Identity Theft in Alabama: Laws, Penalties, and Victim Recovery

Identity theft in Alabama is a Class B felony under the state’s Consumer Identity Protection Act, punishable by 2 to 20 years in prison and fines up to $30,000 per offense. Victims aren’t limited to waiting on a criminal case: Alabama Code § 13A-8-199 lets you sue the person responsible for $5,000 per incident or triple your actual losses, whichever is greater, plus attorney’s fees.

What Counts as Identity Theft Under Alabama Law

Under Alabama Code § 13A-8-192, you commit identity theft when you use another person’s identifying information without permission and with intent to defraud. The statute covers four specific acts: accessing someone’s identifying information to reach their financial resources or benefits, obtaining goods or services using their information, getting identification documents in their name, or obtaining employment using their data.¹

The fraud doesn’t have to benefit the person who commits it. The statute applies equally when someone steals identifying information to benefit a third party, so a person who harvests personal data and hands it to someone else to use faces the same charge as the person who actually opens the fraudulent account.

Trafficking in Stolen Identities

Alabama separates the supply chain from the end user. Under § 13A-8-193, trafficking in stolen identities targets anyone who manufactures, sells, transfers, or purchases identification documents or identifying information for the purpose of committing identity theft.²

Prosecutors don’t need to prove a completed sale. Possessing five or more identification documents belonging to one person, or identifying information belonging to five or more different people, creates a legal inference of intent to traffic. Once police find that volume of stolen information, a jury can conclude intent without additional evidence of a specific planned transaction.²

Criminal Penalties

Both identity theft and trafficking in stolen identities are Class B felonies.¹² A conviction carries a prison sentence of not less than 2 years and not more than 20 years.³

Fines can reach $30,000 per count. Alabama also allows courts to impose a fine equal to double the financial gain the defendant received or double the loss the victim suffered, whichever produces the larger number.⁴ In schemes involving large dollar amounts, that doubling provision often exceeds the standard $30,000 cap.

Repeat offenders face steeper sentences. Alabama’s habitual offender law treats a Class B felony conviction as a Class A felony when the defendant has a prior Class A, B, or C felony conviction, which raises the range to 10 to 99 years. Two priors push the minimum to 15 years with a possible life sentence; three priors mean a mandatory 20-year minimum with life on the table.

Prosecutors have seven years from the date of the offense to bring identity theft charges, a longer window than most crimes get because victims often don’t discover the theft for months or years.¹

What Victims Can Recover in Civil Court

Criminal prosecution isn’t the only route. Under § 13A-8-199, a victim can sue the person responsible for damages of $5,000 per incident or three times the actual damages, whichever is greater, plus reasonable attorney’s fees and court costs.⁵

The treble-damages provision is where this statute has real teeth. If someone racks up $10,000 in fraudulent charges on your accounts, a court could award $30,000, not counting attorney’s fees. The $5,000 floor protects victims whose direct financial losses are small but whose time and disruption costs are significant.

You can file in the county where you live or any county where part of the crime took place, even if the defendant was never physically present there. The civil statute of limitations is seven years from the date you discovered the offense or reasonably should have discovered it.⁵

How to Report Identity Theft in Alabama

Acting quickly limits the damage and builds the paper trail you’ll need for disputes with creditors and credit bureaus.

File a Police Report

Start with your local police department or sheriff’s office. Bring a government-issued ID, any evidence of the fraudulent activity (bank statements, credit card bills, collection letters), and a written summary of what happened and when you noticed it. The responding agency generates a formal report and assigns a case number. That case number is essential — you’ll reference it when disputing fraudulent accounts, placing extended fraud alerts, and filing insurance claims.

File an FTC Identity Theft Report

Visit IdentityTheft.gov to file a federal report with the Federal Trade Commission.⁶ The site walks you through selecting the type of fraud, then generates a personalized recovery plan with pre-filled dispute letters for creditors and credit bureaus. After submitting, you receive a unique FTC Identity Theft Report number. Print or download the full report; banks and creditors routinely require it to process fraud claims.

File a Complaint With the Alabama Attorney General

The Alabama Attorney General’s Consumer Interest Division accepts consumer complaints related to identity theft. Filing creates a state-level record and may prompt investigation if the office sees a pattern against a particular business or fraud operation. Complaints are processed in the order received and assigned to a consumer specialist.⁷ A consumer complaint is not a legal action; the office may advise you to seek private counsel depending on your situation.

