California’s identity theft law, Penal Code 530.5, makes it a crime to willfully obtain another person’s personal identifying information and use it for any unlawful purpose. Penalties run from up to one year in county jail for a misdemeanor to 16 months, two years, or three years for a felony, and several subsections are “wobblers” that prosecutors can file either way. The same statutory scheme gives victims specific tools to pull records on fraudulent accounts, freeze their credit, and sue for damages that can reach $30,000 on top of actual losses.
What PC 530.5 Criminalizes
A conviction under subsection (a) requires two things. The defendant willfully obtained someone else’s personal identifying information, and the defendant used that information for an unlawful purpose — obtaining credit, goods, services, real property, or medical information without consent.1California Legislative Information. California Penal Code 530.5 “Willfully” means intentional, not accidental.
The scheme does not have to work. If someone steals a neighbor’s Social Security number and applies for a credit card that gets denied, the crime is complete. The statute targets use for an unlawful purpose, not whether the purpose succeeded.
You also don’t have to actually use the data to be charged. Three preparatory acts have their own subsections:
- Possession with intent to defraud (c)(1). Holding onto someone else’s personal identifying information with the intent to commit fraud. A first offense is a straight misdemeanor, meaning the prosecutor cannot bump it to a felony. The charge becomes a wobbler if the defendant has a prior PC 530.5 conviction, or if the possession involves the information of ten or more people. That ten-person threshold is how prosecutors reach organized data-harvesting operations.1California Legislative Information. California Penal Code 530.5
- Selling or transferring data (d). Selling, transferring, or giving away someone’s personal identifying information with intent to defraud is a wobbler. A separate provision applies when the seller knows the buyer plans to use the data for identity theft.1California Legislative Information. California Penal Code 530.5
- Mail theft (e). Taking mail from a mailbox, carrier, or delivery vehicle. California treats this as a gateway to identity theft because pre-approved credit offers, bank statements, and tax documents travel through the mail.
One more provision matters for anyone whose name has been used in a crime. Subsection (b) requires that when a defendant uses a stolen identity to commit a further offense, court records must reflect that the person whose identity was stolen did not commit that crime.1California Legislative Information. California Penal Code 530.5 Without that notation, a victim can end up flagged in criminal databases for offenses they knew nothing about.
What Counts as Personal Identifying Information
Penal Code 530.55 defines the term broadly.2California Legislative Information. California Penal Code 530.55 It covers the obvious categories and quite a bit more:
- Financial identifiers: bank account numbers, credit card numbers, PINs, and passwords
- Government-issued identifiers: Social Security numbers, taxpayer identification numbers, driver’s license numbers, passport numbers, and immigration service numbers
- Biometric data: fingerprints, facial scan identifiers, voiceprints, and retina or iris images
- Electronic identifiers: unique electronic identification numbers, routing codes, and telecommunications access devices
- Employment and education records: employee ID numbers, school ID numbers, and place of employment
- Other personal records: mother’s maiden name, health insurance numbers, and information from birth or death certificates
Stealing and using any of these to impersonate someone or gain unauthorized access qualifies.
Misdemeanor vs. Felony Penalties
Which subsection applies determines whether charging is flexible.
Straight misdemeanor. A first-time violation of (c)(1), simple possession with intent to defraud, can only be filed as a misdemeanor. The maximum is one year in county jail, a fine up to $1,000, or both.1California Legislative Information. California Penal Code 530.5
Wobblers. Subsections (a), (c)(2), (c)(3), and (d) can go either way. As a misdemeanor, the maximum is one year in county jail. As a felony, the sentence is 16 months, two years, or three years under Penal Code 1170(h).1California Legislative Information. California Penal Code 530.5 Under realignment, most felony identity theft sentences are served in county jail rather than state prison, unless the defendant has priors for serious or violent felonies.
Prosecutors weigh the financial loss, the number of victims, the sophistication of the scheme, and the defendant’s record. A single stolen credit card used once looks different from a bulk operation targeting dozens of people.
Restitution is mandatory. Under Penal Code 1202.4, the court must order restitution for every determined economic loss, and in identity theft cases that expressly includes the cost of monitoring and repairing the victim’s credit for a reasonable period, plus attorney’s fees and other collection costs. Interest accrues at 10 percent per year from the date of sentencing or the date of loss, at the court’s selection.3California Legislative Information. California Penal Code 1202.4 The court cannot waive restitution because the defendant lacks assets. The obligation stays on the defendant until the full amount is paid.
Collateral Consequences
Beyond jail time and restitution, a conviction can reach into two areas that often matter more to the defendant in the long run.
Professional licenses. Under the Business and Professions Code, a conviction involving dishonesty or fraud is grounds for denying or revoking a license when the crime is substantially related to the profession’s duties. Identity theft typically meets that test in finance, healthcare, law, and real estate. California offers some paths back: under AB 2138, licensing boards generally cannot deny a license based on certain less serious convictions once seven years have passed since the conviction or release, and a certificate of rehabilitation can also help.
