Identity Theft Defense Attorney

Federal Defense for Identity Theft and Account Fraud Charges

Arkady Bukh represents individuals, business owners, executives and international clients facing federal identity theft investigations and related fraud charges.

Identity theft allegations may involve the use of another person’s name, Social Security number, account information, government identification, tax information or online credentials. The government may claim that the information was used to open an account, access money, obtain credit, submit an application, receive a benefit, complete a payment or support another alleged fraud scheme.

A federal investigation may begin with a target letter, grand jury subpoena, request for an interview, search warrant, frozen account or seizure of computers and mobile devices. By the time the client learns about the investigation, agents may already possess account records, electronic communications, login histories, banking documents and information obtained from another alleged participant.

Identity theft cases require more than proof that personal information appeared in a file or transaction. The defense should examine who obtained the information, who controlled the relevant account, whether the client knew that the information belonged to another actual person and how it was allegedly transferred, possessed or used.

Who This Attorney Represents

Arkady Bukh represents clients accused of conduct involving:

Unauthorized use of personal identifying information
Aggravated identity theft
Account takeover
False or altered identification documents
Credit card and access-device fraud
Online applications submitted under another name
Bank, loan, tax or government-benefit fraud
Use of another person’s credentials or account information
Possession or transfer of identifying data
Conspiracy to commit identity theft or fraud

Representation may begin before formal charges are filed and continue through indictment, pretrial proceedings, negotiations, federal trial, sentencing, restitution and forfeiture matters.

What Is Federal Identity Theft?

Identity theft is a broad description that may involve several federal statutes.

Under 18 U.S.C. § 1028(a)(7), the government may allege that a person knowingly transferred, possessed or used, without lawful authority, another person’s means of identification with the intent to commit, aid or abet unlawful activity.

A “means of identification” can include more than a physical identification document. Depending on the allegations, it may involve a name, Social Security number, date of birth, government identification number, financial-account number, electronic identifier, access credential or other information associated with a specific person.

Federal identity theft charges may also concern producing, possessing or transferring false identification documents under other provisions of 18 U.S.C. § 1028.

The statute and elements charged must be identified precisely. The label “identity theft” does not establish which conduct the government must prove.

Aggravated Identity Theft

Aggravated identity theft under 18 U.S.C. § 1028A is a separate federal offense.

The government must generally prove that the defendant, during and in relation to an enumerated felony, knowingly transferred, possessed or used, without lawful authority, a means of identification belonging to another actual person.

The qualifying underlying offense may involve wire fraud, bank fraud, mail fraud, access-device fraud, healthcare fraud, immigration-related fraud, theft of government funds or another offense specifically listed in the statute.

When the requirements of § 1028A(a)(1) are established, the statute provides for a separate two-year prison term that generally must run consecutively to the sentence imposed for the underlying felony.

This additional punishment is not an automatic consequence of every case involving a name, account number or personal record. The prosecution must prove every statutory element.

Knowledge That the Information Belonged to Another Person

For an aggravated identity theft charge, it is not enough for prosecutors to show that the identifying information was false, inaccurate or unauthorized.

The government must prove that the defendant knew the means of identification belonged to another actual person.

This distinction can be important when a case involves:

Invented identifying information
Synthetic identities combining real and false data
Numbers supplied by another participant
Documents that appear genuine but contain inaccurate information
Account credentials received without an explanation of their origin
Information stored in a large database or group of files

The defense should examine what the client was told, what the records showed and whether the evidence establishes knowledge that a real person was connected to the information.

Possession Versus Use of Identifying Information

Federal statutes distinguish among transferring, possessing and using another person’s identifying information.

Alleged Possession

Possession may concern information found:

On a computer or mobile phone
In an email or messaging account
In cloud storage
In a spreadsheet or database
On a physical identification document
In printed financial records
In a shared business system

The presence of personal information on a device does not automatically establish knowing possession.

A file may have been downloaded automatically, received through a group message, stored in a synchronized folder or placed on a shared device by another user. Investigators should determine whether the client knew the information was present and exercised control over it.

Alleged Use

Use generally requires more than the incidental appearance of another person’s name or identifying number in a transaction.

The Supreme Court has held that, for aggravated identity theft, the misuse of another person’s means of identification must be central to what makes the underlying conduct criminal. Merely including a person’s name or number as an ancillary feature of a payment or billing process does not automatically establish aggravated identity theft.

