Policymakers continue to be concerned with securing the economic health of the United States—including combating those crimes that threaten to undermine the nation's financial stability. Identity theft, for one, poses both security and economic risks. By some estimates, identity fraud cost Americans nearly $21 billion in 2012. Federal Trade Commission (FTC) complaint data indicate that the most common fraud complaint received (18% of all consumer fraud complaints) is that of identity theft. In 2012, for instance, about 12.6 million Americans were reportedly victims of identity fraud. This is an increase from the approximately 11.6 million who were victimized in 2011 and 10.2 million who were victimized in 2010. Mirroring this increase in the overall number of reported identity fraud incidents, consumer costs relating to these incidents increased in 2012; the average identity fraud victim incurred a mean of $365. Nonetheless, this cost is about 42% less than the average expense roughly a decade ago. An increase in globalization and a lack of cyber borders provide an environment ripe for identity thieves to operate from within the nation's borders—as well as from beyond. Federal law enforcement is thus challenged with investigating criminals who may or may not be operating within U.S. borders; may have numerous identities—actual, stolen, or cyber; and may be acting alone or as part of a sophisticated criminal enterprise. In addition, identity theft is often interconnected with various other criminal activities. These activities range from credit card and bank fraud to immigration and employment fraud. In turn, the effects felt by individuals and businesses who have fallen prey to identity thieves extend outside of pure financial burdens; identity thieves affect not only the nation's economic health, but its national security as well. Consequently, policymakers may debate the federal government's role in preventing identity theft and its related crimes, mitigating the potential effects of identity theft after it occurs, and providing the most effective tools to investigate and prosecute identity thieves. This report first provides a brief federal legislative history of identity theft laws. It analyzes selected trends in identity theft, including prevalent identity theft-related crimes, the federal agencies involved in combating identity theft, and the trends in identity theft complaints and prosecutions. The report also discusses the relationship between data breaches and identity theft as well as possible effects of the FTC's Identity Theft Red Flags Rule. It also examines possible issues for Congress to consider. When does taking and using someone else's identity become a crime? Current federal law defines identity theft as a federal crime when someone knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, or in connection with, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law. The current federal law also provides enhanced penalties for aggravated identity theft when someone "knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person" in the commission of particular felony violations. Aggravated identity theft carries an enhanced two-year prison sentence for most specified crimes and an enhanced five-year sentence for specified terrorism violations. Identity theft is also defined in the Code of Federal Regulations (CFR) as "fraud committed or attempted using the identifying information of another person without permission." Identity theft can both facilitate and be facilitated by other crimes. For example, identity theft may make possible crimes such as bank fraud, document fraud, or immigration fraud, and it may be aided by crimes such as theft in the form of robbery or burglary. Therefore, one of the primary challenges in analyzing the trends in identity theft (e.g., offending, victimization, or prosecution rates)—as well as the policy issues that Congress may wish to consider—arises from this interconnectivity between identity theft and other crimes. Identity theft and identity fraud are terms that are often used interchangeably. Identity fraud is the umbrella term that refers to a number of crimes involving the use of false identification—though not necessarily a means of identification belonging to another person. Identity theft is the specific form of identity fraud that involves using the personally identifiable information of someone else. Both identity fraud and identity theft are crimes often committed in connection with other violations, as mentioned above. Identity theft, however, may involve an added element of victimization, as this form of fraud may directly affect the life of the victim whose identity was stolen in addition to defrauding third parties (such as the government, employers, consumers, financial institutions, and health care and insurance providers, just to name a few). This report, however, maintains a focus on identity theft rather than the broader term of identity fraud. Another definitional issue is one that went before the U.S. Supreme Court. The statutory definitions of identity theft and aggravated identity theft indicate that they are crimes when someone " knowingly [emphasis added] transfers, possesses, or uses, without lawful authority, a means of identification of another person" in conjunction with specified felony violations outlined in the U.S. Code. The definitional element under question