Arkansas Identity Theft Laws: Financial Fraud and the ID Passport

Arkansas splits identity theft into two separate offenses under Ark. Code Ann. § 5-37-227: financial identity fraud and nonfinancial identity fraud. Arkansas also gives verified victims a tool most states do not offer at all: an Identity Theft Passport, a state-issued card victims can show to law enforcement, creditors, or anyone else questioning their identity while the fraud is being sorted out.

This page covers both fraud offenses and their penalties, the Identity Theft Passport program, restitution and civil remedies, and where to report identity theft in Arkansas. For the broader picture, see our identity theft laws hub and our guide to reporting identity theft.

Arkansas's Financial and Nonfinancial Identity Fraud Statute

Arkansas's identity fraud statute, Ark. Code Ann. § 5-37-227, defines two separate offenses. Financial identity fraud has three prongs. The first covers accessing, obtaining, recording, or submitting to a financial institution another person's identifying information, for the actor's benefit or a third party's, with a purpose to create, obtain, or open a credit account, debit account, or financial resource without that person's authorization. The second covers using a scanning device, re-encoder, or skimmer to appropriate another person's financial resource, financial sight order information, or payment card information without authorization. The third covers transferring to another person a financial resource, financial sight order, or payment card information knowing that the other person is not entitled to obtain or possess it.

Nonfinancial identity fraud applies when a person knowingly obtains another person's identifying information without authorization and uses it for any unlawful purpose, including without limitation to avoid apprehension or criminal prosecution, to harass another person, or to obtain or attempt to obtain a good, service, real property, or medical information of another person. "Identifying information" under the statute includes a Social Security number, driver's license number, credit or debit card number, and any other number or information that can be used to access a person's financial resources.

Penalties, Including the Elder and Disabled-Victim Enhancement

Financial identity fraud is a Class C felony, elevated to a Class B felony if the victim is an elder person or a person with a disability. Nonfinancial identity fraud is a Class D felony, elevated to a Class C felony under the same enhancement.

The statute does not define "elder person" itself. It cross-references Ark. Code Ann. § 4-88-201, which sets the threshold at 60 years of age or older. A victim who has turned 60, not 65, is already inside the enhancement.

The statute also sets venue in the county where the offense occurred, any element of the offense occurred, the victim resides, or the fraudulently obtained property was used or located, which matters given how often identity fraud crosses county lines.

The Arkansas Identity Theft Passport

Arkansas offers verified identity fraud victims a state-issued Identity Theft Passport, a card similar in appearance to a driver's license, under Ark. Code Ann. § 5-37-228. A victim who reasonably suspects they are a victim of financial identity fraud can present the passport to law enforcement, creditors, or other entities investigating fraudulent use of their identity, or to support their claim of innocence. Acceptance by any given creditor or agency is discretionary, not mandatory, so the passport is a strong piece of supporting evidence rather than a guarantee that every business or agency will treat a matter as closed.

To apply, a resident submits to the Attorney General a copy of their police report, a completed application, and any other supporting documentation the office requests. The application and supporting materials are not public records, though the Attorney General may share information with criminal justice agencies. Because a police report is a prerequisite, applying for a passport is generally the second step after reporting the fraud to local law enforcement, not the first.

Filing a Police Report First

Both the Identity Theft Passport and the Attorney General's own victim guidance require filing a police report as an early step. The Attorney General's "What Should Victims Do" page lists reporting to local law enforcement as the second recommended action, right after placing a fraud alert with a national credit bureau, and before contacting affected companies, filing an FTC complaint, considering a security freeze, and applying for a passport.

Restitution for Credit Repair and Related Costs

Restitution under Arkansas's identity fraud statute is discretionary, not automatic. On conviction for financial or nonfinancial identity fraud, a court may order the defendant to make restitution to any victim whose identifying information was appropriated, or to the victim's estate.

That order may include, without limitation, any costs the victim incurred correcting their credit history or credit rating, and any costs incurred in connection with a civil or administrative proceeding to satisfy a debt, lien, or other obligation resulting from the theft, including lost wages and attorney's fees. The court may also order restitution for financial loss to any other person or entity that suffered a financial loss from the offense.

