penalty is up to 20 years per count.
Federal cybercrime charges under the Computer Fraud and Abuse Act carry up to 10–20 years per count. If the FBI has executed a search warrant or reached out to you, the investigation is already advanced. You need defense counsel who understands both the law and the technology.
Federal bank fraud under 18 U.S.C. § 1344 carries 30 years per count, among the highest maximum penalties in white-collar federal law. Mortgage fraud schemes in South Florida frequently involve multiple properties, multiple counts, and loss calculations that drive guidelines ranges far beyond what prosecutors publicly state in charging documents.
Federal money laundering charges under 18 U.S.C. § 1956 carry up to 20 years per count. When federal prosecutors target financial transactions in South Florida, you need defense counsel who knows exactly how they build these cases, and how to dismantle them.