was the word "knowingly." In Flores-Figueroa v. United States , the Court decided that in order to be found guilty of aggravated identity theft, a defendant must have knowledge that the means of identification he used belonged to another individual. It is not sufficient to only have knowledge that the means of identification used was not his own. Although the case before the Court specifically involved aggravated identity theft, the issue may apply to the identity theft statute as well, due to its overlap in wording about the element of knowledge. Since the Court has issued its final decision in Flores-Figueroa v. United States , Congress may wish to consider whether there is a need to clarify the difference between these two types of knowledge in the U.S. Code. If a clarification is warranted, Congress may wish to consider whether the identity theft and aggravated identity theft statutes should be amended to reflect the definitions of both types of knowledge. Until 1998, identity theft was not a federal crime. Leading up to Congress designating identity theft as a federal crime, identity fraud was on the rise, and the Internet was increasingly being used as a method of defrauding innocent victims. Law enforcement and policymakers suggested that the current laws at the time were ineffective at combating the growing prevalence of identity theft; the laws were not keeping up with technology, and stronger laws were needed to investigate and punish identity thieves. In addition, policymakers also suggested that industries that handled records containing individuals' personally identifiable information—such as credit, medical, and criminal records—needed superior methods to ensure the validity of the information they collected and utilized. In 1998, Congress passed the Identity Theft Assumption Deterrence Act ( P.L. 105-318 ), which criminalized identity theft at the federal level. In addition to making identity theft a crime, this act provided penalties for individuals who either committed or attempted to commit identity theft and provided for forfeiture of property used or intended to be used in the fraud. It also directed the FTC to record complaints of identity theft, provide victims with informational materials, and refer complaints to the appropriate consumer reporting and law enforcement agencies. The FTC now records consumer complaint data and reports it in the Identity Theft Data Clearinghouse; identity theft complaint data are available for 2000 and forward. Congress further strengthened the federal government's ability to prosecute identity theft with the passage of the Identity Theft Penalty Enhancement Act ( P.L. 108-275 ). This act established penalties for aggravated identity theft , in which a convicted perpetrator could receive additional penalties (two to five years' imprisonment) for identity theft committed in relation to other federal crimes. Examples of such federal crimes include theft of public property, theft by a bank officer or employee, theft from employee benefit plans, false statements regarding Social Security and Medicare benefits, several fraud and immigration offenses, and specified felony violations pertaining to terrorist acts. Most recently, Congress enhanced the identity theft laws by passing the Identity Theft Enforcement and Restitution Act of 2008 (Title II of P.L. 110-326 ). Among other elements, the act authorized restitution to identity theft victims for their time spent recovering from the harm caused by the actual or intended identity theft. In addition to congressional efforts to combat identity theft, there have been administrative efforts as well. The President's Identity Theft Task Force (Task Force) was established in May 2006 by Executive Order 13402. The task force was created to coordinate federal agencies in their efforts against identity theft, and it was charged with creating a strategic plan to combat (increase awareness of, prevent, detect, and prosecute) identity theft. It was composed of representatives from 17 federal agencies. In April 2007, the task force authored a strategic plan for combating identity theft in which it made recommendations in four primary areas: preventing identity theft by keeping consumer data out of criminals' hands, preventing identity theft by making it more difficult for criminals to misuse consumer data, assisting victims in detecting and recovering from identity theft, and deterring identity theft by increasing the prosecution and punishment of identity thieves. With respect to identity theft prevention, the task force suggested that decreasing the use of Social Security numbers (SSNs) in the public sector and reviewing the use of SSNs in the private sector could help prevent identity theft. Also, the task force suggested that educating employers and individuals on how to safeguard data, as well as establishing national data protection and breach notification standards, could further aid in preventing identity theft. Relating to victim assistance, the task force suggested that identity theft victims may be better served if first responders were specially trained to assist this particular class of victim. It also addressed victim redress by recommending that identity theft victims be able to obtain an alternative identification document after the theft of their identities. Through the Identity Theft Enforcement and Restitution Act of 2008 (Title II of P.L.