Identity Theft Charges in Minnesota
Minnesota identity theft is broader than opening a credit card in someone else’s name.
Minnesota criminal defense guide
Identity Theft Charges in Minnesota: Penalties, Evidence, and Defenses
Minnesota identity theft is broader than opening a credit card in someone else’s name. The statute covers transferring, possessing, or using another person’s or entity’s identity with intent to commit, aid, or abet specified unlawful activity. “Identity” includes names, Social Security numbers, dates of birth, government identifiers, account numbers, routing codes, electronic identifiers, voices, likenesses, data transmissions, and realistic forged digital likenesses. Penalties turn on direct-victim count, combined loss to direct and indirect victims, and certain offense types. The defense must identify the exact identity, prove who possessed or used it, isolate the alleged unlawful objective, audit every victim and dollar, and test the digital evidence rather than accept a spreadsheet total.
Build a victim-and-loss ledger from source records.
The charge level may depend on a single victim or dollar. A serious review identifies every alleged identity, who qualifies as a direct victim, every indirect victim, actual value obtained, remediation expense, duplicate or reversed transaction, and the date placing an item within or outside the six-month aggregate. It also maps each identity to a device, account, login, application, transaction, delivery, and alleged unlawful act. A detective’s summary table is a starting point, not proof.
Minnesota’s definition of “identity” is deliberately broad
The statute protects individuals and entities. A person can therefore be accused of using a human being’s identity, a business identifier, or organizational information. The State still must connect that identity to the accused and prove the required criminal intent.
Traditional personal identifiers
An identity includes a name, Social Security number, date of birth, driver’s-license or other official identification number, passport number, employer identification number, and taxpayer identification number. A prosecution need not involve a complete identity profile. One identifying number can qualify if it can identify a specific individual or entity, alone or with other information.
Account and electronic identifiers
Unique electronic identification numbers, addresses, account numbers, routing codes, telecommunication identification information, access devices, and data transmissions are included. Login tokens, account credentials, subscriber identifiers, bank-routing information, and similar digital records may be alleged even if no physical identification card is recovered.
Voice, likeness, and forged digital likeness
Current Minnesota law includes a person’s voice or likeness and a “forged digital likeness.” The latter is a video, film, sound recording, electronic image, photograph, or technological representation of speech or conduct that was substantially dependent on technical creation or alteration, misrepresents an individual’s appearance, speech, or conduct, and is realistic enough that a reasonable person would believe it depicts the real individual.
This language reaches certain deepfake audio, video, and images. It does not make every parody, filter, edited photograph, synthetic voice, or AI-generated image identity theft. Subdivision 2 still requires transfer, possession, or use of an identity that is not one’s own and intent to commit, aid, or abet qualifying unlawful activity.
A name alone can qualify, but context matters
People share names. A nickname, fictional character, stage name, or mistaken entry is not automatically criminal. The question is whether the information identifies a specific person or entity and whether the accused possessed, transferred, or used it with the required unlawful purpose.
The four questions at the center of an identity-theft charge
1. What particular identity is alleged?
The complaint should identify the name, number, credential, voice, likeness, account, or transmission. A reference to “personal information” without specifying the information makes it difficult to evaluate identity, victim count, possession, and intent. Discovery should associate each alleged identifier with its claimed owner.
2. Did the accused transfer, possess, or use it?
The statute covers three distinct verbs. Transfer can include sending, selling, sharing, uploading, handing over, or otherwise making information available. Possession may be actual or constructive and may involve paper records, a phone, cloud storage, email, a database, or another medium. Use includes entering, submitting, presenting, transmitting, or relying on the identity to further the alleged activity.
Mere proximity is not necessarily possession. A shared home, vehicle, computer, network drive, workplace system, or messaging thread may be accessible to several people. Constructive-possession cases require proof that the accused consciously exercised dominion and control, not simply that data was found somewhere nearby.
3. Was the identity someone else’s?
The State must show the identity was not the accused’s own. Joint accounts, authorized business credentials, marital or family financial arrangements, agency relationships, employer access, caregiving authority, power of attorney, and consent may complicate that proof. Authorization to access information does not necessarily authorize every use, but scope matters.