Because the statute says a court may order restitution rather than that it must, ask the prosecutor handling your case or a licensed Arkansas attorney whether restitution will be sought in your specific matter.

Civil Remedies

Arkansas has not enacted a standalone civil identity theft cause of action of the kind some other states have. The criminal statute itself, however, supplies an identity-theft-specific civil hook rather than leaving victims to general law alone.

Ark. Code Ann. § 5-37-227(g)(1) provides that a violation of the section constitutes an unfair or deceptive act or practice as defined by the Arkansas Deceptive Trade Practices Act, § 4-88-101 et seq. Subsection (g)(2) then makes any remedy, penalty, or authority granted to the Attorney General or another person under that Act available for enforcement of the identity fraud section. The Deceptive Trade Practices Act is therefore not a generic substitute here. It is routed in by the identity fraud statute itself.

Two further provisions confirm that a civil case is contemplated alongside the prosecution. A restitution judgment entered in the criminal case does not bar a remedy available in a civil action to recover damages relating to financial or nonfinancial identity fraud, and the statute fixes venue for any such civil action in the same counties it allows for the criminal case.

The practical limit sits on the private side of the Deceptive Trade Practices Act. Under § 4-88-113(f), a private claimant must prove an actual financial loss proximately caused by his or her own reliance on the unlawful practice, and private class actions are barred except for claims under Arkansas Constitution, Amendment 89. Reliance is often the difficult element for an identity theft victim, who typically never dealt with the offender at all. General Arkansas tort claims such as fraud or conversion remain available alongside the statutory route. Confirm with a licensed Arkansas attorney which of these fits your situation.

Credit Freezes for Minors in Arkansas

Arkansas has not enacted its own protected-consumer or minor credit freeze statute. The Arkansas Consumer Report Security Freeze Act defines "consumer" simply as an individual, with no separate minor age threshold or parent/guardian request procedure distinct from the general adult freeze process. Arkansas minors instead rely on the federal minor freeze right, 15 U.S.C. § 1681c-1(j), which requires all three nationwide credit bureaus to let a parent or guardian freeze a child's credit file for free, even before the child has a credit file at all. See our credit freeze vs. fraud alert page for how the freeze right works generally.

Reporting to the Arkansas Attorney General

The Arkansas Attorney General's Public Protection Division runs a dedicated identity theft hub with sub-resources on fraud alerts and security freezes, protecting yourself, security or data breaches, and what victims should do. The general consumer-protection line is (501) 682-2007 or (800) 482-8982. Its victim guidance walks through six steps: placing a fraud alert with a national credit bureau, filing a police report, contacting each company with a fraudulent account or charge in writing by certified mail, filing a complaint with the FTC, considering a security freeze, and requesting an Identity Theft Passport once you have a police report on file.

Federal Rights That Apply in Every State

On top of Arkansas's own framework, every identity theft victim also has federal rights that do not depend on state law. IdentityTheft.gov, run by the FTC, is a free national recovery site that builds a personal recovery plan once you describe what happened. Once you have an FTC Identity Theft Report, 15 U.S.C. § 1681c-2 (FCRA § 605B) requires a credit bureau to block fraudulent information from your report within 4 business days of receiving your documentation. Federal law has also made both credit freezes and fraud alerts free at all three bureaus since 2018, under 15 U.S.C. § 1681c-1. See our guides to reporting identity theft and credit freeze vs. fraud alert for the full mechanics of both.

Information last verified on 2026-09-02 against the enrolled text of Act 932 of 2017 (SB 225), which sets the current version of Ark. Code Ann. § 5-37-227, and Act 1015 of 2021 (HB 1391), which re-enacted the Ark. Code Ann. § 4-88-201 definitions, both published by the Arkansas General Assembly, together with Ark. Code Ann. § 5-37-228, the Arkansas Consumer Report Security Freeze Act, and the Arkansas Attorney General's identity theft pages. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-09-02.