Identity Theft, Breach Notification, and Consumer Reports
Identity Theft, Breach Notification, and Consumer Reports
Identity events, fraud reports, account and report disputes, consumer-report actors and purposes, accuracy, adverse action, breach events, state notification, security, evidence, correction, and strict handoff.
Structured Visual
Jurisdiction: US; as of 2026-08-28; not legal advice; Render structure, refuse interpretation, cite, abstain, and hand off.
RENDER STRUCTURE · REFUSE INTERPRETATION · CITE · ABSTAIN · HAND-OFF: render structure, refuse interpretation, cite provenance, abstain when unsupported, and hand off to human review.
Scope and honesty note
Jurisdiction: United States federal IP, privacy, consumer-data, and cybersecurity overview as of 2026-08-29; state, international, sectoral, contractual, factual, procedural, remedial, and version differences matter. Synthetic records are classroom inputs, not legal, licensing, infringement, registration, patentability, trademark, trade-secret, privacy, HIPAA, consumer-reporting, security, incident-response, criminal, health, identity or compliance advice. The model cannot determine ownership, protection, validity, infringement, fair use, obviousness, confusion, secrecy, license compatibility, consent, authorization, breach, liability, reporting, access, eligibility or outcome. Cite, expose gaps, abstain, and hand off. This health- or identity-sensitive chapter is not a medical, billing, treatment, coverage, identity-restoration, fraud-reporting, breach-response, safety, crisis or eligibility resource; it cannot assess harm or urgency and routes sensitive decisions to authorized humans.
See the essential structure first
Start with this deliberately incomplete structure, then use the pinned authorities, worked application, exceptions, and handoff below. This deliberately incomplete preview has 4 nodes; exceptions and legal consequences remain in the sourced prose below.
Jurisdiction: US; as of 2026-08-28; not legal advice; Render structure, refuse interpretation, cite, abstain, and hand off.
RENDER STRUCTURE · REFUSE INTERPRETATION · CITE · ABSTAIN · HAND-OFF: render structure, refuse interpretation, cite provenance, abstain when unsupported, and hand off to human review.
Begin with IP, privacy, or security doctrine
Identity theft, consumer reporting and breach notification are related but distinct systems. A fraud report is not a finding of identity theft or intent. FCRA's operative provisions define actors, permissible purposes, accuracy, disputes, reinvestigation, furnishing and adverse-action duties; section Sixteen-Eighty-One states purposes but does not itself decide those duties. Breach-notification laws vary by jurisdiction, data definition, acquisition or access, encryption, risk, timing and exceptions. A security incident is not automatically a legally reportable breach, and a breach notice is not an admission. Records should preserve evidence, communications and corrections without giving restoration, credit, debt or reporting advice.
FCRA findings and purpose
The provision pins congressional concerns about accuracy, fairness, efficiency, privacy and consumer reporting without substituting for operative sections. Verbatim source text: “§1681. Congressional findings and statement of purpose (a) Accuracy and fairness of credit reporting The Congress makes the following findings: (1) The banking system is dependent upon fair and accurate credit reporting. Inaccurate credit reports directly impair the efficiency of the banking system, and unfair credit reporting methods undermine the public confidence which is essential to the continued functioning of the banking system. (2) An elaborate mechanism has been developed for investigating and evaluating the credit worthiness, credit standing, credit capacity, character, and general reputation of consumers. (3) Consumer reporting agencies have assumed a vital role in assembling and evaluating consumer credit and other information on consumers. (4) There is a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy. (b) Reasonable procedures It is the purpose of this subchapter to require that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information in accordance with the requirements of this subchapter. (Pub. L. 90–321, title VI, §602, as added Pub. L. 91–508, title VI, §601, Oct. 26, 1970, 84 Stat. 1128 .)” Source: 15 U.S.C. § 1681; https://www.neochart.com/catalog/federal/title_15/section_1681/title15_sec1681_bdbfc2128004/1681_congressional_findings_and_statement_of_purpose_0001/index.html; data via neochart.com, snapshot 2026-08.
