Oklahoma Identity Theft Laws: Penalties and Victim Resources

Oklahoma criminalizes identity theft at 21 O.S. Section 1533.1. A 2026 law, House Bill 3244, substantially widens the list of personal information a person can be prosecuted for stealing and adds a new aggravated identity theft offense, but it does not take effect until November 1, 2026. This page covers what Oklahoma's statute prohibits and penalizes today, what changes on November 1, 2026, where to report identity theft in Oklahoma, and the federal rights that apply to every Oklahoma resident regardless of state law.

This article addresses Oklahoma state law on identity theft alongside the federal framework under 18 U.S.C. Section 1028 and the Fair Credit Reporting Act. The statutory descriptions below are drawn from Oklahoma's official published Title 21 and Title 24 code and from the enrolled text of House Bill 3244. For the parent overview of identity theft law generally, see our identity theft laws hub.

Oklahoma's Identity Theft Statute: The Law in Force Today

Oklahoma's identity theft offense is codified at 21 O.S. Section 1533.1. Subsection A makes it unlawful to willfully and with fraudulent intent obtain the name, address, Social Security number, date of birth, place of business or employment, debit, credit or account numbers, driver license number, or any other personal identifying information of another person, living or dead, with intent to use, sell, or allow another person to use or sell that information to obtain or attempt to obtain money, credit, goods, property, or services in the other person's name without that person's consent.

Subsection B covers using another person's identity, or information relating to it, with fraudulent intent to obtain or attempt to obtain credit or anything of value. Subsection C reaches the other side of the transaction: lending, selling, or otherwise offering the use of your own identifying information or documents so that another person can obtain an identifying document in that other person's name. Subsection D covers willfully creating, altering, or changing another person's identifying information to obtain money, credit, goods, property, or services, or to control, waste, hinder, or encumber that person's accounts, property, or entitlements without consent.

Penalties are set by subsection E. A violation of subsection A, B, or D is a Class D1 felony punishable by imprisonment as provided in subsections B through F of Section 20N of Title 21, or a fine not to exceed $100,000, or both. The statute contains a separate clause for cases in which the victim is less than eighteen years of age, which currently carries that same Class D1 felony classification. A violation of subsection C, lending or selling your own identifying information, is a misdemeanor punishable by up to one year in the county jail, a fine of up to $100,000, or both. That letter-and-number felony classification entered Section 1533.1 through Laws 2025, c. 486, Section 423, effective January 1, 2026, the act that reclassified Oklahoma felonies, rather than through the 2026 identity theft bill described below.

Restitution to the victim may be ordered in addition to any criminal penalty imposed by the court, and a victim of identity theft may bring a civil action for damages against any person who participated in furthering the crime or attempted crime.

Oklahoma law as it stands today contains no aggravated identity theft offense and no escalating penalty ladder for repeat convictions. Both arrive on November 1, 2026, and are described in the next section.

A separate provision, 21 O.S. Section 1533.3, gives a victim the right to contact the local law enforcement agency where the victim is domiciled and have an incident report about the identity theft prepared and filed, notwithstanding that jurisdiction to investigate and prosecute may lie elsewhere. The agency that prepares and files the report must provide the victim with a copy on request, and it may share the report with agencies in other jurisdictions. The section also provides that such an incident report is not an open case for the purpose of compiling open-case statistics, and that nothing in it interferes with a department's discretion over how to allocate investigative resources.

The 2026 Law: House Bill 3244

Oklahoma made a substantial change to its identity theft framework in 2026, but that change is not in force yet. House Bill 3244 takes effect November 1, 2026. Until that date, the law described in the section above is what applies.

From November 1, 2026, HB 3244 replaces Section 1533.1's short list of covered information with 61 enumerated categories, adding items such as fingerprints, DNA and other biological characteristics, biometric data, retinal scans, PIN numbers, security-question answers, usernames and passwords, cryptocurrency and peer-to-peer payment credentials, IP addresses, digital wallets and private keys, passports, notary stamps, medical documents, and tribal, casino, and medical marijuana cards.

The bill also restructures the penalties into a ladder. A first conviction remains a Class D1 felony punishable by imprisonment under Section 20N, or a fine of up to $100,000, or both. A second conviction, or possession of the identifying information of a minor or an elderly person, carries that same Class D1 classification. A third or subsequent conviction becomes a felony punishable by not less than ten years nor more than fifteen years in the custody of the Department of Corrections. A new subsection creates aggravated identity theft outright: any person in possession of the personal identifying information of five or more victims commits that offense, punishable by ten to fifteen years. A companion subsection provides that possessing five or more articles of identifying information without the owner's consent, each article belonging to a different person, business, or company, constitutes aggravated identity theft and creates a rebuttable presumption that the possessor intended to defraud.