4. Was there intent to commit, aid, or abet unlawful activity?
This is the limiting element. Possessing a customer database, tax form, employee roster, medical record, contact list, or relative’s document may be entirely lawful. The State must prove that possession, transfer, or use was accompanied by intent to commit, help, or encourage unlawful activity as the statute defines it.
“Unlawful activity” includes any felony violation of Minnesota law or a similar law elsewhere. It also includes nonfelony Minnesota or comparable offenses involving theft, theft by swindle, forgery, fraud, or giving false information to a public official. The prosecution should identify the alleged underlying activity. The defense should test whether it is legally qualifying and whether the evidence proves the accused intended it.
Intent can exist before money changes hands
Subdivision 2 does not always require a completed financial loss. Possession with criminal intent can complete the offense. But the State may not infer intent simply because information is sensitive. It typically relies on applications, forged documents, transaction attempts, communications, tools, concealment, delivery addresses, admissions, or patterns. Innocent explanations and mixed-access evidence deserve equal scrutiny.
Identity-theft penalties by victim count and combined loss
Subdivision 3 uses either direct-victim count or combined loss to set the tier. The more serious measure controls. A case with little financial loss can still reach a felony level because of victim count. A case with one direct victim can reach a high tier because of indirect-victim losses and remediation expenses.
One direct victim; total combined loss $250 or less
The maximum is 90 days in jail and a $1,000 fine. Both conditions matter: one direct victim and loss no more than $250. If there are two direct victims, the five-year tier applies even when the alleged loss is zero.
One direct victim; loss more than $250 through $500
The maximum is 364 days in jail and a $3,000 fine. The total includes combined loss to the direct victim and any indirect victim, not only the amount charged to a personal account.
Two or three direct victims, or loss over $500 through $2,500
This tier is a felony punishable by up to five years and a $10,000 fine. Either measure is sufficient. Two identities possessed with qualifying intent can reach this tier even if no transaction succeeds.
Four through seven direct victims, or loss over $2,500
This tier carries up to ten years and a $20,000 fine. The statute says loss “more than $2,500” without a $35,000 ceiling in clause (4), while clause (5) separately assigns more than $35,000 to the highest tier. Reading the provisions together, loss over $35,000 receives clause (5)’s higher punishment.
Eight or more direct victims, or loss over $35,000
The highest general tier carries up to 20 years and a $100,000 fine. It also applies when the identity-theft offense is related to the specified child-sexual-abuse-material offenses.
Six-month aggregation
For subdivision 2 prosecutions, the State may aggregate money, property, or services received or the number of direct or indirect victims within any six-month period. Offenses spanning counties may be prosecuted together in a county where one occurred. The defense should test dates, authorship, common actor, duplicates, legal victim classification, and whether claimed loss belongs to the aggregate.
Broad venue
The case may be prosecuted where the offense occurred or where a direct or indirect victim resides or does business. Phishing and scanner-related cases may also be prosecuted where the person whose identity was obtained or sought resides. Venue can therefore be proper far from the defendant’s residence or the location of a device seizure.
Direct victims, indirect victims, loss, and mandatory restitution
Direct victim
A direct victim is the person or entity whose identity was transferred, used, or possessed in violation of the statute. That classification drives victim count and the mandatory minimum restitution provision. The alleged cardholder, account holder, employee, business, or taxpayer may be direct depending on the identifier used.
Indirect victim
An indirect victim is another legally recognized victim. A bank, merchant, government program, employer, insurer, or service provider that paid money, furnished goods, spent resources, or suffered a covered loss may qualify. Indirect victims contribute to combined loss but not necessarily the direct-victim count.
What counts as loss
Loss includes value obtained as defined by the theft statute and expenses incurred by direct or indirect victims because of identity theft. Expenses may include account remediation, replacement documents, professional assistance, credit monitoring, investigation, or other provable costs with the required causal connection. Requested amounts should be supported, nonduplicative, and reduced for reversals, reimbursements, or offsets where law requires.
