Alabama Identity Theft Laws: Statute, Reporting, and Your Rights

Alabama's identity theft offense is codified at Ala. Code § 13A-8-192, part of the Consumer Identity Protection Act within Title 13A, Chapter 8, Article 10 of the state code. The statute makes identity theft a Class B felony, defines four separate acts that can each constitute the offense, and gives prosecutors seven years from the commission of the offense to bring a case. The same article also gives victims two remedies many state identity theft laws leave out: mandatory restitution on conviction, and a standalone civil action worth at least $5,000 per incident.

This page covers the elements and penalty of Alabama's identity theft statute, the restitution and civil remedies in the same article, how to file a complaint with the Alabama Attorney General, the state's data breach notification law, and the federal recovery rights every identity theft victim has regardless of state. For the broader picture, see our identity theft laws hub and our guide to reporting identity theft.

Alabama's Identity Theft Statute: Elements and Penalty

Alabama's identity theft offense lives at Ala. Code § 13A-8-192, within Article 10 of Chapter 8 in Title 13A, the article the state legislature titles the Consumer Identity Protection Act.

Subsection (a) sets out the elements. A person commits identity theft if, without the authorization, consent, or permission of the victim, and with the intent to defraud for his or her own benefit or the benefit of a third person, that person does any one of four things: obtains, records, or accesses identifying information that would assist in accessing the victim's financial resources, obtaining identification documents, or obtaining the victim's benefits; obtains goods or services through the use of the victim's identifying information; obtains identification documents in the victim's name; or obtains employment through the use of the victim's identifying information.

Any one of those four acts is enough. The intent to defraud is what separates the offense from merely holding someone else's data, and the "benefit of a third person" language means the offense still applies when the person who took the information was not the one who profited.

Subsection (b) is a single sentence: identity theft is a Class B felony. There is no tiering in the statute by dollar amount, by number of victims, or by the type of information taken, so a single fraudulent account and a large-scale scheme carry the same statutory classification in Alabama.

Two limits sit in the rest of the section. Subsection (c) carves out the person who obtains another's identity to misrepresent his or her age for the sole purpose of obtaining alcoholic beverages, tobacco, or another privilege denied to minors; that conduct is not identity theft under this section. Subsection (d) requires that any prosecution brought under the article be commenced within seven years after the commission of the offense.

Reporting Identity Theft to the Alabama Attorney General

The Alabama Attorney General's Office runs a Consumer Interest Division that takes identity theft and other consumer complaints directly. You can file online with your name, address, county, and age, a narrative of what happened, whether you are represented by an attorney, and whether a court action is already pending, and attach supporting documents as a .jpg or .pdf up to 10MB. Additional material can also be emailed to ConsumerInterest@AlabamaAG.gov. You can also call the Consumer Hotline at 1-800-392-5658 or 334-242-7335.

The office is direct about what this process is and is not: filing a complaint "is not a legal action," and the Consumer Interest Division does not give legal advice. Treat it as a way to put your complaint on record and prompt an investigation, not a substitute for your own credit bureau disputes, a police report, or an attorney if your situation calls for one.

Alabama's Data Breach Notification Law

Separately from the criminal identity theft statute, Alabama has required data breach notification since 2018. The Alabama Data Breach Notification Act of 2018 (Acts 2018-396) requires businesses that experience a breach of sensitive personally identifying information to notify affected Alabama residents, and, once a breach affects enough residents, to notify the Attorney General as well. If your identity theft traces back to a specific company's data breach rather than an unknown source, that notice is often your first sign of trouble, and it is worth keeping as documentation when you file a complaint or an FTC Identity Theft Report.

Credit Freezes for Minors in Alabama

Whether Alabama has enacted its own protected-consumer or minor credit freeze statute, separate from the federal minimum, could not be confirmed or ruled out this session. What is certain is that Alabama parents and guardians are not without a right here regardless: federal law, 15 U.S.C. § 1681c-1(j), requires all three nationwide credit bureaus to let a parent or guardian freeze a child's credit file for free, even before the child has a credit file at all, no matter which state the family lives in. See our credit freeze vs. fraud alert page for how the freeze right works generally.

