|
A look at Identity Fraud Legislation’s Past and Future
By Richard G. Hamp Assistant Attorney General
Identity Fraud is not a new subject. It has been occurring for centuries in one form or another. What is new is the ease in which it is committed, the staggering numbers of victims and amount of loss. To combat this new form of identity theft several statutes have been written. These statutes have been designed to provide effective tools for prosecutors to use in their fight against identity theft. Many of the statutes originated from a specific case or cases that indicated a need for new legislation. Almost all of these statutes owe their existence to the dedication and perseverance of Senator Carlene Walker.
Utah passed its first identity fraud statute in 2000. This statute was modeled after federal law and was largely the effort of Francine Giani of the Utah Consumer Protection Division and sponsored by Senator Gene Davis. It provided the following elements of identity fraud.
76-6-1102. Identity fraud crime
(1) For purposes of this part, "personal identifying information" may include: (a) name; (b) address; (c) telephone number; (d) driver's license number; (e) Social Security number; (f) place of employment: (g) employee identification numbers or other personal identification numbers; (h) mother's maiden name; (i) electronic identification numbers; (j) digital signatures or a private key; or (k) any other numbers or information that can be used to access a person's financial resources or medical information in the name of another person without the consent of that person except for numbers or information that can be prosecuted as financial transaction card offenses under Sections 76-6-506 through 76-6-506.4.
(2) A person is guilty of identity fraud when that person knowingly or intentionally: (a) obtains personal identifying information of another person; and (b) uses, or attempts to use, that information with fraudulent intent, including to obtain, or attempt to obtain, credit, goods, services, any other thing of value, or medical information in the name of another person without the consent of that person.
This statute followed the rationale of the theft statute in determining the level of the offense, with the exception of two notable differences. The first was that use of another’s medical records was a class A misdemeanor and the second was the ability to aggregate offenses over a 90-day period. A prosecutor could take all of the transactions the thief made within a 90-day period using someone else’s Id and aggregate or add the value of the thefts together to enhance the level of offense charged.
(3) Identity fraud is: (a) a class B misdemeanor if the value of the credit, goods, services, or any other thing of value is less than $300; (b) a class A misdemeanor if: (i) a value cannot be determined and the personal identifying information has been used to obtain medical information in the name of another person without the consent of that person; or (ii) the value of the credit, goods, services, or any other thing of value is or exceeds $300 but is less than $1,000; (c) a third degree felony if the value of the credit, goods, services, or any other thing of value is or exceeds $1,000 but is less than $5,000; or (d) a second degree felony if the value of the credit, goods, services, or any other thing of value is or exceeds $5,000.
(4) Multiple violations within a 90-day period may be aggregated into a single offense, and the degree of the offense is determined by the total value of all credit, goods, services, or any other thing of value used, or attempted to be used, through the multiple violations.
The 2000 legislation also provided that jurisdiction for investigating identity fraud was with the Consumer Protection Division. This would later cause more problems than what it was worth for the Consumer Protection Division. A unique feature was the provision for a court to make a finding that the victim did not commit the crime. This provision is often overlooked by the prosecution but can be useful if the victim is having problems convincing third parties that he or she was not the perpetrator.
76-6-1103. Investigation, jurisdiction, and prima facie evidence of violation.
(1) In any criminal proceeding brought pursuant to this section, the crime shall be considered to have been committed in any county in which any part of the identity fraud took place, regardless of whether the defendant was ever actually in that county.
(2) The Division of Consumer Protection has responsibility for investigating violations of this part.
(3) A criminal conviction under this part is prima facie evidence of a violation of Section 13-11-4 , of the Utah Consumer Sales Practices Act.
(4) Any violation of this part constitutes a violation of Section 13-11-4 , of the Utah Consumer Sales Practices Act.
76-6-1104. Court records. In any case in which a person commits identify fraud and uses the personal identifying information obtained to commit a crime in addition to the identity fraud, the court shall make appropriate findings in any prosecution of such a crime that the person whose identity was falsely used to commit the crime did not commit the crime.