The *Moua* decision
In State v. Moua, 874 N.W.2d 812, 817 (Minn. Ct. App. 2016), the Court of Appeals addressed who qualifies as a direct victim for mandatory restitution. It held that a person experiences “loss or harm” when the person suffers economic loss or when the theft involves the person’s name and private identifying information. The court did not treat junk mail lacking private identifiers the same as sensitive identity information. Id. at 817–18.
At least $1,000 for each direct victim
Following a subdivision 2 conviction, the court must order restitution of not less than $1,000 to each direct victim. The mandatory amount can make direct-victim classification and count financially significant even when transactions were declined. Additional proven loss may increase restitution.
Certified documents for victims
At a direct victim’s or prosecutor’s specific written request, the court must provide without cost a certified complaint, judgment of conviction, and an order describing the offense facts and circumstances. These materials can help victims correct credit and account records.
Digital evidence in an identity-theft prosecution
Devices and accounts
Investigators may rely on phones, laptops, external drives, cloud storage, password managers, email, social media, messaging apps, browser history, downloads, photographs, scans, spreadsheets, and deleted-file recovery. Discovery should identify extraction method, search terms, file locations, timestamps, user profiles, encryption, and which person had access.
IP addresses and login history
An IP address identifies a network connection at a time, not automatically the human user. Shared Wi-Fi, workplaces, public networks, VPNs, cellular carrier translation, remote access, and compromised accounts affect attribution. Provider logs, device cookies, multifactor prompts, recovery events, and physical possession may strengthen or weaken the link.
Applications and transactions
Applications may contain device fingerprints, typed data, uploaded documents, selfie checks, phone numbers, email addresses, bank links, delivery addresses, and verification results. A transaction ledger should separate applications, approvals, declines, authorizations, reversals, refunds, and completed value. An attempted use may prove intent even if it does not create the same loss.
Deepfake evidence
A forged-digital-likeness allegation requires proof of technical creation or alteration, misrepresentation of a real individual’s appearance, voice, or conduct, and realism sufficient to persuade a reasonable person. Original files, generation or editing tools, model history, metadata, source media, prompt or project files, distribution records, and expert analysis may matter. A conclusory statement that media “looks AI-generated” does not prove the statutory definition or authorship.
Authentication
Under Minn. R. Evid. 901, the proponent must offer enough evidence to support a finding that an exhibit is what it claims to be. Content, metadata, witness familiarity, distinctive characteristics, provider certification, and forensic testimony can authenticate. The defense may show alteration, incomplete exports, account compromise, unreliable screenshots, or a broken chain of custody.
Search warrants and scope
A warrant should establish probable cause connecting the suspected offense, device or account, categories of data, and relevant period. Particularity and execution matter. The defense should examine affidavits, returns, extraction reports, filter procedures, consent, preservation demands, and whether investigators searched beyond lawful scope.
Defense issues in a Minnesota identity-theft case
No intent to commit or aid unlawful activity
This is often central. Employment, tax preparation, bookkeeping, healthcare, education, family assistance, credit repair, legal services, shipping, and IT work regularly involve other people’s identifying information. Lawful access plus poor data handling is not automatically identity theft. The State must prove criminal intent tied to qualifying unlawful activity.
No knowing possession or control
Documents in a shared vehicle, files in a shared folder, messages in a group chat, cached data, email attachments, or information on a borrowed device do not inevitably establish conscious dominion and control. Access history, ownership, user profiles, physical possession, and surrounding conduct matter.
Authorization or legitimate claim of right
A person may have consent or legal authority to use identity information for a stated purpose. Agency, power of attorney, employment, joint accounts, business roles, caregiving, and household practices should be documented. Authorization is limited: permission to pay a bill may not include opening credit, and access for work may not permit personal use.
The alleged information does not identify a specific person or entity
Generic data, a common name without more, fictitious information, a parody persona, or an unusable number may not meet the definition. The State should show how the information, alone or with other information, identifies a specific individual or entity.
Mistaken digital attribution
Shared networks, compromised accounts, spoofed email, cloned phones, remote desktop tools, reused devices, and malware can point investigators to the wrong person. Defense analysis should compare account access, device artifacts, location, timestamps, financial benefit, delivery, and communication.