Restitution and Civil Remedies

Article 10 gives Alabama identity theft victims two financial remedies written specifically for this offense, and both reach further than the general crime-victim restitution rules that apply across Alabama criminal cases.

Restitution is mandatory, not discretionary. Under Ala. Code § 13A-8-195, on conviction for any crime in the article, the court shall order the person found guilty to make restitution for financial loss to any person whose identifying information was appropriated. The statute spells out what financial loss can include: costs the victim incurred correcting his or her credit history or credit rating, costs incurred in connection with any civil or administrative proceeding to satisfy a debt, lien, or other obligation resulting from the theft, and, named expressly, lost wages and attorney's fees. The court may also order restitution to any other person or entity that suffered a loss from the violation. On top of restitution, a person convicted under the article is assessed twenty-five dollars ($25) per day, plus medical expenses, for time spent in a county or municipal jail or in a state prison facility.

Alabama also creates an express civil cause of action, so a victim does not have to fit the claim into general fraud or conversion theories. Ala. Code § 13A-8-199 lets a victim who has suffered loss as a result of a criminal violation of the article sue the defendant for the greater of $5,000 for each incident or three times actual damages, plus reasonable attorney's fees and court costs. The action can be brought in the victim's county of residence or any county in which any part of the crime took place, regardless of whether the defendant was ever actually present in that county, which matters in cases that ran entirely online. The limitations period is seven years, running from the earlier of the date the victim discovered the offense or the date it reasonably should have been discovered, so the civil clock starts at discovery rather than at the crime.

Both remedies are tied to a criminal violation of Article 10, so keep your police report, your FTC Identity Theft Report, and records of every cost you incurred. Those documents are what a restitution order or a civil claim gets built on, and an Alabama attorney can tell you which of the two paths fits your facts.

Federal Rights That Apply in Every State

Alabama's statute and its Article 10 remedies sit on top of federal rights that do not depend on state law at all. IdentityTheft.gov, run by the FTC, is a free national recovery site that builds a personal recovery plan once you describe what happened. Once you have an FTC Identity Theft Report, 15 U.S.C. § 1681c-2 (FCRA § 605B) requires a credit bureau to block fraudulent information from your report within 4 business days of receiving your documentation. Federal law has also made both credit freezes and fraud alerts free at all three bureaus since 2018, under 15 U.S.C. § 1681c-1. See our guides to reporting identity theft and credit freeze vs. fraud alert for the full mechanics of both.

Alabama has a state credit-report block provision of its own alongside the federal one. Ala. Code § 13A-8-200 requires a consumer reporting agency, within 30 days of receiving a court order issued under Ala. Code § 13A-8-198, to use reasonable procedures to block information in your credit report that the order identifies as the result of a criminal violation of the Consumer Identity Protection Act, and to notify the furnisher of that information that the block is in place. A consumer harmed by an intentional or reckless violation can sue for actual damages and injunctive relief, and a judgment in the consumer's favor includes attorney's fees. In practice the federal FCRA § 605B route is the faster one, because it runs on an FTC Identity Theft Report and a 4-business-day deadline rather than a court order, but the state provision is a second path once a court order exists.

No 2025-26 amendment to Ala. Code § 13A-8-192, or to any Alabama minor-freeze law, surfaced during this page's research, though Alabama's own bill-tracking tools could not be checked directly this session, so treat this as a partial check rather than an exhaustive one.

Information last verified on 2026-09-01 against the text of Ala. Code §§ 13A-8-192, 13A-8-195, 13A-8-199, and 13A-8-200 as published on the Alabama Legislature's code portal, together with the Alabama Attorney General's Consumer Interest Division and data breach notification pages and federal law under 15 U.S.C. §§ 1681c-1 and 1681c-2. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-09-01.