Unfairness and deception coordinate
FTC Act text anchors separate representations, security practices and enforcement predicates. Verbatim source text: “§45. Unfair methods of competition unlawful; prevention by Commission (a) Declaration of unlawfulness; power to prohibit unfair practices; inapplicability to foreign trade (1) Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful. (2) The Commission is hereby empowered and directed to prevent persons, partnerships, or corporations, except banks, savings and loan institutions described in section 57a(f)(3) of this title, Federal credit unions described in section 57a(f)(4) of this title, common carriers subject to the Acts to regulate commerce, air carriers and foreign air carriers subject to part A of subtitle VII of title 49, and persons, partnerships, or corporations insofar as they are subject to the Packers and Stockyards Act, 1921, as amended [7 U.S.C. 181 et seq.], except as provided in section 406(b) of said Act [7 U.S.C. 227(b)], from using unfair methods of competition in or affecting commerce and unfair or deceptive acts or practices in or affecting commerce. (3) This subsection shall not apply to unfair methods of competition involving commerce with foreign nations (other than import commerce) unless- (A) such methods of competition have a direct, substantial, and reasonably foreseeable effect- (i) on commerce which is not commerce with foreign nations, or on import commerce with foreign nations; or (ii) on export commerce with foreign nations, of a person engaged in such commerce in the United States; and (B) such effect gives rise to a claim under the provisions of this subsection, other than this paragraph. If this subsection applies to such methods of competition only because of the operation of subparagraph (A)(ii), this subsection shall apply to such conduct only for injury to export business in the United States. (4)(A) For purposes of subsection (a), the term "unfair or deceptive acts or practices" includes such acts or practices involving foreign commerce that- (i) cause or are likely to cause reasonably foreseeable injury within the United States; or (ii) involve material conduct occurring within the United States. (B) All remedies available to the Commission with respect to unfair and deceptive acts or practices shall be available for acts and practices described in this paragraph, including restitution to domestic or foreign victims. (b) Proceeding by Commission; modifying and setting aside orders Whenever the Commission shall have reason to believe that any such person, partnership, or corporation has been or is using any unfair method of competition or unfair or deceptive act or practice in or affecting commerce, and if it shall appear to the Commission that a proceeding by it in respect thereof would be to the interest of the public, it shall issue and serve upon such person, partnership, or corporation a complaint stating its charges in that respect and containing a notice of a hearing upon a day and at a place therein fixed at least thirty days after the service of said complaint. The person, partnership, or corporation so complained of shall have the right to appear at the place and time so fixed and show cause why an order should not be entered by the Commission requiring such person, partnership, or corporation to cease and desist from the violation of the law so charged in said complaint. Any person, partnership, or corporation may make application, and upon good cause shown may be allowed by the Commission to intervene and appear in said proceeding by counsel or in person. The testimony in any such proceeding shall be reduced to writing and filed in the office of the Commission. If upon such hearing the Commission shall be of the opinion that the method of competition or the act or practice in question is prohibited by this subchapter, it shall make a report in writing in which it shall state its findings as to the facts and shall issue and cause to be served on such person, partnership, or corporation an order requiring such person, partnership, or corporation to cease and desist from using such method of competition or such act or practice. Until the expiration of the time allowed for filing a petition for review, if no such petition has been duly filed within such time, or, if a petition for review has been filed within such time then until the record in the proceeding has been filed in a court of appeals of the United States, as hereinafter provided, the Commission may at any time, upon such notice and in such manner as it shall deem proper, modify or set aside, in whole or in part, any report or any order made or issued by it under this section. After the expiration of the time allowed for filing a petition for review, if no such petition has been duly filed within such time, the Commission may at any time, after notice and opportunity for hearing, reopen and alter, modify, or set aside, in whole or in part any report or order made or issued by it under this section, whenever in the opinion of the Commission conditions of fact or of law have so changed as to require such action or if the public interest shall so require, except that (1) the said person, partnership, or corporation may, within sixty days after service upon him or it of said report or order entered after such a reopening, obtain a review