California Penal Code 530.5 is the state’s main identity theft statute. It makes it a crime to willfully obtain and use another person’s identifying information for an unlawful purpose, to possess that information with intent to defraud, to sell or transfer it, and to steal someone else’s mail. Depending on which subsection applies and the defendant’s history, a conviction can mean anything from a $1,000 misdemeanor fine and up to a year in county jail to a felony sentence of 16 months, two years, or three years.
What Counts as Personal Identifying Information
The reach of PC 530.5 depends on a companion statute, Penal Code 530.55(b), which defines personal identifying information broadly. The list includes names, addresses, phone numbers, Social Security numbers, driver’s license numbers, taxpayer identification numbers, health insurance numbers, school and employee ID numbers, PINs, passwords, passport numbers, dates of birth, and credit card numbers.1California Legislative Information. California Penal Code 530.55
Biometric data counts too: fingerprints, facial scans, voiceprints, and retina or iris images. Unique electronic identifiers like routing codes and telecom access devices are also covered. A catchall for any “equivalent form of identification” means the list is not exhaustive. If data can be used to identify a specific person, it likely falls within the statute.1California Legislative Information. California Penal Code 530.55
The Four Prohibited Acts
Using Someone’s Identity — Section 530.5(a)
The core offense requires two things: that you willfully obtained another person’s identifying information, and that you used it for an unlawful purpose. The statute mentions obtaining credit, goods, services, real property, or medical information without consent as examples, but any unlawful use counts.2California Legislative Information. California Penal Code 530.5
“Willfully” means the act was intentional. Information that ended up in your possession by accident, without any attempt to use it, doesn’t satisfy that element. Prosecutors do not have to prove the victim lost money. Using someone’s Social Security number to apply for a credit card is enough even if the application is denied. The crime is in the unauthorized use, not the result.
Possessing Stolen Information — Section 530.5(c)
You don’t have to actually use the data to face charges. Section 530.5(c)(1) makes it a crime to possess another person’s identifying information with intent to defraud, which lets law enforcement act before accounts are opened or charges run up. Evidence of intent usually comes from surrounding circumstances: counterfeit ID equipment, lists of stolen credentials, or communications discussing fraud plans.2California Legislative Information. California Penal Code 530.5
Simple possession of one person’s data under 530.5(c)(1) is a misdemeanor only. The charge escalates in two situations. Under 530.5(c)(2), a prior conviction for identity theft or a related fraud offense turns the possession charge into a wobbler. Under 530.5(c)(3), possessing the identifying information of ten or more people with intent to defraud is also a wobbler, exposing the defendant to felony penalties.2California Legislative Information. California Penal Code 530.5
Selling or Transferring Stolen Information — Section 530.5(d)
Section 530.5(d) targets the supply chain. Selling, transferring, or giving away someone’s personal information with intent to defraud is an independent crime, even if the seller never personally uses the data. The provision reaches middlemen who collect and broker stolen credentials.2California Legislative Information. California Penal Code 530.5
Both 530.5(d)(1), selling any person’s information, and 530.5(d)(2), selling the information of ten or more people, are wobblers. The seller doesn’t need to know exactly what the buyer plans to do. General awareness that it will be used fraudulently is enough.2California Legislative Information. California Penal Code 530.5
Mail Theft — Section 530.5(e)
Section 530.5(e) takes the federal definition of mail theft from 18 U.S.C. § 1708 and makes it chargeable as a California state offense. Stealing, hiding, or destroying someone else’s mail qualifies. Mail remains a common source for identity thieves because pre-approved credit offers, tax documents, and bank statements all carry enough information to open fraudulent accounts.2California Legislative Information. California Penal Code 530.5
Mail theft under 530.5(e) is always a misdemeanor, punishable by up to one year in county jail. The statute specifically allows additional charges under other parts of PC 530.5 for the same conduct. Stealing someone’s mail and then using the information inside to apply for credit produces both a mail theft charge and an identity theft charge under 530.5(a).2California Legislative Information. California Penal Code 530.5