This statutory scheme provided a good start. However there were problems that needed to be addressed. In 2002 it became apparent that a large number of illegal immigrants were using other people’s social security numbers to obtain employment. The debate was where in the statute did employment fit and how? No one disagreed with the fact that employment was something of value, but how do you value it? The wages earned? Over what time period? To get around this debate a simple solution was to add employment as a defined value in the code. Therefore the 2002 amendment added the phrase “or to obtain employment.” The statute now reads:
(b) a Class A misdemeanor if:
(i) a value cannot be determined and the personal identifying information has been used without the consent of that person to obtain medical information or to obtain employment.
Another change that occurred in 2002 was to clarify the language in section 76-6-1103 to include other law enforcement agencies in addition to the Consumer Protection Division as has having jurisdiction over the crime of identity theft. The statute now reads: “In addition to investigations conducted by law enforcement agencies, the Division of Consumer Protection also has responsibility for investigating violations of this part where identity fraud is the primary violation that is alleged to have been committed.” This change was made because there were simply too many identity theft cases for the Consumer Protection to handle with its limited compliment of investigators.
By the year 2003, a number of problems with the identity fraud statute had become apparent. The first problem was with the phrases found in paragraphs 2a and 2b of chapter 1102 that stated without the authorization of that person; and without the consent of that person; These statements required the prosecution to prove as an element that the defendant did not have the permission of the victim to use his or her information. Not hard, simply put the victim on the stand and have him or her testify. However this could be very expensive with identity fraud victims that were often located in another state. With this in mind the phrases were eliminated. Now the prosecution just needed to show that the crime was committed with fraudulent intent. This would not require bringing the victim from out of state to testify.
The second problem was that the impact on identity theft victims was much greater than a simple theft. If someone stole your VCR you could replace it easily in most cases. If someone steals your identity and uses it to purchase even an inexpensive item on your credit, the damage done costs the victim hundreds of hours and even years to fix. In addition, there is a greater feeling of personal intrusion to the victim with an identity theft crime. With this in mind, the ratcheting up scheme of increasing the level of the offense depending on the value of the property stolen was altered.
As the legislation was originally proposed all identity theft offenses would be classified as felonies. There would be no misdemeanors. However, the legislature chose to ad Class A misdemeanors back in. Class B misdemeanors were eliminated. This was not the end of the drive to eliminate the misdemeanor classification. (See 2004 changes). All identity theft started as at least a Class A misdemeanor up to $1000.00; $1000.00 to $5000.00 a third degree felony; over $5000.00 a second-degree felony. This eliminated the necessity of artificially valuing identity theft used to obtain employment and medical records as Class A misdemeanors. The language was removed.
Another change was to allow aggregation of the conduct of an identity thief during the entire time he used someone else’s personal identification to commit crimes. There was no longer a limit of 90 days for the aggregation. An identity thief who stole someone else’s id and used it for longer than 90 days could be held accountable for all crimes committed in an aggregated sum without an arbitrary cutoff at 90 days.
The statute now reads:
2003 Amendment (effective May 5, 2003)
(2) A person is guilty of identity fraud when that person knowingly or intentionally: (a) obtains personal identifying information of another person [without the authorization of that person]; and (b) uses, or attempts to use, that information with fraudulent intent, including to obtain, or attempt to obtain, credit, goods, services, any other thing of value, or medical information in the name of another person [without the consent of that person].
(3) Identity fraud is: [(a) a class B misdemeanor if the value of the credit, goods, services, or any other thing of value is less than $300;] [(b) a class A misdemeanor if:] [(i) a value cannot be determined and the personal identifying information has been used without the consent of that person to obtain medical information or to obtain employment; or] [(ii) the value of the credit, goods, services, or any other thing of value is or exceeds $300 but is less than $1,000;] (a) a class A misdemeanor if the value of the credit, goods, services, or any other thing of value is less than $1,000; [(c)] (b) a third degree felony if the value of the credit, goods, services, or any other thing of value is or exceeds $1,000 but is less than $5,000; or [(d)] (c) a second degree felony if the value of the credit, goods, services, or any other thing of value is or exceeds $5,000.
