Legal Consequences for Credit Card Fraud with Stolen Data

Federal rule-summary notice

Non-advice notice: This out-of-lane Regulation & Ethics companion summarizes federal statutes for general informational purposes. It is not legal advice, does not create an attorney-client relationship, and cannot determine the charges or sentence in a particular case.

• Last verified: August 27, 2026
• Legal-background review: No named legal-background reviewer has been identified for this page. It should not be represented as attorney-reviewed until a reviewer is identified.
• Governing statutes: 18 U.S.C. § 1029; 18 U.S.C. § 1028; 18 U.S.C. § 1028A; 18 U.S.C. § 1343; and 18 U.S.C. § 3663A.

“Credit card fraud” is a descriptive label, not the name of one federal offense. Using stolen card information may support access-device fraud, wire fraud, or both; knowingly using another person’s identifying information in relation to a qualifying felony may add aggravated identity theft. Mandatory restitution can then remain part of the judgment apart from imprisonment.

The federal charge stack at a glance

The table is a charging map, not a forecast. A statutory maximum describes the outer limit Congress authorized for a count. It does not show which counts prosecutors will bring, whether an agreement will dismiss or consolidate allegations, how the sentencing guidelines will apply, or what sentence a judge will impose.

Start with § 1029’s actual gatekeepers

For stolen payment data, § 1029 is the natural starting point because its definition of an “access device” extends beyond the plastic card. It includes an account number and other means of account access that can be used to obtain value or initiate a transfer of funds. An “unauthorized access device” includes an access device that is lost, stolen, expired, revoked, canceled, or obtained with intent to defraud.[1]

That breadth does not eliminate the need to identify the charged paragraph. Under § 1029(a)(2), the relevant conduct is knowingly and with intent to defraud trafficking in or using one or more unauthorized access devices, and thereby obtaining things of value aggregating at least $1,000 during a one-year period. Section 1029(a)(5) applies a similar one-year, $1,000 aggregation condition to fraudulent transactions effected with access devices issued to another person.[1]

What the $1,000 aggregation requirement changes

The relevant question under those provisions is not necessarily the value of one transaction. It is the value obtained by the specified conduct in aggregate during any one-year period. Several transactions can therefore be considered together if they fit the statutory provision and the same one-year window. Conversely, an allegation that merely states that a card number was stolen or tested does not by itself establish that the value requirement was reached.

The $1,000 condition should not be generalized across every part of § 1029. Other paragraphs address different conduct and contain different factual conditions. The charging document must identify the provision being invoked; only then is it possible to know whether the government needs to prove aggregate value, a quantity of devices, device-making conduct, or another statutory element.[1]

A useful exposure review therefore separates three facts that are often compressed into the phrase “used stolen cards”: what device information was possessed or used, what value was actually obtained during the relevant period, and which subsection the alleged conduct is said to violate. Attempted transactions, declined authorizations, completed purchases, and possession of a data set are not interchangeable allegations.

The commerce connection is part of the federal case

Section 1029 applies when the offense affects interstate or foreign commerce. That jurisdictional language is not a decorative recital. The government must connect the offense to the federal commerce requirement, and the supporting facts should be identified rather than assumed from the generic nature of electronic payments.[1]

For an initial assessment, counsel should locate the alleged transactions, payment communications, affected accounts, merchants, processors, and other relevant conduct. The legal question remains whether the charged offense affected interstate or foreign commerce. If the current record does not establish that connection, the responsible conclusion is that federal § 1029 exposure requires further factual development—not that federal jurisdiction is either conclusively present or impossible.

How § 1029’s penalty tiers fit around those elements

Once the applicable paragraph has been identified, § 1029(c) divides first offenses into two principal maximum-penalty groups. Violations of paragraphs (1), (2), (3), (6), (7), and (10) carry maximum imprisonment of 10 years. Violations of paragraphs (4), (5), (8), and (9) carry maximum imprisonment of 15 years. A § 1029 offense committed after a prior conviction under the section carries a maximum of 20 years.[1]

Attempt does not receive a lower statutory ceiling merely because the transaction failed: § 1029(b) permits attempt to be punished to the same extent as the completed offense. Conspiracy is treated differently. Its imprisonment maximum is no more than one-half of the maximum applicable to the underlying offense, while its fine cannot exceed the underlying statutory maximum.[1]

Section 1029 also directs forfeiture of personal property used or intended to be used to commit the offense. That consequence can matter immediately when the alleged operation involved computers, encoding equipment, storage media, phones, or other personal property, although whether particular property is forfeitable depends on its connection to the offense.[1]

The two-year term that changes the exposure calculation

Section 1028A requires a separate inquiry from whether stolen card data was involved. The aggravated identity-theft count requires proof that the defendant knowingly transferred, possessed, or used, without lawful authority, a means of identification of another person during and in relation to an enumerated felony. The existence of an account number in the evidence does not dispense with the knowledge, other-person, lawful-authority, predicate-felony, or relational requirements.[2]

When those elements are established, the penalty is not simply another maximum for the court to consider. Section 1028A(a)(1) prescribes two years of imprisonment, and § 1028A(b) requires that term to run consecutively to the punishment for the predicate felony. Probation is unavailable for the aggravated identity-theft offense.[2]

This is why a recitation of 10-, 15-, or 20-year ceilings can obscure the more consequential issue. A defendant convicted of a qualifying predicate and § 1028A does not merely face two available sentencing ranges. The two-year identity-theft term is added to the predicate sentence. The actual length of the predicate sentence remains case-specific, but the consecutive structure changes the floor created by the convictions.