The defense should ask:

Was the client pretending to be another person?
Was the identity used to gain access to that person’s account?
Was the identity itself used to deceive a bank, business or government agency?
Was the identifying information merely included in an otherwise disputed transaction?
Did the client possess the information without ever putting it to use?
Can the government connect the alleged use to the client personally?

The difference between possession and use may affect the charges, the evidence required and the available defense.

Digital Records and Electronic Evidence

Federal identity theft cases often depend on electronic records collected from devices, online services and financial institutions.

Investigators may obtain:

Emails and text messages
Encrypted or social media communications
Account-registration information
Password-reset records
Login histories
IP addresses
Device identifiers
Authentication codes
Browser history
Cloud-storage records
Bank and payment-platform documents
Credit and loan applications
Government-benefit submissions
Photographs or scans of identification documents

Digital evidence requires context.

An account may have multiple users. Credentials may have been shared or compromised. An IP address usually identifies an internet connection rather than a particular person. A document may have been received but never opened or used.

The defense may need to examine timestamps, user profiles, metadata, remote-access software and the chain of custody for seized devices.

Account Access and Account Takeover Allegations

Account takeover cases involve accusations that someone accessed an existing account without authority and used or changed it.

The account may belong to:

A bank or credit-card company
A payment platform
A brokerage firm
A cryptocurrency exchange
An online marketplace
An email provider
A mobile telephone company
A government-benefit system
A tax or employment service

Investigators may examine password resets, authentication codes, changes to telephone numbers, recovery email addresses, new payment beneficiaries and transactions completed after the alleged takeover.

The government may attempt to identify the user through a combination of technical and financial records. The defense should determine whether the account was shared, compromised or accessed through a device used by several people.

Possession of an authentication message or password does not necessarily prove that the client completed the unauthorized transaction.

Common Identity Theft Allegations

Opening Accounts or Applying for Credit

The government may allege that another person’s identity was used to apply for a credit card, loan, bank account, mobile telephone service or online payment account.

Relevant evidence may include the application, contact details, device information, supporting documents and the account into which funds were transferred.

The defense should determine who completed the application, who supplied the identifying information and who controlled the resulting account.

Credit Card and Payment Fraud

Identity theft may be charged with access-device fraud when another person’s card number, account number or payment credentials are allegedly used.

The appearance of another person’s information in a transaction does not establish whether the client knew it was unauthorized or whether another participant completed the purchase.

For allegations focused on payment cards, the related Credit Card Fraud Defense page addresses carding, counterfeit cards and access-device evidence in greater detail.

Tax and Government-Benefit Allegations

Federal investigations may involve tax returns, refund claims, unemployment benefits, healthcare benefits or other government programs submitted using another person’s information.

The government may rely on application records, bank deposits, mailing addresses, IP information and communications among alleged participants.

The defense should distinguish between the person whose account received money, the person who prepared the submission and the person who allegedly obtained the identifying information.

Employment and Identification Documents

A case may concern the alleged production, possession or use of a passport, driver’s license, Social Security document, employment record or other identification.

The relevant legal issues may include whether the document was false or altered, whether the client knew of that condition and the purpose for which it was allegedly possessed or used.

Online Impersonation and Account Fraud

Another person’s name, photograph, email address or credentials may allegedly be used to create an online profile, communicate with a business or obtain access to an account.

The defense should determine whether the client controlled the profile and whether the alleged impersonation was connected with the fraud offense charged.

Search Warrants and Seized Devices

Identity theft investigations may lead to searches of homes, offices, online accounts and electronic devices.

Agents may seize computers, phones, storage devices, financial documents and identification records. They may then create forensic copies and search for personal information, applications, communications and transaction histories.

The defense may examine whether:

The warrant was supported by probable cause
The places and devices were described with sufficient particularity
Agents remained within the authorized scope
Unrelated devices were seized
Several people had access to the device
Privileged communications were captured
The original data was properly preserved
The government correctly attributed files and activity to the client

Finding another person’s information on a device is only the beginning of the analysis. Investigators must still prove knowing possession, transfer or use and the required criminal intent.

Conspiracy and Aiding-and-Abetting Charges

Identity theft cases frequently involve allegations that several people performed different roles.

One person may allegedly obtain identifying information, another may prepare applications, another may receive money and another may withdraw or transfer it.

A client can be accused of conspiracy even if prosecutors do not claim that the client personally stole or used every identity.