(4) Multiple violations [within a 90-day period] may be aggregated into a single offense, and the degree of the offense is determined by the total value of all credit, goods, services, or any other thing of value used, or attempted to be used, through the multiple violations.
The Division of Consumer Protection realized that it had taken on a project that was bigger than the resources of its division. They were now involved in investigating felony offenses with category 2 officers and dealing with some very unsavory individuals. The result was to transfer the investigations to the Attorney General’s office. To accommodate this change section 76-6-1103 was rewritten. It now reads:
(2) In addition to investigations conducted by law enforcement agencies, the Office of the Attorney General has responsibility for investigating violations of this part where identity fraud is the primary violation that is alleged to have been committed. (3) A criminal conviction under this part is prima facie evidence of a violation of Section 13-11-4, of the Utah Consumer Sales Practices Act. (4) Any violation of this part constitutes a violation of Section 13-11-4, of the Utah Consumer Sales Practices Act.
By now it had also become apparent that the state was inadvertently helping identity thieves. One source of information was the provision for your Social Security number to appear on your state issued drivers license and ID card. Senator Walker easily solved this problem by passing legislation that removed the Social Security Number form your driver’s license and your ID card. (See UCA § 53-3-207, 53-3-411, 53-3-805
One issue that was raised in 2004, was the possession by criminals of identification documents belonging to others. There was no offense on the books to charge someone who was caught with the ID of another person. To rectify this problem the following statute was drafted and passed into law.
UNLAWFUL POSSESSION OF ANOTHER’S IDENTIFICATION DOCUMENTS
76-6-1105. Unlawful possession of another's identification documents.
(1) For purposes of this section "identifying document" means: (a) a government issued identifying document; (b) a vehicle registration certificate; or (c) any other document containing personal identifying information as defined in Subsections 76-6-1102(1)(d) through (k).
(2) (a) Notwithstanding the provisions of Subsection 76-6-1102(3), a person is guilty of a class A misdemeanor if he: (i) obtains or possesses an identifying document with knowledge that he is not entitled to obtain or possess the identifying document; or (ii) assists another person in obtaining or possessing an identifying document with knowledge that the person is not entitled to obtain or possess the identifying document. (b) A person is guilty of a third degree felony if he: (i) obtains or possesses multiple identifying documents with knowledge that he is not entitled to obtain or possess the multiple identifying documents; or (ii) assists another person in obtaining or possessing multiple identifying documents with knowledge that the person is not entitled to obtain or possess the multiple identifying documents. (c) For purposes of Subsection (2)(b), "multiple identifying documents" means identifying documents of two or more people.
The above statute was written with the language “with knowledge that he is not entitled to obtain or possess the identifying document;” with the idea that a parent with a child’s ID or someone validly holding the ID of another person would not be in violation of the law. The statute defines a Class A misdemeanor violation if the perpetrator has one person’s ID but is punishable as a third degree felony if the perpetrator has two or more ID’s of other people.
Yet still another issue that needed to be addressed, was the identity thief’s constant movement between jurisdictions. Often an ID thief would use a stolen ID in several different jurisdictions. To avoid each jurisdiction prosecuting only the crimes occurring within that jurisdiction and instead allowing prosecution of all of the crimes an individual perpetrator committed in multiple jurisdictions using the same stolen ID, new paragraphs were added to the venue statute.
76-1-202. Venue of actions. (h) A person who commits an offense based on Chapter 6, Part 11, Identity Fraud Act, may be tried in the county: (i) where the victim's personal identifying information was obtained; (ii) where the defendant used or attempted to use the personally identifying information; (iii) where the victim of the identity fraud resides or is found; or (iv) if multiple offenses of identity fraud occur in multiple jurisdictions, in any county where the victim's identity was used or obtained or where the victim resides or is found.