Penalties by Subsection
Not every part of PC 530.5 carries the same exposure. Here is how each subsection breaks down:
- 530.5(a), using someone’s identity: wobbler (misdemeanor or felony)
- 530.5(c)(1), possessing one person’s data with intent to defraud: misdemeanor only
- 530.5(c)(2), possession with a prior qualifying conviction: wobbler
- 530.5(c)(3), possessing data of ten or more people: wobbler
- 530.5(d)(1), selling any person’s data: wobbler
- 530.5(d)(2), selling data of ten or more people: wobbler
- 530.5(e), mail theft: misdemeanor only
Misdemeanor sentences max out at one year in county jail. PC 530.5 itself only says “a fine” without specifying an amount, so the general sentencing statutes supply the limits. For misdemeanors without a specified fine, Penal Code 19 caps the fine at $1,000.3California Legislative Information. California Penal Code 19 For felonies without a specified fine, Penal Code 672 allows up to $10,000.4California Legislative Information. California Penal Code 672
Felony sentences follow Penal Code 1170(h), which sets a triad of 16 months, two years, or three years. Most PC 530.5 felony sentences are served in county jail under 1170(h), not state prison. The exceptions are defendants with a prior serious or violent felony conviction, defendants required to register as sex offenders, and defendants whose sentence is enhanced under PC 186.11; those go to state prison.5California Legislative Information. California Penal Code 1170
Judges can also order restitution to reimburse victims for financial losses and the costs of repairing damaged credit. When charges come from multiple subsections of PC 530.5, the sentences can run consecutively, which can increase total time served considerably.2California Legislative Information. California Penal Code 530.5
Common Defenses
Each PC 530.5 subsection requires the prosecution to prove specific elements. Defenses tend to target those elements directly.
- No unlawful purpose. Section 530.5(a) requires use for an unlawful purpose. Showing a legitimate reason to possess or use the data, such as authorization from the person or a lawful business reason, breaks the prosecution’s case on that element.
- No willful act. Coming into possession of someone’s information by accident does not satisfy the “willfully obtains” requirement. Documents mixed in with your paperwork by mistake are not identity theft on their own.
- No intent to defraud. For the possession and sale charges under 530.5(c) and (d), prosecutors must prove fraudulent intent. Without evidence linking the defendant to a plan to misuse the data, these charges are harder to sustain.
- False accusation. Identity theft cases sometimes grow out of personal disputes. A former partner or associate may claim theft of information that was actually shared voluntarily. The defense turns on the accuser’s credibility and evidence that the information was obtained with consent.
When Federal Charges Can Stack
A California identity theft case doesn’t shut the door on federal prosecutors filing their own case for the same conduct. The most serious federal charge is aggravated identity theft under 18 U.S.C. § 1028A, which carries a mandatory two-year prison sentence on top of the sentence for the underlying felony. That two-year term must run consecutively, the court cannot make it concurrent, and probation is not an option.6Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
If the identity theft is connected to terrorism, the mandatory additional term rises to five years. Courts also cannot shorten the sentence for the underlying felony to offset the add-on.6Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
On the mail side, federal prosecutors can charge the same conduct covered by PC 530.5(e) under 18 U.S.C. § 1708, which carries up to five years in prison and is a felony regardless of the value of the stolen mail.7Office of the Law Revision Counsel. 18 USC 1708 – Theft or Receipt of Stolen Mail Matter Generally
Immigration Risk for Noncitizens
A PC 530.5 conviction creates serious immigration exposure for noncitizens. Crimes involving intent to commit fraud have traditionally been classified as crimes involving moral turpitude, which can trigger deportation or make a person inadmissible. This area of immigration law is unsettled enough that defense attorneys generally treat any fraud-based conviction as potentially qualifying. A plea that looks favorable on the criminal side can be devastating on the immigration side, so anyone who is not a U.S. citizen should get immigration-specific legal advice before resolving an identity theft case.