However, association with another participant is not enough. The government must prove the agreement and the client’s knowing participation in its unlawful objective.

Similarly, aiding-and-abetting liability requires proof that the client intentionally assisted the commission of the offense. Ordinary employment, administrative assistance or receipt of a payment does not automatically establish criminal participation.

Related Federal Fraud Charges

Identity theft may be charged together with:

Wire fraud
Mail fraud
Bank fraud
Credit card or access-device fraud
Computer fraud
False statements
Forgery
Theft of government funds
Tax fraud
Healthcare fraud
Money laundering
Conspiracy
Obstruction of justice

Each offense has separate elements.

Evidence that supports a fraud allegation does not automatically prove aggravated identity theft. The identifying information must satisfy the specific requirements of the identity theft statute.

Likewise, possession of personal data does not automatically establish the wire, bank or access-device fraud alleged in another count.

What the Government Must Prove

The elements depend on the statute and subsection charged.

Disputed questions may include whether:

The information identified another actual person
The client knew that the information belonged to another person
The client transferred, possessed or used it
The conduct was without lawful authority
The client acted with the required fraudulent or unlawful intent
The information was central to the underlying offense
The client controlled the relevant account or device
A qualifying predicate felony existed
The client knowingly joined a conspiracy
The alleged financial loss resulted from the charged conduct

The prosecution must prove every element of every count beyond a reasonable doubt.

Identity Theft Defense Strategies

The defense strategy depends on the alleged information, transaction, account and client’s role.

Authorization or Consent

The information may have been used with permission.

Family members, employees, business partners and authorized account users may share information for legitimate purposes. A later disagreement does not automatically prove that the original access was unauthorized.

Consent does not resolve every legal question, but messages, contracts, account history and prior transactions may be important.

Lack of Knowledge

The client may not have known that the information belonged to another actual person or that it was obtained without authority.

This can be relevant when another participant supplied an account, document, number or file without explaining its origin.

No Knowing Possession

The identifying information may have been found on a shared or compromised device without proof that the client knew it was there.

Forensic analysis may show that the file was not opened, was stored automatically or belonged to another device user.

No Deceptive Use of the Identity

Another person’s information may have appeared in a transaction without being used to deceive anyone about who was involved.

For aggravated identity theft, the defense should examine whether the alleged misuse was genuinely central to what made the underlying conduct criminal.

Mistaken Account Attribution

The government may have incorrectly connected the client with an email address, application, IP address, online account or device.

Several people may have used the same network or business system. The account may also have been compromised remotely.

Legitimate Business Activity

A company may possess customer identification and financial information as part of lawful business operations.

The government must distinguish ordinary possession of customer records from intentional use of those records for unlawful activity.

No Agreement to Join a Conspiracy

The client may have performed a limited task without knowing that another person was allegedly committing identity theft.

The defense should separate the client’s own communications and actions from the conduct attributed to the wider group.

Unreliable Cooperating Witness

Another alleged participant may accuse the client in an effort to obtain favorable treatment.

The witness’s statements should be compared with original communications, account records and prior statements.

Improper Search or Statements

Evidence may be challenged when agents conducted an unlawful search, exceeded the scope of a warrant or obtained statements in violation of the client’s rights.

Incorrect Loss Calculation

The government may include transactions that were declined, reversed, refunded or completed by another participant.

The amount attributed to identity theft should be compared with the original account and payment records.

Potential Consequences of Identity Theft Charges

The consequences depend on the statutes, number of counts, underlying fraud, alleged loss, client’s role and prior criminal history.

A conviction may result in imprisonment, fines, restitution, supervised release and forfeiture. Aggravated identity theft may add a consecutive two-year term when all elements of § 1028A(a)(1) are proven.

Professional licenses, employment and business relationships may also be affected. Non-U.S. citizens can face immigration consequences depending on the offense and disposition, so separate immigration analysis may be appropriate.

There is no single universal sentence for all identity theft cases. Broad claims that every conviction results in a specific prison term, loss of a driver’s license or loss of citizenship are inaccurate.

How Identity Theft Allegations Can Affect a Business

A business connected with identity theft allegations may experience frozen accounts, suspended merchant services, customer claims, loss of contracts and regulatory inquiries.

A search warrant can also result in the seizure of computers, employee records and customer databases needed for daily operations.

