According to the Federal Trade Commission, identity theft is the most common complaint from consumers in all 50 states, and accounts for over 35% of the total number of complaints the Identity Theft Data Clearinghouse received for calendar years 2004, 2005, and 2006. In calendar year 2006, of the 674,354 complaints received, 246,035 or 36% were identity theft complaints. The identity theft victim's information was misused for credit card fraud in 25% of the identity theft complaints; for phone or utilities fraud in 16% of the identity theft complaints; for bank fraud in 16% of the identity theft complaints; for employment-related fraud in 14% of the identity theft complaints; for government documents or benefits fraud in 5% of the identity theft complaints; for loan fraud in 5% of the identity theft complaints; and other types of identity theft fraud made up 24% of the complaints. As a result of identity theft, victims may incur damaged credit records, unauthorized charges on credit cards, and unauthorized withdrawals from bank accounts. Sometimes, victims must change their telephone numbers or even their social security numbers. Victims may also need to change addresses that were falsified by the impostor. With media reports of data security breaches increasing, concerns about new cases of identity theft are widespread. This report provides an overview of the federal laws that could assist victims of identity theft with purging inaccurate information from their credit records and removing unauthorized charges from credit accounts, as well as federal laws that impose criminal penalties on those who assume another person's identity through the use of fraudulent identification documents. This report will be updated as warranted. While not exclusively aimed at consumer identity theft, the Identity Theft Assumption Deterrence Act prohibits fraud in connection with identification documents under a variety of circumstances. Certain offenses under the statute relate directly to consumer identity theft, and impostors could be prosecuted under the statute. For example, the statute makes it a federal crime, under certain circumstances, to knowingly and without lawful authority produce an identification document, authentication feature , or false identification document; or to knowingly possess an identification document that is or appears to be an identification document of the United States which is stolen or produced without lawful authority knowing that such document was stolen or produced without such authority. It is also a federal crime to knowingly transfer or use, without lawful authority, a means of identification of another person with the intent to commit, or aid or abet, any unlawful activity that constitutes a violation of federal law, or that constitutes a felony under any applicable state or local law. The punishment for offenses involving fraud related to identification documents varies depending on the specific offense and the type of document involved. For example, a fine or imprisonment of up to 15 years may be imposed for using the identification of another person with the intent to commit any unlawful activity under state law, if, as a result of the offense, the person committing the offense obtains anything of value totaling $1,000 or more during any one-year period. Other offenses carry terms of imprisonment up to three years. However, if the offense is committed to facilitate a drug trafficking crime or in connection with a crime of violence, the term of imprisonment could be up to twenty years. Offenses committed to facilitate an action of international terrorism are punishable by terms of imprisonment up to twenty-five years. The Identity Theft Penalty Enhancement Act was signed on July 15, 2004, ( P.L. 108-275 ). The act amends Title 18 of the United States Code to define and establish penalties for aggravated identity theft and makes changes to the existing identity theft provisions of Title 18. Under the law, aggravated identity theft occurs when a person "knowingly transfers, possess, or uses, without lawful authority, a means of identification of another person" during and in relation to the commission of certain enumerated felonies. The penalty for aggravated identity theft is a term of imprisonment of two years in addition to the punishment provided for the original felony committed. Offenses committed in conjunction with certain terrorism offenses are subject to an additional term of imprisonment of five years. The act also directs the United States Sentencing Commission to "review and amend its guidelines and its policy statements to ensure that the guideline offense levels and enhancements appropriately punish identity theft offenses involving an abuse of position" adhering to certain requirements outlined in the legislation. In addition to increasing penalties for identity theft, the act authorized appropriations to the Justice Department "for the investigation and prosecution of identity theft and related credit card and other fraud cases constituting felony violations of law, $2,000,000 for FY2005 and $2,000,000 for each of the 4 succeeding fiscal years." While the Fair Credit Reporting Act (FCRA) does not directly address identity theft, it could offer victims assistance in having negative information resulting from unauthorized charges or accounts