Ohio Identity Theft Laws: Penalties, Minor Freeze Rights, and the Identity Theft Unit

Ohio prosecutes identity fraud under Ohio Rev. Code § 2913.49, a felony that scales with the dollar value involved and escalates further when the victim is an elderly person, a disabled adult, an active-duty service member, or the spouse of an active-duty service member. Ohio also runs one of the more fully built-out state minor credit freeze systems in the country, and its identity theft statute includes an explicit private civil right of action separate from any criminal case. Ohio law additionally authorizes an identity fraud passport, a document the Attorney General may issue to a victim who has filed a police report, though the Revised Code does not use the marketing name "Identity Theft Verification Passport Program" that circulates online.

This article addresses Ohio's identity fraud statute, its minor protected-consumer freeze law, and Attorney General resources, together with the federal layer of protections that applies nationwide. It does not cover every state's law; see the identity theft laws hub for other states.

Ohio's Identity Fraud Statute: Ohio Rev. Code § 2913.49

Ohio's identity fraud law prohibits using another person's personal identifying information, including their name, address, phone number, driver's license, Social Security number, birth certificate, employment details, financial account numbers, passwords, or credit card numbers, of a living or deceased person, without consent, to impersonate them or represent their information as your own. It also criminalizes creating, obtaining, or possessing someone's identifying information to help commit that offense, and separately criminalizes permitting another person to fraudulently use your own information.

The statute includes several affirmative defenses: acting as a legal guardian, conservator, trustee, or other fiduciary; law-enforcement or fraud-investigation use with prior consent; and other lawful-purpose exceptions, with a carve-out preserving law-enforcement investigations.

Ohio's Penalty Structure

The base offense is a felony of the fifth degree, Ohio's lowest felony class. Penalties escalate based on the dollar value obtained through the offense: a fourth degree felony for $1,000 to $7,499, a third degree felony for $7,500 to $149,999, and a second degree felony for $150,000 or more.

Ohio adds a further escalation when the victim is an elderly person, a disabled adult, an active-duty service member, or the spouse of an active-duty service member. The crime is then identity fraud against a person in a protected class, and the charge is bumped one degree higher than it would otherwise be. This means, for example, that a mid-tier offense that would ordinarily be a fourth degree felony becomes a third degree felony if the victim falls into any of those four categories.

Two additional penalties attach in a narrower situation. Under § 2913.49(I)(3), if the victim of the offense is an elderly person, the offender must pay full restitution to the victim and a fine of up to $50,000, on top of any other penalty imposed. Those two consequences are tied to elderly victims alone; the one-degree escalation is the part that applies across all four protected categories. Fines collected under that division go to the county department of job and family services for the reporting and investigation of elder abuse, neglect, and exploitation, or for protective services.

Ohio's Minor Protected-Consumer Freeze Law

Ohio has its own dedicated state law covering credit freezes for minors, running alongside and in some ways more detailed than the federal freeze framework. Ohio Rev. Code § 1349.52 defines a "minor protected consumer" as an individual under 16 years of age, and it allows a "representative with proper authority," which includes a parent, guardian, or conservator, to request a freeze on the minor's behalf. Sufficient proof of authority for a parent includes a birth certificate naming the parent as the minor's parent.

Ohio Rev. Code § 1349.521 sets the mechanics. A representative requests the freeze in writing, by certified mail, a comparable delivery service, or a secured electronic method, and must provide proof of authority as well as proof of identity for both the representative and the minor. The credit reporting agency must place the freeze within 30 days and send written confirmation to the minor's address within 5 business days. If no credit file exists yet for the minor, the agency must create one, but that record cannot be used to assess creditworthiness. Removing the freeze follows the same 30-day process with proof of authority for a representative, or a minor who has turned 16 can request removal directly by providing sufficient proof of identity and age. An agency may remove a freeze early on a material misrepresentation of facts, but only after giving 5 business days' written notice first, and any change to the protected consumer's identifying information, such as name, birthdate, Social Security number, or address, requires written confirmation sent to both the new and former addresses within 30 days.

Restitution and Civil Remedies

Mandatory restitution under § 2913.49(I)(3) applies specifically where the victim is an elderly person, not across the broader protected-class enhancement described above. For other identity fraud convictions, restitution likely flows from Ohio's general felony-sentencing framework, but this article did not independently confirm that general statute's specific application to identity fraud at publication.

Ohio's identity fraud statute also includes an explicit civil remedy, distinct from anything most states offer directly in the criminal code. Under Ohio Rev. Code § 2913.49(J), a person injured in person or property by a violation of division (B), (D), or (E) who is the owner of the identifying information involved in that violation has a civil action against the offender pursuant to Ohio Rev. Code § 2307.60. That person may also bring a civil action to enjoin or restrain future acts that would constitute a violation of those divisions.