thereof in the appropriate court of appeals of the United States, in the manner provided in subsection (c) of this section; and (2) in the case of an order, the Commission shall reopen any such order to consider whether such order (including any affirmative relief provision contained in such order) should be altered, modified, or set aside, in whole or in part, if the person, partnership, or corporation involved files a request with the Commission which makes a satisfactory showing that changed conditions of law or fact require such order to be altered, modified, or set aside, in whole or in part. The Commission shall determine whether to alter, modify, or set aside any order of the Commission in response to a request made by a person, partnership, or corporation under paragraph 1 (2) not later than 120 days after the date of the filing of such request. (c) Review of order; rehearing Any person, partnership, or corporation required by an order of the Commission to cease and desist from using any method of competition or act or practice may obtain a review of such order in the court of appeals of the United States, within any circuit where the method of competition or the act or practice in question was used or where such person, partnership, or corporation resides or carries on business, by filing in the court, within sixty days from the date of the service of such order, a written petition praying that the order of the Commission be set aside. A copy of such petition shall be forthwith transmitted by the clerk of the court to the Commission, and thereupon the Commission shall file in the court the record in the proceeding, as provided in section 2112 of title 28. Upon such filing of the petition the court shall have jurisdiction of the proceeding and of the question determined therein concurrently with the Commission until the filing of the record and shall have power to make and enter a decree affirming, modifying, or setting aside the order of the Commission, and enforcing the same to the extent that such order is affirmed and to issue such writs as are ancillary to its jurisdiction or are necessary in its judgement to prevent injury to the public or to competitors pendente lite. The findings of the Commission as to the facts, if supported by evidence, shall be conclusive. To the extent that the order of the Commission is affirmed, the court shall thereupon issue its own order commanding obedience to the terms of such order of the Commission. If either party shall apply to the court for leave to adduce additional evidence, and shall show to the satisfaction of the court that such additional evidence is material and that there were reasonable grounds for the failure to adduce such evidence in the proceeding before the Commission, the court may order such additional evidence to be taken before the Commission and to be adduced upon the hearing in such manner and upon such terms and conditions as to the court may seem proper. The Commission may modify its findings as to the facts, or make new findings, by reason of the additional evidence so taken, and it shall file such modified or new findings, which, if supported by evidence, shall be conclusive, and its recommendation, if any, for the modification or setting aside of its original order, with the return of such additional evidence. The judgment and decree of the court shall be final, except that the same shall be subject to review by the Supreme Court upon certiorari, as provided in section 1254 of title 28. (d) Jurisdiction of court Upon the filing of the record with it the jurisdiction of the court of appeals of the United States to affirm, enforce, modify, or set aside orders of the Commission shall be exclusive. (e) Exemption from liability No order of the Commission or judgement of court to enforce the same shall in anywise relieve or absolve any person, partnership, or corporation from any liability under the Antitrust Acts. (f) Service of complaints, orders and other processes; return Complaints, orders, and other processes of the Commission under this section may be served by anyone duly authorized by the Commission, either (a) by delivering a copy thereof to the person to be served, or to a member of the partnership to be served, or the president, secretary, or other executive officer or a director of the corporation to be served; or (b) by leaving a copy thereof at the residence or the principal office or place of business of such person, partnership, or corporation; or (c) by mailing a copy thereof by registered mail or by certified mail addressed to such person, partnership, or corporation at his or its residence or principal office or place of business. The verified return by the person so serving said complaint, order, or other process setting forth the manner of said service shall be proof of the same, and the return post office receipt for said complaint, order, or other process mailed by registered mail or by certified mail as aforesaid shall be proof of the service of the same. (g) Finality of order An order of the Commission to cease and desist shall become final- (1) Upon the expiration of the time allowed for filing a petition for review, if no such petition has been duly filed within such time; but the Commission may thereafter modify or set aside its order to the extent provided in the last sentence of subsection (b). (2) Except