The predicate must be identified with care. Section 1028A’s enumerated felonies include offenses in Chapter 63, which contains wire, mail, and bank fraud. Thus, a § 1343 wire-fraud charge can serve as the qualifying felony when the remaining § 1028A elements are also proved.[2] An indictment’s use of identity-theft language should not be mistaken for proof that the mandatory consecutive count necessarily applies.

The distinction between ordinary identity-related offenses under § 1028 and aggravated identity theft under § 1028A also matters. Section 1028 addresses several forms of fraud involving identification documents, authentication features, and identifying information; § 1028A is the provision carrying the specific two-year consecutive term for qualifying conduct tied to an enumerated felony.[5] The same stacked-count mechanics appear in the site’s federal check-theft penalty record.

Wire fraud as the card-not-present overlay

Card-not-present conduct may also be charged under § 1343 when the evidence supports a scheme or artifice to defraud and an interstate or foreign wire communication used to execute that scheme. The analysis should identify the alleged misrepresentation or fraudulent scheme, the defendant’s intent, and the transmission on which federal wire jurisdiction rests. Calling a purchase “online” is a factual starting point, not an element-by-element conclusion.

The ordinary statutory maximum for wire fraud is 20 years. If the violation affects a financial institution, § 1343 authorizes imprisonment of up to 30 years and a fine of up to $1,000,000.[3] The enhanced tier therefore depends on the statutory “affects a financial institution” condition, not simply on the fact that a bank issued the card or appears somewhere in the transaction history.

A wire-fraud count can materially alter the case even when its maximum never becomes the expected sentence. It can supply a predicate for § 1028A, broaden the alleged scheme beyond individual access-device transactions, and shape plea negotiations. Those are possible consequences of the charging structure, not a claim that every remote use of stolen card data produces all three counts.

Restitution is part of the judgment, not a footnote

Under § 3663A, restitution is mandatory for covered offenses against property, including offenses committed by fraud or deceit, when the statute’s victim and loss conditions are satisfied.[4] This inquiry is separate from selecting an imprisonment range. The court must determine who qualifies as a victim and which losses are recoverable under the statute.

That distinction matters in multi-transaction cases. The face value of attempted charges, the amount successfully obtained, the loss attributed to the offense of conviction, and the amount recoverable as restitution need not be assumed to be identical. Each figure answers a different legal or evidentiary question. Restitution should therefore be assessed from the offense, victim, causation, and loss record rather than copied from the largest number in a complaint.

For a client, the restitution obligation may remain consequential long after discussion of statutory maxima has ended. It belongs in the first exposure conversation alongside incarceration, forfeiture, and the effect of a consecutive § 1028A count—not in a final miscellaneous-consequences paragraph.

A disciplined order for reviewing the allegations

1. Identify the precise § 1029 paragraph and the conduct assigned to it. Do not treat possession, use, trafficking, production, and transaction activity as interchangeable.
2. For charges under § 1029(a)(2) or (a)(5), calculate the alleged value obtained within the specified one-year period and test whether it reaches $1,000.
3. Locate the facts said to establish an effect on interstate or foreign commerce.
4. For § 1028A, identify the other person’s alleged means of identification, the evidence of knowledge and lack of lawful authority, and the enumerated predicate felony.
5. For § 1343, separate the alleged scheme to defraud from the interstate or foreign wire transmission used to execute it, then determine whether the financial-institution enhancement is actually alleged.
6. Map the applicable maximums, the mandatory consecutive term, forfeiture exposure, and restitution separately before considering guidelines, plea posture, or likely sentence.

Section 1029 authorizes the Secret Service to investigate offenses under that section, subject to statutory coordination provisions.[1] The Department of Justice’s Computer Crime and Intellectual Property Section also works on computer and intellectual-property crime, including cyber-enabled criminal matters.[6] Those institutional roles provide orientation; they do not establish that a particular investigation will be federal, that a particular office will participate, or that every available count will be charged.

Separate state charges may also apply to the same conduct. State offense definitions, value thresholds, classifications, and sentencing rules are jurisdiction-specific. This article does not provide a nationwide state-law comparison, so no conclusion about one state should be generalized to another.

The federal map establishes possible statutory exposure: § 1029 depends on its particular conduct, threshold, and commerce elements; § 1343 requires a wire-fraud theory; § 1028A can add a mandatory consecutive term; and § 3663A can require restitution. It cannot predict the actual sentence. That requires the proved facts, charging decisions, criminal history, guidelines calculations, plea posture, count structure, loss findings, and the sentencing court’s judgment. The site’s federal charging and penalty pipeline addresses why those stages cannot be replaced by a headline statutory maximum.

References

1. 18 U.S. Code § 1029 — Fraud and related activity in connection with access devices, Cornell Legal Information Institute.
2. 18 U.S. Code § 1028A — Aggravated identity theft, Cornell Legal Information Institute.
3. 18 U.S. Code § 1343 — Fraud by wire, radio, or television, Cornell Legal Information Institute.
4. 18 U.S. Code § 3663A — Mandatory restitution to victims of certain crimes, Cornell Legal Information Institute.
5. 18 U.S. Code § 1028 — Fraud and related activity in connection with identification documents, authentication features, and information, Cornell Legal Information Institute.
6. Computer Crime and Intellectual Property Section (CCIPS), U.S. Department of Justice.