Now an ID thief could be prosecuted where the ID was stolen, where it was used or where the victim resided. Additionally the thief’s crimes no longer stopped at the border of the next county. He could be charged by the same prosecution agency for crimes he committed in the next county. What’s more, couple the venue statute with the ID fraud statutes provisions for aggregating the crime and the prosecution could file second-degree felony charges. Caveat, when screening cases for filing the prosecutor should charge all of the offenses he is aware of or coordinate with the second jurisdiction where the additional offenses occurred. Only filing offenses which occurred in one county when the prosecutor is aware of offenses occurring outside of that county could lead to the defense raising an issue under UCA 76-1-402:
(2) Whenever conduct may establish separate offenses under a single criminal episode, unless the court otherwise orders to promote justice, a defendant shall not be subject to separate trials for multiple offenses when: (a) The offenses are within the jurisdiction of a single court; and (b) The offenses are known to the prosecuting attorney at the time the defendant is arraigned on the first information or indictment.
There were still changes yet to be made to the Identity Fraud statute itself. One was to address the earlier issue of making the penalty fit the crime. With this idea in mind, the Class A offense level was finally abolished. All identity theft became at least a third degree felony and, unlike the forgery statute, the second-degree felony for crimes over $5000.00 was retained. The statue now reads:
(3) Identity fraud is: [(a) a class A misdemeanor if the value of the credit, goods, services, or any other thing of value is less than $1,000;] [(b)] (a) a third degree felony if the value of the credit, goods, services, or any other thing of value is [or exceeds $1,000 but is] less than $5,000; or [(c)] (b) a second degree felony if the value of the credit, goods, services, or any other thing of value is or exceeds $5,000.
(4) Multiple violations may be aggregated into a single offense, and the degree of the offense is determined by the total value of all credit, goods, services, or any other thing of value used, or attempted to be used, through the multiple violations.
In 2005 it had become apparent that the drivers license code sections needed to be revised. The code in existence had been passed when individuals were using a razor blade to scratch off the birth date on a license and alter it to reflect that they were of a legal drinking age to get into bars. The statutes therefore, made it a violation to alter a validly issued drivers license. However, the state was now in the twenty first century and with the technology available fake driver's licenses could be made that mimicked the originals in every detail. Not only could “ authentic looking” drivers licenses be manufactured but also they were now used for a wider variety of illegal purposes.
They are still used to get into bars but they are also used to commit identity fraud offenses and even for terrorism. At least five of the terrorists on 9-11 used fake ID's. The statutes on the books did not specifically address the manufacture of a fake driver's license or its use. A review of the code indicated that the manufacture of a driver’s license could be dealt with by using the forgery statute. However, new statutes were needed to address the use of the fake license. Therefore, the following statues were enacted.
DRIVER LICENSE
53-3-221. Offenses which may result in denial, suspension, disqualification, or revocation of license without hearing -- Additional grounds for suspension -- Point system for traffic violations -- Notice and hearing -- Reporting of traffic violation procedures. (e) has knowingly acquired, used, displayed, or transferred and item that purports to be an authentic driver license certificate issued by a governmental entity if the item is not an authentic driver's license certificate or has permitted an unlawful use of the license as prohibited under Section 53-3-229; or
(9) (a) By following the emergency procedures in Title 63, Chapter 46b, Administrative Procedures Act, the Division may immediately suspend the license of any person without hearing and without receiving a record of his conviction for a crime when the division has reason to believe that the person’s license was granted by the division through error for fraud or that the necessary consent for the license has been withdrawn or is terminated.
Driver's License Certificate
53-3-229. Prohibited uses of license certificate -- Penalty. (1) It is a class C misdemeanor for a person to: (a) lend or knowingly permit the use of a license certificate issued to the person, by a person not entitled to it; (b) display or to represent as the person's own a license certificate not issued to the person; (c) refuse to surrender to the division or a peace officer upon demand any license certificate issued by the division; (d) use a false name or give a false address in any application for a license or any renewal or duplicate of the license certificate, or to knowingly make a false statement, or to knowingly conceal a material fact or otherwise commit a fraud in the application; (e) display a canceled, denied, revoked, suspended, or disqualified driver license certificate as a valid driver license certificate.