as to any order provision subject to paragraph (4), upon the sixtieth day after such order is served, if a petition for review has been duly filed; except that any such order may be stayed, in whole or in part and subject to such conditions as may be appropriate, by- (A) the Commission; (B) an appropriate court of appeals of the United States, if (i) a petition for review of such order is pending in such court, and (ii) an application for such a stay was previously submitted to the Commission and the Commission, within the 30-day period beginning on the date the application was received by the Commission, either denied the application or did not grant or deny the application; or (C) the Supreme Court, if an applicable petition for certiorari is pending. (3) For purposes of subsection (m)(1)(B) and of section 57b(a)(2) of this title, if a petition for review of the order of the Commission has been filed- (A) upon the expiration of the time allowed for filing a petition for certiorari, if the order of the Commission has been affirmed or the petition for review has been dismissed by the court of appeals and no petition for certiorari has been duly filed; (B) upon the denial of a petition for certiorari, if the order of the Commission has been affirmed or the petition for review has been dismissed by the court of appeals; or (C) upon the expiration of 30 days from the date of issuance of a mandate of the Supreme Court directing that the order of the Commission be affirmed or the petition for review be dismissed. (4) In the case of an order provision requiring a person, partnership, or corporation to divest itself of stock, other share capital, or assets, if a petition for review of such order of the Commission has been filed- (A) upon the expiration of the time allowed for filing a petition for certiorari, if the order of the Commission has been affirmed or the petition for review has been dismissed by the court of appeals and no petition for certiorari has been duly filed; (B) upon the denial of a petition for certiorari, if the order of the Commission has been affirmed or the petition for review has been dismissed by the court of appeals; or (C) upon the expiration of 30 days from the date of issuance of a mandate of the Supreme Court directing that the order of the Commission be affirmed or the petition for review be dismissed. (h) Modification or setting aside of order by Supreme Court If the Supreme Court directs that the order of the Commission be modified or set aside, the order of the Commission rendered in accordance with the mandate of the Supreme Court shall become final upon the expiration of thirty days from the time it was rendered, unless within such thirty days either party has instituted proceedings to have such order corrected to accord with the mandate, in which event the order of the Commission shall become final when so corrected. (i) Modification or setting aside of order by Court of Appeals If the order of the Commission is modified or set aside by the court of appeals, and if (1) the time allowed for filing a petition for certiorari has expired and no such petition has been duly filed, or (2) the petition for certiorari has been denied, or (3) the decision of the court has been affirmed by the Supreme Court, then the order of the Commission rendered in accordance with the mandate of the court of appeals shall become final on the expiration of thirty days from the time such order of the Commission was rendered, unless within such thirty days either party has instituted proceedings to have such order corrected so that it will accord with the mandate, in which event the order of the Commission shall become final when so corrected. (j) Rehearing upon order or remand If the Supreme Court orders a rehearing; or if the case is remanded by the court of appeals to the Commission for a rehearing, and if (1) the time allowed for filing a petition for certiorari has expired, and no such petition has been duly filed, or (2) the petition for certiorari has been denied, or (3) the decision of the court has been affirmed by the Supreme Court, then the order of the Commission rendered upon such rehearing shall become final in the same manner as though no prior order of the Commission had been rendered. (k) "Mandate" defined As used in this section the term "mandate", in case a mandate has been recalled prior to the expiration of thirty days from the date of issuance thereof, means the final mandate. (l) Penalty for violation of order; injunctions and other appropriate equitable relief Any person, partnership, or corporation who violates an order of the Commission after it has become final, and while such order is in effect, shall forfeit and pay to the United States a civil penalty of not more than $10,000 for each violation, which shall accrue to the United States and may be recovered in a civil action brought by the Attorney General of the United States. Each separate violation of such an order shall be a separate offense, except that in a case of a violation through continuing failure to obey or neglect to obey a final order of the Commission, each day of continuance of such failure or neglect shall be deemed a separate offense. In such actions, the United States district courts are empowered to grant mandatory injunctions and such other and further equitable relief as they deem appropriate