Immigration. For non-citizens, identity theft generally qualifies as a crime involving moral turpitude because it involves fraud, theft, and dishonesty. A single conviction can trigger deportation, particularly where the offense carries a potential sentence over one year. The felony version of PC 530.5 easily clears that threshold.
Common Defenses
The specific intent elements built into PC 530.5 create the most reliable openings for the defense.
Subsection (a) requires use for an unlawful purpose. If the defendant had a legitimate reason to possess or use the data, like a family member authorized to manage finances, the prosecution’s case weakens. The authorized/unauthorized line is where most of these cases are actually fought.
Subsections (c) and (d) require intent to defraud. Someone who ends up with another person’s information through a shared mailbox, a workplace database, or a misdirected document has not committed a crime without the intent to misuse it. The prosecution carries that burden.
A mistake-of-fact defense can also negate intent. For a specific intent crime, even an unreasonable mistake can work if it genuinely shows the defendant lacked criminal intent. In multi-defendant cases, a middleman who received and forwarded packages without knowing the scheme may lack the required mental state.
Statute of limitations. For felonies, prosecutors generally have three years from the date of the offense; for misdemeanors, one year. Identity theft often stays hidden for months or years, and the discovery rule can push the start date to when the victim or law enforcement found the crime. A viable limitations issue can produce outright dismissal, so it’s worth evaluating early.
When Federal Charges Also Apply
Identity theft that crosses state lines, uses the internet, or targets federal institutions can draw federal charges on top of or instead of state ones, and the penalties are steeper.
Under 18 U.S.C. 1028, the base federal penalty is up to five years. The maximum climbs to 15 years when the scheme involves large numbers of identification documents or generates $1,000 or more in value within a one-year period, 20 years when the offense connects to drug trafficking or a violent crime, and 30 years for terrorism-related schemes.4Office of the Law Revision Counsel. 18 U.S. Code 1028
Federal prosecutors frequently add 18 U.S.C. 1028A, aggravated identity theft, which carries a mandatory two-year sentence that runs consecutively to the underlying felony. The court cannot reduce the other sentence to account for it, substitute probation, or run the two concurrently. For terrorism-related identity theft, the mandatory add-on is five years.5Office of the Law Revision Counsel. 18 U.S. Code 1028A
When data was obtained through hacking, 18 U.S.C. 1030 may also apply, criminalizing unauthorized access to protected computers to obtain financial records, consumer data, or anything of value.6Office of the Law Revision Counsel. 18 U.S. Code 1030 Federal charges also trigger mandatory forfeiture of property used in the offense, so vehicles, computers, and other equipment can be seized permanently.
If You’re the Victim
California gives identity theft victims specific statutory rights that go well beyond the general advice to “contact your bank.” Filing the right reports early activates protections that are difficult or impossible to trigger later.
Start With a Police Report
Under Penal Code 530.6, you can report identity theft to your local police department. This report is the key that unlocks nearly every other right under California law. Credit freezes at no cost, access to fraudulent account records, and the civil remedies described below all require either a police report or an FTC identity theft report as a prerequisite.
Pull the Records on Fraudulent Accounts
Under PC 530.8, once you present a copy of your police report or signed FTC identity theft report along with identifying information, the business where a fraudulent account was opened must give you copies of the application and all transaction records within 10 business days, at no charge. If a business refuses, you can sue for $100 per day of noncompliance plus attorney’s fees.7California Legislative Information. California Penal Code 530.8 These records are what let you build the paper trail for everything that follows.
Freeze Your Credit
Under California Civil Code 1785.11.2 through 1785.11.6, you can place a security freeze with all three major credit bureaus. For identity theft victims who have a police report, the freeze is free.8California Department of Justice. How to Freeze Your Credit Files A freeze blocks new creditors from pulling your report, which effectively stops a thief from opening additional accounts in your name. You can lift it temporarily when you apply for legitimate credit.
File With the FTC
An identity theft report through IdentityTheft.gov creates a federally recognized record of the theft and generates a personalized recovery plan covering disputed charges, fraud alerts, and business notifications. The FTC report can substitute for a police report in some California contexts, and many victims find the FTC process more structured than working through local law enforcement alone.
Civil Lawsuit Against a Claimant
California Civil Code 1798.93 lets a victim sue in civil court for identity theft, with unusually strong remedies.9California Legislative Information. California Civil Code 1798.93 A court can declare that you owe nothing on the fraudulent claim, void any security interest the claimant obtained through the fraud, enjoin further collection, and dismiss any lawsuit the claimant filed against you based on the fraudulent account.
You can also recover actual damages, attorney’s fees, costs, and equitable relief. To qualify for damages and fees, you must send written notice to the claimant at least 30 days before filing suit, with a police report or FTC identity theft report attached, alerting them to the possible identity theft.9California Legislative Information. California Civil Code 1798.93
The strongest provision is the civil penalty. If you show by clear and convincing evidence that you gave the written notice, the claimant failed to investigate diligently, and the claimant kept pursuing the debt anyway, the court can award up to $30,000 on top of your other damages.9California Legislative Information. California Civil Code 1798.93 That penalty exists to punish creditors and collectors who ignore identity theft claims and keep hounding victims. The 30-day written notice is critical, so document everything from the start.