Crimes: Identity Theft and “Phishing”
To address identity theft, section 609.527 (Minnesota’s identity theft law) criminalizes two types of behavior. First, it is a crime to transfer, possess, or use an identity that is not the person’s own, with the intent to commit, aid, or abet any unlawful activity. Minn. Stat. § 609.527, subd. 2. Second, the law criminalizes the electronic use of a false pretense to obtain another’s identity, often referred to as “phishing.” Minn. Stat. § 609.527, subd. 5a.
For purposes of both crimes, the following definitions apply:
- Direct victim: A person or entity who incurs a loss or harm and whose identity has been transferred, used, or possessed in violation of section 609.527
- Indirect victim: A person or entity, other than a direct victim, who incurs a loss or harm (This is typically a bank or financial institution.)
- Identity: Any name, number, or data transmission that may be used, alone or in conjunction with any other information, to identify a specific individual, including
- name, Social Security number, date of birth, driver’s license, passport, employer or taxpayer identification number;
- unique electronic identification number, address, account number, or routing code; or
- telecommunication identification information or access device.
- Loss: Value obtained and expenses incurred
Definition of Identity Theft
Section 609.527, subdivision 2, prohibits transferring, possessing, or using another’s identity with the intent to perpetrate any unlawful activity. Unlawful activities include any felony violations and lesser offenses involving theft, forgery, fraud, or misrepresentation to a public official. An unlawful activity is not limited to illegal acts for financial gain. The threshold question under subdivision 2 is whether the perpetrator intended to use another’s identity to commit a crime. Identity theft is often associated with financial crimes, such as theft, financial transaction card fraud, or check fraud. These financial crimes fall under the purview of subdivision 2. In the case of nonfinancial identity theft, a crime may also be involved. For example, the typical case of criminal record identity theft involves a person giving another’s identity to law enforcement or the court to avoid prosecution. Under Minnesota law, it is a gross misdemeanor to provide false information to a public official or court official. In the case of reverse record identity theft, the thief uses another’s identity when applying for a job or an apartment to conceal a criminal record. It is a crime to forge a document for purposes of identification.3 These cases of nonfinancial identity theft would fall under the criminal definition of identity theft.
Definition of “Phishing”
Another provision in the law specifically criminalizes the use of “phishing” schemes to obtain another’s identifying information. Minn. Stat. § 609.527, subd. 5a. In a typical phishing scheme, a perpetrator uses fraudulent e-mail messages that appear to come from legitimate businesses. Authentic-looking messages are designed to fool recipients into divulging personal data such as account numbers, passwords, credit card numbers, and Social Security numbers.
Under subdivision 5a, it is a crime to use a false pretense in an e-mail or web page to trick a victim into divulging his or her personal information. A “false pretense” is defined as “any false, fictitious, misleading, or fraudulent information or pretense or pretext depicting or including or deceptively similar to the name, logo, Web site address, e-mail address, postal address, telephone number, or any other identifying information of a for-profit or not-for-profit business or organization or of a government agency, to which the user has no legitimate claim of right.” Minn. Stat. § 609.527, subd. 1(c).
An important piece of the phishing legislation provides that a crime is committed even if a person does not obtain or use another’s identity. The statute specifically forecloses the following defenses:
- the person committing the offense did not obtain another’s identity
- the person committing the offense did not use another’s identity
- the offense did not result in a financial loss or other loss to any person
There are separate penalty provisions for identity theft and phishing. Identity theft penalties vary and are tied to the resulting loss or harm involved. Because the crime of “phishing” is related to the conduct involved, whether or not it results in harm or loss, the penalty is fixed.
Identity Theft Penalties
The penalties for identity theft range from a misdemeanor to a 20-year felony. The offense level correlates with the amount of loss incurred, the number of direct victims involved, or the related offense. Loss is defined as the value obtained and the expenses incurred as a result of the crime.
Penalties for financial crimes are readily distinguishable by the monetary loss thresholds. For example, if the amount of loss is $250 or less, the maximum penalty is a misdemeanor. If the amount of loss is more than $35,000, the maximum penalty is a 20-year felony. Nonfinancial crimes that result in zero loss and involve only one victim default to the misdemeanor penalty. If a crime involves more than one victim, the penalty is raised to a felony.
Identity Theft Penalties
Minn. Stat. § 609.527, subd. 3.
|Number of Direct Victims||Combined Loss to Direct and
Indirect Victims/or Crime
|Penalty – Maximum
|1||$250 or less||90 days/$1,000||Misdemeanor|
|1||$251 to $500||1 year/$3,000||Gross misdemeanor|
|1||$501 to $2,500||5 years/$10,000||Felony|
|1||$2,501 to $35,000||10 years/$20,000||Felony|
|1||More than $35,000||20 years/$100,000||Felony|
|1+||Possession or distribution of
pornographic work involving
minors (§§ 617.246-617.247)
|2 or 3||Any amount||5 years/$10,000||Felony|
|4 to 7||Any amount||10 years/$20,000||Felony|
|8+||Any amount||20 years/$100,000||Felony|
For phishing crimes, the maximum penalty is a five-year felony and/or a $10,000 fine. Minn. Stat. § 609.527, subd. 5a.
This and any related posts have been adopted from the Minnesota House of Representatives Research Department’s Information Brief, Identity Theft and Related Crimes, written by legislative analyst Rebecca Pirius.
3 Certain misrepresentations on background checks are also made crimes by statute. For example, a person who makes a false representation to obtain a permit to possess, purchase, or carry certain firearms is guilty of a gross misdemeanor. Minn. Stat. §§ 624.7131, 624.7132, 624.714.