Vermont Identity Theft Laws: Penalties and Victim Rights

Vermont's identity theft statute, 13 V.S.A. section 2030, works differently from many states. Instead of scaling the penalty to a dollar amount or a number of victims within a single scheme, Vermont caps a first offense at 3 years and $5,000 no matter how much was taken, and only raises the ceiling to 10 years and $10,000 for a second or later conviction tied to a separate scheme. This page covers that penalty structure, Vermont's own protected consumer security freeze law (which covers more people than the federal baseline), the state's breach notification requirements, and the federal recovery process that fills in the rest.

This article addresses Vermont state law, primarily 13 V.S.A. section 2030 (Title 13, Chapter 047, Frauds) and related provisions of Title 9, plus the federal layer that applies in every state. Some Vermont-specific practices, including the Attorney General's complaint process and whether a mandatory police-report or victim-certification program exists, could not be verified during this article's research and are flagged as open questions below rather than stated as fact.

13 V.S.A. 2030: Vermont's Identity Theft Statute

Vermont's identity theft law, found in Title 13, Chapter 047 (Frauds), prohibits two overlapping types of conduct. First, no person may obtain, produce, possess, use, sell, give, or transfer another person's personal identifying information with intent to use it to commit a misdemeanor or felony. Second, no person may knowingly or recklessly obtain, produce, possess, use, sell, give, or transfer that information without the other person's consent while knowingly or recklessly facilitating a third person's use of it to commit a misdemeanor or felony.

"Personal identifying information" is defined broadly under the statute: name, address, birth date, Social Security number, DMV PIN, phone number, financial and account numbers, credit and debit card numbers, a picture, an identification document, an electronic identification number, educational, health care, financial, credit, or employment records, an email address, a computer password, a mother's maiden name, or similar information. The statute carves out one specific exception: using someone else's identifying information solely to misrepresent one's own age for alcohol, tobacco, or similar age-restricted purposes does not fall under this section. Consent is an affirmative defense, which the defendant must prove by a preponderance of the evidence.

Penalties: A Recidivist Structure, Not a Dollar-Amount Tier

Vermont's penalty structure is genuinely different from the value-based or item-count tiers common in most states. A first offense carries a maximum of 3 years imprisonment, a $5,000 fine, or both, regardless of how much money or how many records were involved. The maximum only rises to 10 years imprisonment, a $10,000 fine, or both, for a second or subsequent conviction under this same statute that involves a separate scheme from the first. In other words, the amount of loss in a single incident does not by itself push the case into the higher penalty range; a prior conviction and a separate later scheme are what does.

Restitution

Section 2030 itself contains no restitution mandate. Vermont's general restitution statute, 13 V.S.A. section 7043, applies instead: restitution must be considered in every case where a victim of a crime has suffered a material loss, covering uninsured property loss, out-of-pocket monetary loss, lost wages, and medical expenses. This is a mandatory requirement to consider restitution, not an absolute guarantee it will be ordered in every case; if restitution is requested but not ordered, the court must state its reasons on the record. No separate statutory civil cause of action specific to identity theft was located in Vermont law during this article's research; Vermont's general Consumer Protection Act may offer a possible avenue, but that was not independently confirmed.

Vermont's Security Freeze Law: Broader Than the Federal Baseline

Vermont's protected consumer security freeze law sits in its own subchapter of Title 9, added by 2017 Act No. 179 (Adj. Sess.) and effective January 1, 2019, and it reaches further than the federal minor-freeze right, which took effect a few months earlier on September 21, 2018. A "protected consumer" under Vermont law includes anyone under 16 years of age at the time of the freeze request, an incapacitated person, or a "protected person" under Vermont guardianship law, a category broader than the federal baseline of minors and incapacitated adults. Under 9 V.S.A. section 2483a(c), a credit reporting agency must place the freeze not later than 30 days after it receives a compliant request from the protected consumer's representative, who must supply sufficient proof of identification and sufficient proof of authority to act, and must send written confirmation of the freeze within 10 business days of placing it, together with a unique PIN or password used to authorize any later release. A separate section, 9 V.S.A. section 2483b, bars a consumer reporting agency from charging a fee for any service performed under that subchapter. The freeze remains in place until the representative, or the consumer once they reach adulthood, requests its removal.

Vermont's general adult freeze runs on different rules. That law, 9 V.S.A. section 2480h, dates to 2005, but it was not free for everyone at first: it waived the fee only for identity theft victims and allowed a credit reporting agency to charge all other Vermont consumers up to $10.00 to place and $5.00 to remove a freeze. 2018 Act 171 struck those fees, and the change took effect on May 22, 2018, about four months before the federal free-freeze mandate reached every credit bureau nationwide on September 21, 2018. Section 2480h also runs on a shorter clock than the protected consumer sections: it gives a credit reporting agency five business days to place an adult freeze, not 30 days.

Breach Notification

Vermont's Security Breach Notice Act requires a business to notify affected Vermont consumers within 45 days of discovering a breach involving their personal information. Notice to the Attorney General or the Department of Financial Regulation is required within 14 business days, and notice to the credit bureaus is required without unreasonable delay if a breach affects more than 1,000 consumers. The statute does not mandate free credit monitoring; it only requires the notice itself to advise consumers to review their account statements and monitor their free credit reports.

Reporting Identity Theft in Vermont

The Vermont Attorney General's office was entirely unreachable during the research for this article, so this page cannot describe its specific complaint process, hotline number, or online form. Until that can be independently confirmed, Vermont residents should start with the federal reporting process: file a report at IdentityTheft.gov to generate a personalized recovery plan, and file a police report with your local Vermont law enforcement agency to support disputes with creditors and credit bureaus. Whether Vermont requires police to accept an identity theft report, or offers a formal victim-certification or expungement process, was not confirmed in either direction during this research; if those questions matter to your situation, confirm directly with the Attorney General's office or a Vermont attorney.

The Federal Layer

Every Vermont identity theft victim can also draw on federal protections that apply regardless of state. The Fair Credit Reporting Act's section 605b lets a victim submit a police report or FTC Identity Theft Report to block fraudulent information from appearing on their credit file. IdentityTheft.gov, run by the Federal Trade Commission, remains the fastest way to generate the initial recovery plan most other steps build on.

Information last verified on 2026-08-13. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.