in the enforcement of such final orders of the Commission. (m) Civil actions for recovery of penalties for knowing violations of rules and cease and desist orders respecting unfair or deceptive acts or practices; jurisdiction; maximum amount of penalties; continuing violations; de novo determinations; compromise or settlement procedure (1)(A) The Commission may commence a civil action to recover a civil penalty in a district court of the United States against any person, partnership, or corporation which violates any rule under this subchapter respecting unfair or deceptive acts or practices (other than an interpretive rule or a rule violation of which the Commission has provided is not an unfair or deceptive act or practice in violation of subsection (a)(1)) with actual knowledge or knowledge fairly implied on the basis of objective circumstances that such act is unfair or deceptive and is prohibited by such rule. In such action, such person, partnership, or corporation shall be liable for a civil penalty of not more than $10,000 for each violation. (B) If the Commission determines in a proceeding under subsection (b) that any act or practice is unfair or deceptive, and issues a final cease and desist order, other than a consent order, with respect to such act or practice, then the Commission may commence a civil action to obtain a civil penalty in a district court of the United States against any person, partnership, or corporation which engages in such act or practice- (1) after such cease and desist order becomes final (whether or not such person, partnership, or corporation was subject to such cease and desist order), and (2) with actual knowledge that such act or practice is unfair or deceptive and is unlawful under subsection (a)(1) of this section. In such action, such person, partnership, or corporation shall be liable for a civil penalty of not more than $10,000 for each violation. (C) In the case of a violation through continuing failure to comply with a rule or with subsection (a)(1), each day of continuance of such failure shall be treated as a separate violation, for purposes of subparagraphs (A) and (B). In determining the amount of such a civil penalty, the court shall take into account the degree of culpability, any history of prior such conduct, ability to pay, effect on ability to continue to do business, and such other matters as justice may require. (2) If the cease and desist order establishing that the act or practice is unfair or deceptive was not issued against the defendant in a civil penalty action under paragraph (1)(B) the issues of fact in such action against such defendant shall be tried de novo. Upon request of any party to such an action against such defendant, the court shall also review the determination of law made by the Commission in the proceeding under subsection (b) that the act or practice which was the subject of such proceeding constituted an unfair or deceptive act or practice in violation of subsection (a). (3) The Commission may compromise or settle any action for a civil penalty if such compromise or settlement is accompanied by a public statement of its reasons and is approved by the court. (n) Standard of proof; public policy considerations The Commission shall have no authority under this section or section 57a of this title to declare unlawful an act or practice on the grounds that such act or practice is unfair unless the act or practice causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition. In determining whether an act or practice is unfair, the Commission may consider established public policies as evidence to be considered with all other evidence. Such public policy considerations may not serve as a primary basis for such determination. (Sept. 26, 1914, ch. 311, §5, 38 Stat. 719 ; Mar. 21, 1938, ch. 49, §3, 52 Stat. 111 ; June 23, 1938, ch. 601, title XI, §1107(f), 52 Stat. 1028 ; June 25, 1948, ch. 646, §32(a), 62 Stat. 991 ; May 24, 1949, ch. 139, §127, 63 Stat. 107 ; Mar. 16, 1950, ch. 61, §4(c), 64 Stat. 21 ; July 14, 1952, ch. 745, §2, 66 Stat. 632 ; Pub. L. 85–726, title XIV, §§1401(b), 1411, Aug. 23, 1958, 72 Stat. 806 , 809; Pub. L. 85–791, §3, Aug. 28, 1958, 72 Stat. 942 ; Pub. L. 85–909, §3, Sept. 2, 1958, 72 Stat. 1750 ; Pub. L. 86–507, §1(13), June 11, 1960, 74 Stat. 200 ; Pub. L. 93–153, title IV, §408(c), (d), Nov. 16, 1973, 87 Stat. 591 , 592; Pub. L. 93–637, title II, §§201(a), 204(b), 205(a), Jan. 4, 1975, 88 Stat. 2193 , 2200; Pub. L. 94–145, §3, Dec. 12, 1975, 89 Stat. 801 ; Pub. L. 96–37, §1(a), July 23, 1979, 93 Stat. 95 ; Pub. L. 96–252, §2, May 28, 1980, 94 Stat. 374 ; Pub. L. 97–290, title IV, §403, Oct. 8, 1982, 96 Stat. 1246 ; Pub. L. 98–620, title IV, §402(12), Nov. 8, 1984, 98 Stat. 3358 ; Pub. L. 100–86, title VII, §715(a)(1), Aug. 10, 1987, 101 Stat. 655 ; Pub. L. 103–312, §§4, 6, 9, Aug. 26, 1994, 108 Stat. 1691 , 1692, 1695; Pub. L. 109–455, §§3, 13, Dec. 22, 2006, 120 Stat. 3372 , 3382; Pub. L. 112–203, §1, Dec. 4, 2012, 126 Stat. 1484 .) Amendment of Section For repeal of amendment by section 13 of Pub. L. 109–455, see Termination Date of 2006 Amendment note below.” Source: 15 U.S.C. § 45; https://www.neochart.com/catalog/federal/title_15/section_45/title15_sec45_b96b57465c31/45_unfair_methods_of_competition_unlawful_prevention_by_comm_0001/index.html; data via neochart.com, snapshot 2026-08.
