Despite SCOTUS Ruling, Aggravated Identity Theft Statute Ripe for Overreach

By Andrew Mancilla and Robert Fantone

In 2004, when identity theft emerged as a significant threat to individuals and institutions alike, Congress enacted 18 U.S.C. §1028A, entitled “Aggravated Identity Theft,” to impose stricter penalties on offenders. The statute imposes a non-discretionary two-year prison sentence for offenders who, “during and in relation to any [predicate offense], knowingly transfer, possess, or use, without lawful authority, a means of identification of another person.”
Predicate offenses encompass a wide range of crimes, including healthcare fraud and wire fraud, and the two-year mandatory minimum must run consecutively to the sentences imposed for the predicate and other offenses charged.
While intended to target classic identity theft, the statute’s ambiguous language has allowed prosecutors to apply it expansively, often leading to disproportionate sentences for defendants whose actions fall outside the traditional understanding of identity theft.
The Supreme Court’s June 2023 decision in Dubin v. United States, 599 U.S. 110 (2023), aimed to curb this prosecutorial overreach by narrowing the interpretation of §1028A. However, early indications suggest that the decision’s impact has been limited as the government and lower courts continue to apply the statute broadly.
This article suggests that, despite the Supreme Court’s ruling in Dubin, §1028A remains inherently vague, perpetuating unjust outcomes. Without legislative amendment or more definitive judicial guidance, the statute will continue to serve as a tool for prosecutorial overreach.
|

‘Dubin’s’ Attempt To Narrow §1028A

Since its enactment, “[t]he Government has, by its own admission, wielded §1028A(a)(1) well beyond the ordinary meanings of identity theft.” Dubin, 599 U.S. at 115. The government’s expansive application of §1028A has enabled prosecutors to charge it in undeserving cases, often using the threat of the mandatory two-year minimum prison sentence as undue leverage to secure more favorable plea agreements. The government’s liberal use of the statute has resulted in overly harsh penalties for crimes that do not conform to the statute’s original purpose.
Recognizing this growing inequity, the Supreme Court in Dubin sought to narrow the statute’s interpretation by clarifying what it means to “use” a “means of identification” under §1028A. The defendant David Dubin, who managed a psychological services company, submitted reimbursement claims to Medicaid that inflated the reimbursement amounts his company was entitled to.
Specifically, Dubin “overstated the qualifications of the employee that actually performed the testing,” thus causing an undue inflation in the reimbursement his company received from Medicaid. Dubin, 599 U.S. at 114. Because Dubin’s inflated requests included the patients’ Medicaid reimbursement numbers (a “means of identification” per 18 U.S.C. §1028(d)(7)), the government charged Dubin with aggravated identity theft in addition to healthcare fraud and other crimes.
Dubin was subsequently convicted of two counts of health care fraud and related offenses, resulting in a sentence of one year and one day incarceration. He was also convicted of aggravated identity theft for which the court imposed a consecutive two-years’ incarceration, thus tripling his sentence.
In a decision written by Justice Sonia Sotomayor, the Supreme Court ruled in Dubin’s favor, holding that §1028A should not apply to cases where identity use is incidental to the underlying crime, even when use of another’s identity is necessary to complete the criminal transaction.
The Supreme Court recognized that if the statute were read too broadly, it could apply to virtually any crime involving someone else’s name or identifying information and thus sought to bring §1028A back in line with its original purpose. Id. at 127.
The Dubin court concluded that the aggravated identity theft statute requires “a more targeted reading [that] accurately captures the ordinary understanding of identity theft, where misuse of a means of identification is at the crux of the criminality.” Id. at 120 (emphasis added).The decision stated:
To be clear, being at the crux of the criminality requires more than a causal relationship, such as ‘facilitation’ of the offense or being a but-for cause of its ‘success.’ Instead, with fraud or deceit crimes like the one in this case, the means of identification specifically must be used in a manner that is fraudulent or deceptive. Such fraud or deceit going to identity can often be succinctly summarized as going to ‘who’ is involved.
Id. at 131-32 (internal citation omitted).
The Dubin court further emphasized: “[c]rimes are supposed to be defined by the Legislature, not by clever prosecutors riffing on equivocal language” (id. at 129-30 (internal quotations omitted)) and further cautioned that “we cannot construe a criminal statute on the assumption that the Government will use it responsibly,” explaining:
[T]o rely upon prosecutorial discretion to narrow the otherwise wide-ranging scope of a criminal statute’s highly abstract general statutory language places great power in the hands of the prosecutor. This concern is particularly salient here. If §1028A(a)(1) applies virtually automatically to a swath of predicate offenses, the prosecutor can hold the threat of charging an additional 2-year mandatory prison sentence over the head of any defendant who is considering going to trial.
Id. at 131 (internal citations and quotations omitted).
|