(f)knowingly acquire, use, display, or transfer an item that purports to be an authentic driver license certificate issued by a governmental entity if the item is not an authentic driver license certificate issued by that governmental entity; or (g) alter any information on an authentic driver license certificate so that it no longer represents the information originally displayed.
(2) The provisions of Subsection (1)(e) do not prohibit the use of a person's driver license certificate as a means of personal identification.
(3) It is a class A misdemeanor to: (a) knowingly issue a driver license certificate with false or fraudulent information; (b) knowingly issue a driver license certificate to a person younger than 21 years of age if the driver license certificate is not distinguished as required for a person younger than 21 years of age under Section 53-3-207; or (c) knowingly acquire, use, display, or transfer a false or altered driver license certificate to procure cigarettes, tobacco, or tobacco products.
(4) A person may not use, display, or transfer a false or altered driver license certificate to procure alcoholic beverages, gain admittance to a place where alcoholic beverages are sold or consumed, or obtain employment that may not be obtained by a minor in violation of Section 32A-1-301.
(5) It is a third degree felony if a person's acquisition, use, display, or transfer of a false or altered driver license certificate: (a) aids or furthers the person's efforts to fraudulently obtain goods or services; or (b) aids or furthers the person's efforts to commit a violent felony.
Amended by Chapter 197, 2005 General Session
Please note the statute provides that if the fake driver's license is used to obtain age-restricted items (alcohol or cigarettes) it is a Class A misdemeanor. However if the fake license is used to obtain goods or services i.e. identity theft or to commit a violent act then the penalty is a third degree felony.
Another problem that needed to be addressed was the use by identity fraud criminals of deceased individuals’ information. The Identity Theft statue did not specify if “person” included deceased individuals. Therefore paragraph 2 was revised to state:
(2) A person is guilty of identity fraud when that person knowingly or intentionally: (a) obtains personal identifying information of another person whether that person is alive or deceased.
In 2005 a bill that was drafted and argued over in the legislature was credit freeze legislation Senate Bill 39 credit freeze legislation is the first and only statutory scheme that gives the consumer a proactive ability to combat identity theft. To take advantage of a credit freeze the consumer contacts the credit bureaus and asks to put a credit freeze on his credit history and score.
The consumer would pay a reasonable fee for this service. The credit bureau sends the consumer a pin number. When the consumer wants to apply for credit he calls the credit bureau and provides his pin number. He can then unfreeze his credit report for a specific creditor or for a specific time interval if he is shopping a number of creditors for the best rate.
After he obtains the new credit line, his credit history is frozen again. This effectively prevents anyone else from using the consumer’s information, birth date, name or social security number to obtain credit. Without the pin number none can apply for credit in another person’s name. A creditor attempting to order a credit history will get a message from the credit bureaus that the individual’s credit history is frozen. The creditor will not grant credit without the score and the identity thief has been stopped.
The advantage this legislation provided was not only could a consumer finally protect himself or herself from becoming a victim, but it also was voluntary. No one had to sign up for the credit freeze that didn’t want it. This idea will be introduced again in the 2006 legislative season.
An issue that should be addressed is a lock off of certain court records that contain personal information that can be used to steal another’s identity. An example of this type of record is found in divorce files. If there is a child support issue in a case, the parties supply a great amount of sensitive financial and other personal information. This part of the court file is currently a public record. A system that removes this information from public record is needed.
In the near future legislation may be proposed that requires businesses to notify customers if they have had a security breach that may affect the customer’s personal information.
Finally, legislation may be needed that addresses the problem of businesses negligently disposing of their records. An example of this is the check cashing business that recently disposed if its records by dumping them in the local dumpster. The records included photocopies of checks, driver's licenses, addresses, account numbers and social security numbers. This type of negligent disposal of records may require criminal sanctions.
| 