removed from their credit files. The purpose of the FCRA is "to require that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information." The FCRA outlines a consumer's rights in relation to his or her credit report, as well as permissible uses for credit reports and disclosure requirements. In addition, the FCRA imposes a duty on consumer reporting agencies to ensure that the information they report is accurate, and requires persons who furnish information to ensure that the information they furnish is accurate. The FCRA allows consumers to file suit for violations of the act, which could include the disclosure of inaccurate information about a consumer by a credit reporting agency. A consumer who is a victim of identity theft could file suit against a credit reporting agency for the agency's failure to verify the accuracy of information contained in the report and the agency's disclosure of inaccurate information as a result of the consumer's stolen identity. Under the FCRA, as recently amended, a consumer may file suit not later than the earlier of two years after the date of discovery by the plaintiff of the violation that is the basis for such liability, or five years after the date on which the violation occurred. The FACT Act, signed on December 4, 2003, includes, inter alia , a number of amendments to the Fair Credit Reporting Act aimed at preventing identity theft and assisting victims. Generally, these new provisions mirror laws passed by state legislatures and create a national standard for addressing consumer concerns with regard to identity theft and other types of fraud. Credit card issuers, who operate as users of consumer credit reports, are required, under a new provision of the FCRA, to follow certain procedures when the issuer receives a request for an additional or replacement card within a short period of time following notification of a change of address for the same account. In a further effort to prevent identity theft, other new provisions require the truncation of credit card account numbers on electronically printed receipts, and, upon request, the truncation of social security numbers on credit reports provided to a consumer. Consumers who have been victims of identity theft, or expect that they may become victims, are now able to have fraud alerts placed in their files. Pursuant to the new provisions, a consumer may request a fraud alert from one consumer reporting agency and that agency is required to notify the other nationwide consumer reporting agencies of the existence of the alert. In general, fraud alerts are to be maintained in the file for 90 days, but a consumer may request an extended alert which is maintained for up to seven years. The fraud alert becomes a part of the consumer's credit file and is thus passed along to all users of the report. The alert must also be included with any credit score generated using the consumer's file, and must be referred to other consumer reporting agencies. In addition to the fraud alert, victims of identity theft may also have information resulting from the crime blocked from their credit reports. After the receipt of appropriate proof of the identity of the consumer, a copy of an identity theft report, the identification of the alleged fraudulent information, and a statement by the consumer that the information is not information relating to any transaction conducted by the consumer, a consumer reporting agency must block all such information from being reported and must notify the furnisher of the information in question that it may be the result of identity theft. Requests for the blocking of information must also be referred to other consumer reporting agencies. Victims of identity theft are also allowed to request information about the alleged crime. A business entity is required, upon request and subject to verification of the victim's identity, to provide copies of application and business transaction records evidencing any transaction alleged to be a result of identity theft to the victim or to any law enforcement agency investigating the theft and authorized by the victim to take receipt of the records in question. The Fair Credit Billing Act (FCBA) is not an identity theft statute per se , but it does provide consumers with an opportunity to receive an explanation and proof of charges that may have been made by an impostor and to have unauthorized charges removed from their accounts. The purpose of the FCBA is "to protect the consumer against inaccurate and unfair credit billing and credit card practices." The law defines and establishes a procedure for resolving billing errors in consumer credit transactions. For purposes of the FCBA, a "billing error" includes unauthorized charges, charges for goods or services not accepted by the consumer or delivered to the consumer, and charges for which the consumer has asked for an explanation or written proof of purchase. Under the FCBA, consumers are able to file a claim with the creditor to have billing errors resolved. Until the alleged billing error is resolved, the consumer is not required to pay the disputed amount, and the creditor may not attempt to collect, any part of the disputed amount, including related finance charges or other charges. The act sets forth dispute resolution procedures and requires an investigation into the consumer's claims.