The underlying activity does not qualify
The State must prove intent toward “unlawful activity” as the identity statute defines it. A civil contract dispute, policy violation, embarrassing impersonation, or noncriminal deception does not automatically qualify. The complaint and jury instructions should identify a legally covered felony or nonfelony theft, swindle, forgery, fraud, or false-information offense.
Victim count is inflated
One person’s identity may appear in several records without creating several direct victims. An entity may be an indirect victim rather than a direct identity owner. Junk mail or nonprivate material may not support the same classification as sensitive identifying data under Moua. Count errors can change the felony level dramatically.
Loss is inflated or duplicated
Authorization holds, declined purchases, reversals, refunds, insurer payments, replacement transactions, and overlapping remediation expenses should be separated. Loss must be caused by the offense and supported. The same amount should not be assigned to both a consumer and bank without a legal basis.
Aggregation is improper
The State may aggregate only within a six-month period and only as the statute permits. Different actors, unrelated events, items outside the period, unproved identities, and transactions not attributable to the accused should not be folded into one total.
Suppression and evidentiary challenges
Statements, device searches, account warrants, vehicle searches, and home searches may be challenged. Evidence may also draw authentication, hearsay, completeness, expert-foundation, chain-of-custody, and unfair-prejudice objections. A large data dump is not self-authenticating proof of who created or intended each item.
Sentencing Guidelines and collateral consequences
Severity levels vary sharply
The current Minnesota Sentencing Guidelines offense-severity table ranks identity theft involving two or three direct victims or $501 through $2,500 loss at level 2; four through seven direct victims or loss over $2,500 at level 3; and eight or more direct victims or loss over $35,000 at level 8. Identity theft related to child sexual abuse material is also level 8. Phishing and scanner/reencoder offenses are level 2.
The presumptive sentence is determined from severity level and criminal-history score, subject to applicable rules and lawful departures. The statutory maximum sets the outer limit, not an automatic prison term.
Restitution can dominate the case
Mandatory minimum restitution of $1,000 per direct victim can produce a large judgment. Additional direct and indirect losses may be ordered. A sentencing submission should address direct-victim status, causation, documentation, offsets, ability to pay where legally relevant, and a realistic payment structure.
Probation conditions
Conditions may restrict Internet or device use, financial employment, account access, contact with victims, possession of identity documents, and association. Courts may order searches, treatment, restitution, fines, jail, and disclosure of accounts within lawful limits. Conditions should be clear, proportionate, and connected to rehabilitation or public safety.
Employment and licensing
Identity-theft convictions can affect work involving money, data, healthcare, government benefits, children, vulnerable adults, fiduciary duties, security clearances, or professional licensing. Background-study and licensing consequences vary by offense level and role. They should be investigated before a plea.
Immigration
Fraud, theft, loss, sentence, and victim facts may carry immigration consequences. Noncitizens need advice from qualified immigration counsel before resolving the criminal case. A state offense title alone does not answer the federal immigration analysis.
Expungement
Eligibility depends on the final disposition and degree. Dismissals and acquittals have different rules from convictions; felony eligibility requires checking the current statutory list and waiting period. The official starting point is Minn. Stat. § 609A.02 (2026).
What happens after an identity-theft investigation begins
Investigation
Law enforcement may collect victim reports, bank and merchant data, mail, surveillance, applications, delivery records, device and account data, and search-warrant evidence. Financial institutions may release limited account-holder information under the statute after a qualifying written certification. Investigators often build timelines and link charts before charging.
Charging and first appearance
The complaint should state the identity, alleged unlawful activity, direct-victim count, loss tier, aggregation period, and venue. Release conditions may restrict financial accounts, devices, Internet access, contact, travel, or employment. Counsel should seek terms that protect the case without making lawful work or family life impossible.
Discovery and independent review
Discovery may include thousands of pages and large forensic images. It should be organized by alleged victim, identifier, act, date, device, account, benefit, and loss. Defense experts may be useful for device forensics, account attribution, deepfake analysis, banking systems, or loss accounting.
Motions
Motions may challenge probable cause, particularity and scope of digital warrants, custodial statements, vehicle or home searches, joinder, venue, aggregation, victim count, expert evidence, and authentication. Legal disputes should be separated from factual disputes so the jury receives accurate elements and penalty-tier questions.
