Identity theft in Florida is a felony in every form, prosecuted under Section 817.568 of the Florida Statutes, with prison exposure that runs from five years for a single offense up to a mandatory minimum of ten years when the fraud tops $100,000 or hits 30 or more victims. Victims also have federal protections that cap liability for unauthorized card charges, tools to block fraudulent entries on credit reports, and the option to sue for damages.1Section 817.568, Florida Statutes
What Counts as Identity Theft Under Florida Law
Section 817.568, titled “Criminal Use of Personal Identification Information,” makes it a felony to fraudulently use or possess another person’s identifying information without consent. The covered information is broad: names, Social Security numbers, bank account numbers, credit card numbers, dates of birth, and biometric data such as fingerprints.1Section 817.568, Florida Statutes
Prosecutors don’t have to show the thief actually profited. Possession of someone else’s identifying data with intent to use it fraudulently is enough on its own.
The statute also carries an enhanced offense for anyone who impersonates a law enforcement officer, bank employee, or government representative to extract personal information. The classic version is a phone call from a fake “fraud investigator” asking you to confirm account numbers. That tactic triggers harsher penalties than a standard identity theft charge.
Penalties for Identity Theft in Florida
Penalties scale with the dollar amount of the fraud and the number of victims. Several tiers carry mandatory minimum prison sentences a judge cannot waive.
- Third-degree felony (the base offense): any fraudulent use or possession of another person’s identifying information, regardless of amount. Up to five years in prison and a fine of up to $5,000.
- Second-degree felony: fraud totaling $5,000 or more, or 10 to 19 victims. Up to 15 years in prison, with a mandatory minimum of three years.
- First-degree felony: fraud totaling $50,000 or more, or 20 to 29 victims. Up to 30 years in prison, with a mandatory minimum of five years.
- First-degree felony, enhanced: fraud totaling $100,000 or more, or 30 or more victims. Up to 30 years in prison, with a mandatory minimum of ten years.
The mandatory minimums are the teeth of the statute. Someone convicted of stealing the identities of 20 people cannot walk out with probation, whatever the mitigating facts. The judge has to impose at least five years.
Courts also routinely order restitution covering the victim’s financial losses, legal fees, and credit restoration costs. A conviction can bar someone from working in finance, healthcare, or other fields that handle sensitive personal data.
Related Florida Statutes
A few other Florida laws matter if your case has a business or organized-crime angle.
Section 817.5681 requires any business operating in Florida that holds computerized personal data to notify affected residents within 45 days of discovering a data breach. Vendors that handle data for other businesses must notify the data owner within 10 days.2Section 817.5681, Florida Statutes That deadline gives you a legal hook to demand timely notice, so you can freeze accounts before the damage spreads.
Section 817.569 creates a separate crime for using public records, or information obtainable only through public records, to commit fraud. Florida’s public records are unusually accessible, and this statute targets people who exploit that access.3Section 817.569, Florida Statutes
When identity theft is part of a larger criminal enterprise, prosecutors can add charges under Florida’s RICO Act, Chapter 895, which lists Chapter 817 fraud offenses as qualifying “racketeering activity.” RICO charges stack on top of the underlying identity theft counts and expose the defendant’s assets to forfeiture.4Chapter 895, Florida Statutes
What to Do if Your Identity Is Stolen
Speed changes the outcome. The faster you report, the less damage accumulates and the stronger your position when you dispute charges.
File a police report. Contact your local police department or sheriff’s office. Florida law requires officers to accept your report even if the crime originated in another jurisdiction. That report becomes the foundational document for disputing fraudulent charges with banks and creditors.
Report to the FTC. File through IdentityTheft.gov. The site produces an identity theft affidavit that financial institutions accept, plus a personalized recovery plan.
Place a fraud alert. Call any one of the three major credit bureaus (Equifax, Experian, or TransUnion), and that bureau must notify the other two. An initial fraud alert lasts one year and forces creditors to take extra steps to verify identity before opening new accounts. With an identity theft report, you can request an extended fraud alert that stays on your file for seven years.
Freeze your credit. A security freeze blocks creditors from accessing your credit report until you lift it. Placing and lifting a freeze is free under federal law. You have to contact each bureau separately.
