Kentucky Identity Theft Laws

Kentucky's identity theft statute, KRS § 514.160, is unusual among the states in a specific way: it is a flat Class D felony with no dollar-value tiers, no victim-count enhancement, and no separate penalty for a repeat offense written into the section itself. Kentucky escalates through a separate offense instead. KRS § 514.170, trafficking in stolen identities, is a Class C felony, one grade higher.

This page covers Kentucky's theft of identity and trafficking statutes, its own protected-person credit freeze law, the Attorney General's Identity Theft Hotline and Data Breach Hotline, and the civil, Consumer Protection Act, and restitution remedies available to Kentucky victims. For the federal rights that apply everywhere, see our identity theft laws hub.

Kentucky's Theft of Identity Statute

KRS § 514.160 makes a person guilty of theft of identity when they knowingly possess or use any current or former identifying information of another person, or of that person's family member or ancestor, with intent to represent that they are the other person for purposes that include obtaining benefits or property they would not otherwise be entitled to, making financial or credit transactions using the other person's identity, avoiding detection, or gaining commercial or political benefit. «Identifying information» covers name, address, telephone number, e-mail address, Social Security number, driver's license number, birth date, personal identification number or code, unique biometric data, and any other information that could identify the person.

The statute carves out two specific exceptions. It does not apply when a person obtains the identity of another to misrepresent his or her age for the purpose of obtaining alcoholic beverages, tobacco, or another privilege denied to minors. Read the subject carefully: the exception turns on the purpose, obtaining an age-restricted privilege, and not on the age of the person doing it. The statute also does not apply to credit or debit card fraud, which Kentucky addresses separately under KRS §§ 434.550 through 434.730. A person convicted forfeits any lawful claim to the identifying information, property, or other benefit realized from the violation.

Theft of identity is a Class D felony. Two independent readings of the current official statute text found no dollar-value tiers, no victim-count tiers, and no enhancement for repeat offenses or elderly or vulnerable victims anywhere in the section. That is not the whole picture on severity, though. Kentucky's escalation lives in the companion offense described in the next section. KRS 514.160(2) also carries a civil hook that is easy to miss: if the person violating the section is a business that has violated it on more than one occasion, that business also violates the Consumer Protection Act, KRS 367.110 to 367.300.

Trafficking in Stolen Identities

Kentucky's more serious identity crime is KRS § 514.170, trafficking in stolen identities. A person is guilty when they manufacture, sell, transfer, or purchase the personal identity of another person or persons, or possess it with the intent to do any of those things, for any of the purposes listed in KRS 514.160(1). The personal identity covered is the same set of identifying information described in KRS 514.160(1).

Trafficking in stolen identities is a Class C felony, one grade above theft of identity. The statute also supplies an evidentiary shortcut for prosecutors: possession of five or more separate identities is prima facie evidence that the identities are possessed for the purpose of trafficking. As with 514.160, a business that violates KRS 514.170 on more than one occasion also violates the Consumer Protection Act, KRS 367.110 to 367.300.

So while the theft of identity section itself does not scale with the number of victims, Kentucky does treat multi-identity and distribution conduct more harshly. It just does so through a separate charge rather than through tiers inside one statute.

Kentucky's Minor Credit Freeze Law

Kentucky has its own protected-person security freeze statute, KRS § 367.3645, predating the 2018 federal baseline. It defines a «protected person» as an individual under sixteen years of age at the time a freeze request is made, and bars a consumer reporting agency from releasing the protected person's consumer report, derived information, or records while the freeze is active.

Unlike Iowa's or Kansas's fee-free statutes, Kentucky's own statute as written permits the reporting agency to charge a fee of up to $10 for placement or removal of a protected-person freeze. Whether that fee provision is displaced in practice by the federal free-freeze mandate for protected consumers under 15 U.S.C. § 1681c-1(j) was not independently confirmed during this page's research. Willful noncompliance by a reporting agency exposes it to actual damages, liquidated damages of $100 to $1,000, punitive damages, and attorney's fees; obtaining a protected person's report under false pretenses exposes the requester to actual damages or $1,000, whichever is greater. A separate statute, KRS § 367.365, covers the general (adult) security freeze process, including placement, duration, removal, and temporary lifting.