Negotiation or trial
A negotiated outcome can address count reduction, loss stipulations, victim count, restitution, disposition, jail or prison, probation, device conditions, and dismissal of overlapping charges. Any offer should be compared with trial proof and collateral consequences. At trial, the State must prove every element beyond a reasonable doubt; the defense need not prove who else committed the offense.
Immediate steps
- Do not delete files, wipe devices, close accounts, or alter transaction records.
- Do not contact alleged victims or coordinate explanations with witnesses.
- Preserve devices, security notices, account history, employment authorizations, consent, contracts, and communications.
- Document who had access to shared devices, vehicles, homes, networks, cloud folders, and accounts.
- Do not provide an unplanned statement or passwords without legal advice.
- Have counsel obtain warrants, forensic reports, provider records, and the State’s complete victim-and-loss calculation.
Frequently asked questions about Minnesota identity theft
Is using someone else’s name always identity theft?
No. The State must prove transfer, possession, or use of an identity not your own and intent to commit, aid, or abet qualifying unlawful activity. Shared names, mistakes, parody, or authorized use are not automatically criminal.
Can possession alone be charged?
Yes, if the State proves possession of another’s identity with the required intent toward unlawful activity. Sensitive information found nearby does not by itself establish knowing control or criminal intent.
Does the State have to prove financial loss?
Not always. Victim count can create felony exposure without financial loss, and possession with criminal intent can complete subdivision 2. The phishing offense expressly applies even when no identity is obtained or loss occurs.
Can a business be a direct victim?
Yes. The statute protects individuals and entities. A business can be direct when its identity was transferred, possessed, or used; another organization that suffers loss may instead be an indirect victim.
Do deepfakes count as identity theft?
Some can. Current law includes a realistic forged digital likeness created or altered through technical means that misrepresents a real individual’s appearance, speech, or conduct. The State still must prove criminal transfer, possession, or use and intent toward unlawful activity.
Is an unsuccessful phishing email a crime?
Potentially. Subdivision 5a requires a qualifying Internet false pretense and intent to obtain identity. It expressly says failure to obtain or use identity and absence of loss are not defenses.
What is the penalty for one victim and less than $250 loss?
For one direct victim and combined loss of $250 or less, the maximum is 90 days and a $1,000 fine. A second direct victim raises the case to the five-year tier regardless of that low loss.
How do eight alleged victims affect the charge?
Eight or more direct victims trigger the highest general tier: up to 20 years and a $100,000 fine, with a Guidelines severity level of 8. Direct-victim classification should be audited carefully.
Can transactions be combined?
Yes. The State may aggregate value received or victim count within any six-month period under subdivision 2. Items outside the period, duplicates, unrelated actors, and unproved events should be excluded.
What is the difference between direct and indirect victims?
The direct victim owns the identity transferred, used, or possessed. An indirect victim is another person or entity suffering covered harm or loss. Direct victims determine the victim-count tier; both can contribute to combined loss.
Is restitution automatically at least $1,000?
After a subdivision 2 conviction, the court must order at least $1,000 for each direct victim. Additional proven loss may be ordered. Classification and number of direct victims therefore matter greatly.
Can an IP address prove who committed identity theft?
Not by itself. It identifies a network connection. Shared users, VPNs, public Wi-Fi, carrier systems, compromised accounts, device evidence, login data, delivery, and financial benefit affect attribution.
Can police search all data on my phone?
A warrant or exception must authorize the search, and warrants must satisfy probable cause and particularity requirements. Scope, time period, categories searched, execution, and connection to the alleged crime can be challenged.
Can identity theft be expunged?
Potentially, depending on dismissal, conviction level, waiting period, later history, and current statutory eligibility. The exact final disposition—not merely the original charge—controls the analysis.
What should I do if I am under investigation?
Preserve devices and records, stop discussing the case, do not contact alleged victims, and do not delete or “clean up” data. Have counsel identify the alleged identity, unlawful activity, victim count, loss, warrants, and digital attribution before deciding whether to make a statement.