Unauthorized-computer-access coordinate
CFAA text anchors specified computer conduct but does not make every identity or breach event a CFAA offense. Verbatim source text: “§ 1030. Fraud and related activity in connection with computers Whoever— (1) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained information that has been determined by the United States Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations, or any restricted data, as defined in paragraph y. of section 11 of the Atomic Energy Act of 1954, with reason to believe that such information so obtained could be used to the injury of the United States, or to the advantage of any foreign nation willfully communicates, delivers, transmits, or causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States entitled to receive it; (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (A) information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602(n) 1 1 See References in Text note below. of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act ( 15 U.S.C. 1681 et seq.); (B) information from any department or agency of the United States; or (C) information from any protected computer; (3) intentionally, without authorization to access any nonpublic computer of a department or agency of the United States, accesses such a computer of that department or agency that is exclusively for the use of the Government of the United States or, in the case of a computer not exclusively for such use, is used by or for the Government of the United States and such conduct affects that use by or for the Government of the United States; (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period; (5) (A) knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; (B) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or (C) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss. 2 2 So in original. The period probably should be a semicolon. (6) knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if— (A) such trafficking affects interstate or foreign commerce; or (B) such computer is used by or for the Government of the United States; 3 3 So in original. Probably should be followed by “or”. (7) with intent to extort from any person any money or other thing of value, transmits in interstate or foreign commerce any communication containing any— (A) threat to cause damage to a protected computer; (B) threat to obtain information from a protected computer without authorization or in excess of authorization or to impair the confidentiality of information obtained from a protected computer without authorization or by exceeding authorized access; or (C) demand or request for money or other thing of value in relation to damage to a protected computer, where such damage was caused to facilitate the extortion; shall be punished as provided in subsection (c) of this section. Whoever conspires to commit or attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section. The punishment for an offense under subsection (a) or (b) of this section is— (1) (A) a fine under this title or imprisonment for not more than ten years, or both, in the case of an offense under subsection (a)(1) of this section which does not occur after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; and (B) a fine under this title or imprisonment for not more than twenty years, or both, in the case of an offense under subsection (a)(1) of this section which occurs after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; (2) (A) except as provided in subparagraph (B), a fine under this title or imprisonment for not more than one year, or both, in the case of an offense under subsection (a)(2), (a)(3), or (a)(6) of this section which does not occur after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; (B) a fine under this title or imprisonment for not more than 5 years, or both, in the case of an offense under subsection (a)(2), or an attempt to commit an offense punishable under this subparagraph, if— (i) the offense was committed for purposes of commercial advantage or private financial gain; (ii) the offense was committed in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or of any State; or (iii) the value of the information obtained exceeds $5,000; and (C) a fine under this title or imprisonment for not more than ten years, or both, in the case of an offense under subsection (a)(2), (a)(3) or (a)(6) of this section which occurs after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; (3) (A) a fine under this title or imprisonment for not more than five years, or both, in the case of an offense under subsection (a)(4) or (a)(7) of this section which does not occur after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; and (B) a fine under this title or imprisonment for not more than ten years, or both, in the case of an offense under subsection (a)(4), 4 4 So in original. The comma probably should not appear. or (a)(7) of this section which occurs after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; (4) (A) except as provided in subparagraphs (E) and (F), a fine under this title, imprisonment for not more than 5 years, or both, in the case of— (i) an offense under subsection (a)(5)(B), which does not occur after a conviction for another offense under this section, if the offense caused (or, in the case of an attempted offense, would, if completed, have caused)— (I) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value; (II) the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals; (III) physical injury to any person; (IV) a threat to public health or safety; (V) damage affecting a computer used by or for an entity of the United States Government in furtherance of the administration of justice, national defense, or national security; or (VI) damage affecting 10 or more protected computers during any 1-year period; or (ii) an attempt to commit an offense punishable under this subparagraph; (B) except as provided in subparagraphs (E) and (F), a fine under this title, imprisonment for not more than 10 years, or both, in the case of— (i) an offense under subsection (a)(5)(A), which does not occur after a conviction for another offense under this section, if the offense caused (or, in the case of an attempted offense, would, if completed, have caused) a harm provided in subclauses (I) through (VI) of subparagraph (A)(i); or (ii) an attempt to commit an offense punishable under this subparagraph; (C) except as provided in subparagraphs (E) and (F), a fine under this title, imprisonment for not more than 20 years, or both, in the case of— (i) an offense or an attempt to commit an offense under subparagraphs (A) or (B) of subsection (a)(5) that occurs after a conviction