Report Tax-Related Identity Theft to the IRS

If someone files a fraudulent tax return using your Social Security number, submit IRS Form 14039 (Identity Theft Affidavit) separately from your other reports. You sign it under penalty of perjury.⁸ After filing, consider enrolling in the IRS Identity Protection PIN program. An IP PIN is a six-digit number assigned each year that prevents anyone else from filing a return using your SSN. Anyone with an SSN or ITIN who can verify their identity is eligible, and parents can request IP PINs for dependents.⁹

Protecting Your Credit After the Theft

Credit Freezes

A credit freeze blocks lenders from accessing your credit report, which stops most new accounts from being opened in your name. Freezes are free for all consumers under federal law, and credit bureaus must place a freeze within one business day of an online or phone request. Lifting a freeze takes one hour when requested online or by phone.¹⁰ Contact each of the three major bureaus separately:

Equifax: 800-685-1111 or Equifax.com
Experian: 888-397-3742 or Experian.com
TransUnion: 888-909-8872 or TransUnion.com

Parents and guardians can freeze the credit of children under 16 for free, and the same right extends to anyone with a valid power of attorney for a dependent.¹¹

Fraud Alerts

A fraud alert tells creditors to verify your identity before opening new accounts. Unlike a freeze, you only need to contact one of the three bureaus; that bureau is required to notify the other two. A standard fraud alert lasts one year.¹¹ If you’ve filed a police report or FTC identity theft report, you qualify for an extended fraud alert that stays on your file for seven years.¹²

Blocking Fraudulent Entries

Under the Fair Credit Reporting Act, you can request that credit bureaus block any information on your report that resulted from identity theft. The bureau must act within four business days of receiving your request, as long as you provide proof of your identity, a copy of your identity theft report, identification of the specific fraudulent entries, and a statement that you did not authorize those transactions.¹³

Once a fraudulent debt has been blocked, any creditor or collector who knows about the block is prohibited from selling, transferring, or placing that debt for collection. That stops the cycle of fraudulent debts getting resold to new collectors who then come after you again.

Medical Identity Theft Is a Separate Problem

Medical identity theft happens when someone uses your personal information to receive healthcare, fill prescriptions, or file insurance claims. The danger goes beyond financial loss. Incorrect medical information in your records, such as someone else’s blood type, allergies, or conditions, can lead to dangerous treatment decisions.

If you find fraudulent entries in your medical records, report the errors to your healthcare provider in writing. Include a copy of the records showing the incorrect information and explain why it’s wrong. Send the letter by certified mail. Your provider must respond within 30 days and notify any other providers who may have the same inaccurate information.¹⁴

If a Company’s Data Breach Exposed Your Information

Alabama’s Data Breach Notification Act of 2018 requires businesses and other entities that experience a data breach to notify affected Alabama residents when sensitive personal information has been accessed by an unauthorized person and the breach is reasonably likely to cause substantial harm. The Attorney General and consumer credit reporting agencies must also be notified when more than 1,000 people are affected.

Triggering information includes your name combined with a Social Security number, driver’s license number, financial account numbers with associated security codes or PINs, medical or mental health treatment information, health insurance identification numbers, or email login credentials that could provide access to accounts containing sensitive data.

Businesses must send notifications within 45 days of discovering the breach, and those that miss the deadline face fines of up to $5,000 per day of delay. If you receive a breach notification letter, treat it as a signal to freeze your credit and monitor your accounts closely, even if the company says no misuse has been detected yet.

Handling Collection Calls for Debts You Didn’t Incur

One of the most stressful parts of identity theft is getting collection calls for debts you never incurred. Under the Fair Debt Collection Practices Act, a collector cannot claim you owe a debt without a reasonable basis for that assertion. Under the Fair Credit Reporting Act, collectors who receive an identity theft report from a consumer must investigate before continuing to report the account to credit bureaus.¹³

When a collector contacts you about a debt you believe resulted from identity theft, send a written dispute along with a copy of your FTC identity theft report or police report. Once they receive that documentation, they must investigate before continuing collection efforts or reporting the debt. Keep copies of everything you send and use certified mail. The paper trail matters if the collector ignores your dispute and you need to escalate.

1
Alabama Legislature. Alabama Code 13A-8-192 – Identity Theft
2
Alabama Legislature. Alabama Code 13A-8-193 – Trafficking in Stolen Identities
3
Alabama Legislature. Alabama Code 13A-5-6 – Sentences of Imprisonment for Felonies
4
Alabama Legislature. Alabama Code 13A-5-11 – Fines for Felonies
5
Alabama Legislature. Alabama Code 13A-8-199 – Civil Action for Violation of Chapter
6
Federal Trade Commission. Report Identity Theft
7
Alabama Attorney General’s Office. Consumer Complaint
8
Internal Revenue Service. Identity Theft Affidavit
9
Internal Revenue Service. Get an Identity Protection PIN
10
Federal Trade Commission. Free Credit Freezes Are Here
11
Federal Trade Commission. Starting Today, New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts
12
Federal Trade Commission. Credit Freezes and Fraud Alerts
13
Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft
14
Federal Trade Commission. What To Know About Medical Identity Theft