The company may need to determine:

Which employees accessed the disputed information
Whether credentials were shared
Whether a system was compromised
Who submitted the applications or transactions
Whether customer data was collected for a legitimate business purpose
Whether the company and individual employees have conflicting interests

An internal review should be organized carefully because reports, interviews and electronic records may later be requested by investigators.

Pre-Indictment Identity Theft Defense

Representation may begin before formal charges are filed.

At the pre-indictment stage, an attorney may communicate with prosecutors, identify the suspected transactions, respond to subpoenas and advise whether a government interview is appropriate.

The defense may also preserve account data, collect authorization records, identify other device users and retain digital-forensic or financial specialists.

When appropriate, factual and legal information may be presented before prosecutors decide whether to seek an indictment.

Early representation cannot guarantee that charges will be avoided, but it can help prevent unsupported assumptions from becoming the government’s accepted account of the case.

Bukh Law Firm Identity Theft Defense Services

Representation may include:

Federal pre-indictment defense
Responses to grand jury subpoenas
Preparation for federal interviews
Review of search warrants and seized devices
Analysis of accounts, applications and electronic records
Defense against aggravated identity theft allegations
Defense involving access-device, wire and bank fraud
Coordination with digital-forensic and financial specialists
Pretrial motions and negotiations
Federal trial preparation
Review of restitution, loss and forfeiture claims
Sentencing and post-trial representation

Credit-report monitoring has been removed from the legal-services section because it is generally a consumer-protection service rather than criminal defense representation.

What to Do During an Identity Theft Investigation

Do not delete messages, applications, account records or files from electronic devices.

Preserve documents showing authorization, legitimate business use, shared account access, employment responsibilities and the identities of other people who could access the relevant systems.

Before speaking with federal agents or voluntarily providing a device, determine which agency is involved, what conduct is under investigation and whether you are considered a witness, subject or target.

Arkady Bukh represents clients before and after federal identity theft charges are filed, including during investigations, grand jury proceedings, searches, negotiations and federal trials.

Identity Theft Defense FAQ

Is Arkady Bukh an identity theft attorney?

Yes. Arkady Bukh represents individuals and businesses in federal identity theft investigations involving personal data, account access, identification documents and related fraud allegations.

What is aggravated identity theft?

Aggravated identity theft is a federal offense under 18 U.S.C. § 1028A involving the knowing transfer, possession or use, without lawful authority, of another actual person’s means of identification during and in relation to an enumerated felony.

Does aggravated identity theft automatically apply whenever another person’s name appears in a fraud case?

No. The government must prove every element of § 1028A. The identifying information must have the required connection with the underlying offense.

What is the penalty for aggravated identity theft?

Section 1028A(a)(1) provides for a separate two-year prison term that generally runs consecutively to the punishment for the qualifying underlying felony.

Must the defendant know that the information belonged to a real person?

Yes. For aggravated identity theft, the government must prove that the defendant knew the means of identification belonged to another actual person.

Does finding personal information on a phone prove identity theft?

No. The government must establish knowing possession, transfer or use and the required intent. A device may be shared, compromised or automatically synchronized.

What is the difference between possessing and using identifying information?

Possession concerns control of the information. Use generally concerns putting it into action. The evidence and statutory requirements may differ depending on the conduct charged.

Can identity theft involve account takeover?

Yes. Account-takeover cases may involve unauthorized access to bank, credit-card, email, payment, cryptocurrency or other online accounts.

Can identity theft charges be added to credit card fraud?

Yes. Prosecutors may charge access-device fraud and aggravated identity theft when they allege that another actual person’s information was knowingly used without lawful authority during the qualifying offense.

Can a business legally possess customer identification?

Yes. Many businesses lawfully collect and store identity information. The issue is whether it was intentionally transferred, possessed or used for an unlawful purpose.

Does an IP address prove who accessed an account?

Not by itself. An IP address generally identifies a network connection, which may be used by several people or devices.

Can someone be charged for receiving money connected with identity theft?

Potentially, but receipt of money alone does not prove knowledge or participation. The government must establish the required intent and connection with the alleged scheme.

Does consent prevent every identity theft charge?

Consent can be important, but the legal effect depends on the statute and circumstances. The defense should examine what authority was given and how the information was used.

Can an identity theft case include wire or bank fraud?

Yes. Identity theft is often charged with wire fraud, bank fraud, access-device fraud, computer fraud, false statements or conspiracy.

Does an indictment establish guilt?

No. An indictment is a formal accusation. The government must prove every charge beyond a reasonable doubt unless the case is resolved through another procedure.