§1028A Post Dubin

Despite the Supreme Court’s effort to narrow the scope of §1028A, the government and lower courts continue to apply the statute broadly. Courts have dismissed §1028A charges in only a handful of cases since Dubin, and it is difficult to distinguish those dismissals from cases where the convictions were upheld.
For instance, in United States v. Shepard, 2024 U.S. Dist. LEXIS 97931 (S.D. Fla. June 3, 2024), the court vacated a §1028A conviction where the defendant, in an attempt to lend credibility to business loan applications, misrepresented that a professional accountant had prepared his tax returns by, among other things, forging the accountant’s name on relevant tax forms. Id. at *10-11.
In vacating the aggravated identity theft charge, the Shepard court noted that the “‘key mover’ in the fraud was the false payroll and business information, not the identity of the tax preparer.” Id. at *38. However, in United States v. Fullerton, 2023 U.S. Dist. LEXIS 167119 (W.D.Tx. Sept. 20, 2023), the court upheld a §1028A charge on identical facts, stating: “it is hard to identify a clearer allegation of identity theft.” Id. at *11.
In addition to §1028A’s inconsistent application, what strikes many as counterintuitive and unfair is the government’s tendency to charge aggravated identity theft without regard to whether any harm occurred to the individual whose identity was misused. In such circumstances, the §1028A charge functions to add two years to a defendant’s sentence in a somewhat arbitrary manner, often in cases that appear “well beyond the ordinary meanings of identity theft.” Dubin, 559 U.S. at 115. In fact, the majority of the post-Dubin decisions involve little to no identifiable harm to the individuals whose identities were misused.
For example, in United States v. Thomas, 2024 U.S. App. LEXIS 23685 (9th Cir. 2024), the U.S. Court of Appeals for the Ninth Circuit upheld a §1028A conviction against a defendant that forged her supervisors’ signatures to facilitate her receipt of improper reimbursements from the county. While the county suffered losses due to the defendant’s forgeries, the supervisors whose signatures were forged suffered no harm. Nevertheless, the Thomas defendant was sentenced to two years’ incarceration in addition to the one-year sentence she received for her theft of county funds.
Another seemingly unwarranted application of the statute occurred in Randall v. United States, 2024 U.S. Dist. LEXIS 95856 (E.D. Pa. May 29, 2024), where the court sustained a §1028A conviction after a defendant used the identities of his own co-conspirators to commit bank fraud. Despite the co-conspirators’ explicit consent to the use of their identities to facilitate the fraud, as well as their willing receipt of the stolen funds, the Randall court upheld the §1028A charge, adding another two years to the eight and a half year sentence the defendant received for the bank fraud.
Given the breadth of §1028A, it is difficult to imagine any forgery or bank fraud in which the §1028A charge, along with the additional two-year sentence, would not apply. And these offenses are not alone in this regard — §1028A’s non-discretionary two-year penalty has overshadowed the established sentencing structures for some of the most well-known offenses, such as mail fraud, wire fraud, and health care fraud.
These examples highlight the ongoing tension between the Supreme Court’s attempt to narrow §1028A and the practical application of the statute since the Dubin decision. They underscore the need for further clarification, either from the courts or from Congress, to ensure that the statute is applied in a manner consistent with the principles articulated in Dubin and to prevent its use in ways that lead to disproportionate or unjust outcomes.
One meaningful way to limit prosecutorial overreach would be to further confine §1028A’s application to cases in which there is actual harm to the individual whose identity was misused, thus ensuring that the enhanced penalty applies only when a defendant causes harm over and above what the underlying predicate charges already account for. Restricting the statute’s application to such situations would also achieve Dubin’s goal of bringing the statute’s enforcement in line with the conventional understanding of identity theft.
Nevertheless, the inherent vagueness of §1028A will continue to present a formidable obstacle to its consistent application. Although Dubin attempted a shift in the right direction, Justice Neil Gorsuch’s cautionary concurrence in Dubin has proven instructive. While acknowledging his colleagues’ commendable efforts to bring clarity to an unconstitutionally vague statute, he opined that §1028A is too ambiguous to salvage, forewarning: “I fear the issues that have long plagued lower courts will persist. And I will not be surprised if someday, maybe someday soon, they find their way back here.” Dubin, 599 U.S. at 139 (Gorsuch, J concurring).
Criminal defense practitioners must continue to vigorously challenge the unconstitutional vagueness of §1028A. Determining what constitutes the “crux” of a crime under the statute is largely a matter of semantic framing. As Gorsuch noted in his concurrence, the majority framed the issue by focusing on Dubin’s misrepresentation of the service provider’s qualifications, concluding that “who” received the services was not central to the crime. Id. at 137. However, framed differently, the patient’s identity was the “key mover” of the fraud because Dubin could not have billed the insurance provider without it. Id.
The question of liability under §1028A ultimately hinges on causation, which is inherently subject to interpretation. According to Dubin, even if the use of someone’s identification was material or necessary for committing an offense, such use is not automatically the “crux” of the criminality. Id. at 131. However, where that line is drawn remains unclear. Given this uncertainty, the Government should refrain from charging §1028A except in the most obvious cases.
It may be years before the Supreme Court revisits the consequences of its ruling in Dubin. In the meantime, injustice will continue to prevail for criminal defendants subject to the fundamentally ambiguous statute that may arbitrarily add two years to their prison sentences.