Reporting Identity Theft to the Kentucky Attorney General

The Kentucky Attorney General's Office of Consumer Protection offers an online complaint and scam form at ag.ky.gov/scams, a dedicated Data Breach Hotline (1-855-813-6508), and a separate Identity Theft Hotline (1-877-438-4338), plus a mailing address at 1024 Capital Center Drive, Suite 200, Frankfort, KY 40601. The office provides an «Identity Theft: The Name Game» recovery brochure and can mail a hard copy of the FTC's ID Theft Booklet on request (502-696-5389).

The Attorney General's page advises victims to act quickly, report to the FTC at identitytheft.gov, monitor credit reports, place fraud alerts, and obtain a police report, and specifically notes that a police report helps secure a seven-year extended fraud-alert protection. Separately, the office flags unemployment-insurance identity fraud for reporting to Kentucky's Office of Unemployment Insurance and to the U.S. Department of Justice's National Center for Disaster Fraud (866-720-5721).

Civil Remedies in Kentucky

Kentucky does have an identity-theft-specific civil cause of action, and it is the first place a victim should look. KRS § 411.210, «Action for theft of identity or trafficking in stolen identities», provides that anyone who is a victim under KRS 514.160, 514.170, 434.872, or 434.874 has a cause of action for compensatory and punitive damages against the violator. Suit may be brought either where the victim resides or where the defendant resides, and a successful plaintiff «shall be awarded reasonable costs and attorneys' fees». The limitations period is five years from the date the victim discovers the violation, and the statute opens by saying the action is available «in addition to pursuing any other remedy».

The Kentucky Consumer Protection Act is a second, narrower route. KRS § 367.220 allows a person who purchases or leases goods or services primarily for personal, family, or household purposes and suffers an ascertainable loss to sue for actual damages, equitable relief, and, as the statute preserves, punitive damages, plus attorney's fees and costs at the court's discretion, within one year after the Attorney General's action terminates or two years after the violation, whichever is later. Because it is tied to a covered consumer transaction, it does not reach identity theft harm generally the way KRS 411.210 does.

There is one bridge between the two. KRS 514.160(2) and KRS 514.170(3) each provide that a business that violates the section on more than one occasion also violates the Consumer Protection Act, KRS 367.110 to 367.300. That route can reach a repeat-offender business without the personal, family, or household purchase KRS 367.220 otherwise requires.

A criminal case carries its own money remedy on top of all of this. KRS § 532.034 provides that a person found guilty under KRS 514.160, 514.170, 434.872, or 434.874 shall, in addition to any other punishment, be ordered to make restitution for the financial loss a victim sustained. The statute says that loss may include costs the victim incurred correcting their credit history and costs of any civil or administrative proceeding to satisfy a debt or other obligation created by the theft, including lost wages and attorney's fees. Restitution is paid to the person or entity that suffered the loss, which may include a financial institution, insurance company, or bonding association that took a direct financial hit.

The Federal Layer

Kentucky's own protections sit alongside the federal baseline available to every state. Since 2018, federal law has required free credit freezes and free freeze removals nationwide. A fraud alert placed with one credit bureau is shared with the other two, lasts one year by default, and extends to seven years once you have filed an FTC Identity Theft Report, the same extended-alert benefit the Kentucky Attorney General's own page points victims toward. Under FCRA § 605B (15 U.S.C. § 1681c-2), a victim with an identity theft report can get specific fraudulent information blocked from a credit report. IdentityTheft.gov, the FTC's free recovery site, builds a personalized recovery plan and, for account holders, pre-fills the letters and forms most victims need. See our guide to reporting identity theft and our comparison of credit freezes versus fraud alerts for more.

If You Are a Victim of Identity Theft in Kentucky

File a police report first, since Kentucky's own Attorney General notes it helps secure the seven-year extended fraud alert. Call the Identity Theft Hotline at 1-877-438-4338 or file online at ag.ky.gov/scams. Report to the FTC through IdentityTheft.gov, and place a freeze with all three major credit bureaus. If the theft involves a child's information, use Kentucky's protected-person freeze process under KRS 367.3645, and confirm the current fee, if any, directly with the credit bureau before paying it. If you know who took your identity and you have measurable losses, KRS 411.210 gives you five years from discovery to bring a civil claim, so it is worth asking a Kentucky lawyer about that action rather than assuming the criminal case is your only path.

Information last verified on 2026-09-02, drawn directly from KRS §§ 514.160, 514.170, 411.210, 532.034, 367.3645, 367.365, and 367.220, and the Kentucky Attorney General's identity theft page. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert
• Child Identity Theft: Warning Signs, Credit Checks, and the Minor Freeze Right

---

Last updated: 2026-09-02.