How Much You Can Be Held Liable For
Federal law caps your exposure when a thief uses your accounts, but the caps for credit cards and debit cards are very different, and that difference catches people off guard.
Credit Card Fraud
Under the Fair Credit Billing Act, your liability for unauthorized credit card charges is capped at $50, no matter how much the thief spent. Most major issuers waive even that $50 under their zero-liability policies. Report fraudulent charges to the card issuer in writing within 60 days of the statement date.5Fair Credit Billing Act
Debit Card Fraud
Debit card protections under the Electronic Fund Transfer Act are weaker and depend heavily on how quickly you report:6Electronic Fund Transfer Act
- Within two business days: your loss is capped at $50 or the actual unauthorized amount, whichever is less.
- After two business days but within 60 days of the statement: your loss can reach $500.
- After 60 days: no cap. You could lose everything the thief took.
The two-day clock starts when you learn your card was lost or stolen, not when the first unauthorized charge posts. If you were hospitalized or traveling and couldn’t reasonably report on time, the law requires the bank to extend the deadlines. Even so, the gap in protection is enormous. If a thief drains a checking account through a debit card and you don’t spot it for 90 days, you may have no legal right to recover those funds.
Blocking Fraudulent Credit Report Entries
Under the Fair Credit Reporting Act, identity theft victims can have credit bureaus block fraudulent information from appearing on their reports. You’ll need proof of identity and a copy of your identity theft report. Once a fraudulent debt is blocked, creditors and debt collectors who received notice of the block are prohibited from selling or placing that debt for collection.7Fair Credit Reporting Act
Tax, Social Security, and Medical Variants
Tax Identity Theft
Tax identity theft happens when someone files a return using your Social Security number to claim your refund. You usually find out when your legitimate return is rejected as a duplicate. If that happens, or if you receive IRS notices about income you didn’t earn or taxes you don’t owe, file Form 14039 (Identity Theft Affidavit) with the IRS. Do not file Form 14039 if you received IRS Letter 5071C, 4883C, or 5747C; those letters mean the IRS already flagged the suspicious return and will tell you what to do next.
To prevent a repeat, apply for an IRS Identity Protection PIN. It’s a six-digit number that changes every year and must appear on your return for the IRS to process it. Anyone with a Social Security number or ITIN can enroll, most easily through an IRS online account.
Social Security Number Misuse
If someone uses your Social Security number to get a job, credit, or government benefits, report it to the Social Security Administration’s Office of the Inspector General at oig.ssa.gov or 1-800-269-0271. Create a “my Social Security” account at ssa.gov so you can watch your earnings record for wages reported by employers you’ve never worked for. The account also offers two protective blocks: one that prevents online changes to your personal information, and one that blocks changes to direct deposit or address information. Both can only be lifted in person at a local Social Security office.
Medical Identity Theft
Medical identity theft can insert someone else’s diagnoses, allergies, or prescriptions into your health records, which is dangerous well beyond the financial harm. Under the HIPAA Privacy Rule, you have the right to request corrections to your medical records. An amendment typically doesn’t erase the original entry; it adds an explanatory note documenting the fraud. Submit the request in writing to the provider’s privacy officer, identify the inaccurate entries, and include supporting documentation.8HIPAA Privacy Rule
Suing for Damages
Florida law also lets victims file civil lawsuits against the people who stole their information. Civil cases use a lower standard of proof than criminal cases: you only need to show the defendant more likely than not committed the theft.
Recoverable damages include actual financial losses (fraudulent withdrawals, unauthorized loans in your name, credit restoration costs) and, in appropriate cases, emotional distress. When the defendant acted with malice or reckless disregard, punitive damages can push the award higher. Courts can also grant injunctive relief, ordering a business or financial institution to correct your records, return stolen funds, or fix its security practices.
The hard part is collection. Many identity thieves have no assets worth seizing. When the theft traces back to a data breach at a business or an insider at a financial institution, though, a civil claim against that entity may be worth the effort. A consumer protection attorney can tell you whether the likely recovery justifies the cost of pursuing the case.