What HB 3244 contributes on the penalty side is the repeat-conviction ladder and the aggravated tier. The Class D1 felony designation and the $100,000 fine ceiling were already in the statute before it, having arrived through the 2025 felony-reclassification act.

Two related statutes change alongside it. Section 1 of the bill broadens the definition of a «pattern of criminal offenses» at 21 O.S. Section 425 to reach conduct spanning two or more municipalities, conduct split between a county and a municipality within it, conduct in which one offense was committed outside Oklahoma, and conduct begun online through a computer application, social media, artificial intelligence, or a cellular network. It also adds organized retail theft to the predicate offenses that can establish such a pattern. It does not create a standalone organized retail theft crime.

Section 2 of the bill amends 21 O.S. Section 843.4, the exploitation of an elderly person or disabled adult statute. It does not raise an existing penalty; it creates two new offenses. A new subsection C makes it unlawful to use coercion, deception, enticement, intimidation, bartering, recruiting, or other means to exploit a person who has a mental illness, is vulnerable, homeless, intellectually or developmentally disabled, elderly, a user of drugs or alcohol, a minor, or whose legal status in this country may be unlawful, in order to get that person to engage in any crime. That offense is a felony punishable by up to ten years in the custody of the Department of Corrections, a fine of up to $10,000, or both. A new subsection D adds a pattern-of-exploitation offense, established by certain prior convictions or by participating in circumstances in which the exploited person committed offenses under Section 425, punishable by up to twenty years, a fine of up to $20,000, or both. The reach of both new provisions is any crime, not identity theft specifically.

HB 3244 was authored by Rep. Steve Bashore, with Sen. Chuck Hall as Senate author, and was supported by the Oklahoma Bankers Association, law enforcement agencies statewide, and AARP Oklahoma. The House passed it 92-0 on March 26, 2026, and the Senate passed it 46-0 on April 29, 2026. According to the Oklahoma Legislature's official bill-status page, the measure became law without the Governor's signature on May 7, 2026.

Where to Report Identity Theft in Oklahoma

Oklahoma's identity theft complaints are handled by the Attorney General's Consumer Protection Unit, which the office describes as fighting fraud and protecting Oklahoma consumers, including complaints involving identity theft, credit card scams, and telemarketing scams. To file a complaint, download and complete the Consumer Complaint form, save it as a PDF, and email it to ConsumerProtection@oag.ok.gov with «Complaint» in the subject line, attaching supporting documentation. The unit can also be reached by phone at (405) 521-2029 or (833) 681-1895, or by mail at 313 NE 21st Street, Oklahoma City, OK 73105.

Separately, the Oklahoma Department of Human Services publishes a general «Protect Your Identity» resource page listing the three credit bureaus' fraud lines, the FTC's identity theft hotline at 1-877-438-4338, and Social Security Administration guidance. That page is a Department of Human Services resource, not the Attorney General's office. Neither of these Oklahoma-specific resources names a dedicated identity-theft-only hotline separate from the general consumer complaint line described above.

Alongside either of those, Section 1533.3 entitles you to have your local police or sheriff's department prepare and file an incident report about the identity theft and give you a copy on request. That report is often what a bank, credit bureau, or creditor asks for when you dispute fraudulent activity.

Freezing a Minor's Credit in Oklahoma

Oklahoma's security freeze law is the Oklahoma Consumer Report Security Freeze Act, 24 O.S. Sections 149 and following. It defines a consumer as an individual who is a resident of the state, and it sets out how a consumer requests a freeze, how quickly a credit reporting agency must place it, and how to lift or remove it. It contains no separate provision for minors or protected consumers of the kind several other states have enacted.

That does not leave Oklahoma families without a remedy. Federal law gives a parent or guardian the right to freeze a child's credit file for free, and that right applies in Oklahoma regardless of what the state act covers. The next section explains it.

Federal Rights That Apply Regardless of State Law

Every identity theft victim in Oklahoma, including minors through a parent or guardian, has rights under federal law independent of anything Oklahoma's own statutes provide. A credit freeze and a fraud alert are both free by federal law under 15 U.S.C. Section 1681c-1, added by the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018. Filing a free report at IdentityTheft.gov, the FTC's federal recovery site, also unlocks the right under FCRA Section 605B, 15 U.S.C. Section 1681c-2, to have fraudulent information blocked from a credit report. For the full mechanics of both, see our guides on how to report identity theft and credit freeze vs. fraud alert.

Information last verified on 2026-09-02 against the Oklahoma Legislature's official published text of Title 21 (Sections 425, 1533.1 and 1533.3) and Title 24 (the Oklahoma Consumer Report Security Freeze Act), the enrolled text of House Bill 3244, the official HB 3244 bill-status page, the Oklahoma House of Representatives release on the bill, the Oklahoma Attorney General's Consumer Protection Unit pages, and the Oklahoma Department of Human Services identity-resources page. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-09-02.