Two limits are worth reading closely. The remedy belongs to the owner of the identifying information, not to everyone who suffered a downstream loss from the fraud, and it does not reach division (C), the offense of creating or possessing identifying information to aid or abet someone else's violation. Within those limits, it gives Ohio victims a direct path to sue independent of whether prosecutors bring or win a criminal case.

Ohio Attorney General Resources: The Identity Theft Unit

The Ohio Attorney General's Consumer Protection Section operates a dedicated Identity Theft Unit. Victims who file a police report and submit an "Identity Theft Notification and Affidavit" form are assigned a consumer advocate who personally contacts credit agencies, creditors, and collectors on the victim's behalf. The office notes that some entities require direct consumer contact rather than advocate contact, and it will redirect victims to the appropriate resource in those cases.

The Attorney General's office also maintains specialized pathways for related problems: federal tax identity theft (through the IRS taxpayer advocate process), Ohio state tax identity theft (through the Ohio Department of Taxation's own form), and a Bureau of Criminal Investigation process for victims whose stolen identity was used during an arrest, letting them challenge or seek review of a criminal record that resulted from someone else using their name with police. This article confirmed that this BCI process exists and is linked from the Attorney General's identity theft page, but it did not independently read the BCI page's own step-by-step mechanics, so contact the Attorney General's office directly if this situation applies to you.

Ohio's identity fraud passport. Ohio Rev. Code § 109.94 authorizes the Attorney General, in cooperation with any law enforcement agency, to issue an identity fraud passport to a person who is a victim of identity fraud in Ohio and has filed a police report citing a violation of § 2913.49. The victim applies through a law enforcement agency, which sends the police report and the application to the Attorney General; the passport issues in the form of a card or certificate.

Its purpose is practical. Under § 109.94(B), a victim may present the passport to a law enforcement agency to help prevent the victim's arrest or detention for offenses committed by someone else using their identity, and to creditors to aid their investigation of whether fraudulent charges were made or accounts opened in the victim's name. Two caveats sit in the statute itself: the Attorney General "may" issue a passport rather than must, and acceptance is discretionary, so a police agency or creditor can weigh the surrounding circumstances and decline to rely on it. Applications and their supporting documents are not public records, though the Attorney General reports annual statistics on how many passports are requested and issued.

One point of terminology is worth clearing up, because the wrong name circulates widely. Ohio's program is not called an "Identity Theft Verification Passport Program" anywhere in the Revised Code; the statutory term is "identity fraud passport." If you want to apply, ask the law enforcement agency that took your report, or the Attorney General's office, about current procedure. This article did not independently confirm the office's present-day application form or processing times.

Federal Protections That Also Apply in Ohio

Beyond Ohio's own robust state law, federal protections apply as well. Under 15 U.S.C. § 1681c-1, every consumer is entitled to a free security freeze and free fraud alerts, a 1-year initial alert and, with an FTC Identity Theft Report, a 7-year extended alert requiring a potential creditor to actually contact you before extending credit. Under 15 U.S.C. § 1681c-2, a victim with an FTC Identity Theft Report can get fraudulent information blocked from their credit report within 4 business days of the credit reporting agency receiving the required documentation.

What To Do If You're a Victim of Identity Theft in Ohio

File a police report first; it is the prerequisite both for the Ohio Attorney General's Identity Theft Unit to assign you a consumer advocate and for an identity fraud passport under § 109.94. Submit the office's "Identity Theft Notification and Affidavit" form alongside that report. Separately, file a report at IdentityTheft.gov to create an FTC Identity Theft Report and a personalized recovery plan. If a child in your family needs a credit freeze, use Ohio's own minor protected-consumer freeze process under §§ 1349.52 and 1349.521. If your stolen identity was used during an arrest, contact the Attorney General's office about the BCI criminal-record-challenge process, and ask the agency that took your report about an identity fraud passport, which exists partly to head off exactly that kind of wrongful detention.

Information last verified on 2026-09-02, drawn from the text of Ohio Rev. Code §§ 2913.49, 109.94, 1349.52, and 1349.521 as published on the state's official code site, the Ohio Attorney General's Identity Theft Unit resource, and federal law under 15 U.S.C. §§ 1681c-1 and 1681c-2. This article has not yet been reviewed by a licensed lawyer. General felony-sentencing restitution for identity fraud convictions outside the elderly-victim provision, the full mechanics of the BCI criminal-record-challenge process, and the Attorney General's current identity fraud passport application procedure were not independently confirmed at publication.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert
• Child Identity Theft
• Tax Identity Theft: When to File IRS Form 14039

---

Last updated: 2026-09-02.