for another offense under this section; or (ii) an attempt to commit an offense punishable under this subparagraph; (D) a fine under this title, imprisonment for not more than 10 years, or both, in the case of— (i) an offense or an attempt to commit an offense under subsection (a)(5)(C) that occurs after a conviction for another offense under this section; or (ii) an attempt to commit an offense punishable under this subparagraph; (E) if the offender attempts to cause or knowingly or recklessly causes serious bodily injury from conduct in violation of subsection (a)(5)(A), a fine under this title, imprisonment for not more than 20 years, or both; (F) if the offender attempts to cause or knowingly or recklessly causes death from conduct in violation of subsection (a)(5)(A), a fine under this title, imprisonment for any term of years or for life, or both; or (G) a fine under this title, imprisonment for not more than 1 year, or both, for— (i) any other offense under subsection (a)(5); or (ii) an attempt to commit an offense punishable under this subparagraph. (1) The United States Secret Service shall, in addition to any other agency having such authority, have the authority to investigate offenses under this section. (2) The Federal Bureau of Investigation shall have primary authority to investigate offenses under subsection (a)(1) for any cases involving espionage, foreign counterintelligence, information protected against unauthorized disclosure for reasons of national defense or foreign relations, or Restricted Data (as that term is defined in section 11y of the Atomic Energy Act of 1954 ( 42 U.S.C. 2014(y) ), except for offenses affecting the duties of the United States Secret Service pursuant to section 3056(a) of this title . (3) Such authority shall be exercised in accordance with an agreement which shall be entered into by the Secretary of the Treasury and the Attorney General. As used in this section— (1) the term “computer” means an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device; (2) the term “protected computer” means a computer— (A) exclusively for the use of a financial institution or the United States Government, or, in the case of a computer not exclusively for such use, used by or for a financial institution or the United States Government and the conduct constituting the offense affects that use by or for the financial institution or the Government; (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; or (C) that— (i) is part of a voting system; and (ii) (I) is used for the management, support, or administration of a Federal election; or (II) has moved in or otherwise affects interstate or foreign commerce; (3) the term “State” includes the District of Columbia, the Commonwealth of Puerto Rico, and any other commonwealth, possession or territory of the United States; (4) the term “financial institution” means— (A) an institution, with deposits insured by the Federal Deposit Insurance Corporation; (B) the Federal Reserve or a member of the Federal Reserve including any Federal Reserve Bank; (C) a credit union with accounts insured by the National Credit Union Administration; (D) a member of the Federal home loan bank system and any home loan bank; (E) any institution of the Farm Credit System under the Farm Credit Act of 1971; (F) a broker-dealer registered with the Securities and Exchange Commission pursuant to section 15 of the Securities Exchange Act of 1934; (G) the Securities Investor Protection Corporation; (H) a branch or agency of a foreign bank (as such terms are defined in paragraphs (1) and (3) of section 1(b) of the International Banking Act of 1978); and (I) an organization operating under section 25 or section 25(a) 1 of the Federal Reserve Act; (5) the term “financial record” means information derived from any record held by a financial institution pertaining to a customer’s relationship with the financial institution; (6) the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter; (7) the term “department of the United States” means the legislative or judicial branch of the Government or one of the executive departments enumerated in section 101 of title 5 ; (8) the term “damage” means any impairment to the integrity or availability of data, a program, a system, or information; (9) the term “government entity” includes the Government of the United States, any State or political subdivision of the United States, any foreign country, and any state, province, municipality, or other political subdivision of a foreign country; (10) the term “conviction” shall include a conviction under the law of any State for a crime punishable by imprisonment for more than 1 year, an element of which is unauthorized access, or exceeding authorized access, to a computer; (11) the term “loss” means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service; (12) the term “person” means any individual, firm, corporation, educational institution, financial institution, governmental entity, or legal or other entity; (13) the term “Federal election” means any election (as defined in section 301(1) of the Federal Election Campaign Act of 1971 ( 52 U.S.C. 30101(1) )) for Federal office (as defined in section 301(3) of the Federal Election Campaign Act of 1971 ( 52 U.S.C. 30101(3) )); and (14) the term “voting system” has the meaning given the term in section 301(b) of the Help America Vote Act of 2002 ( 52 U.S.C. 21081(b) ). This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States. Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in subclauses 5 5 So in original. Probably should be “subclause”. (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i). Damages for a violation involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages. No action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage. No action may be brought under this subsection for the negligent design or manufacture of computer hardware, computer software, or firmware. The Attorney General and the Secretary of the Treasury shall report to the Congress annually, during the first 3 years following the date of the enactment of this subsection, concerning investigations and prosecutions under subsection (a)(5). (1) The court, in imposing sentence on any person convicted of a violation of this section, or convicted of conspiracy to violate this section, shall order, in addition to any other sentence imposed and irrespective of any provision of State law, that such person forfeit to the United States— (A) such person’s interest in any personal property that was used or intended to be used to commit or to facilitate the commission of such violation; and (B) any property, real or personal, constituting or derived from, any proceeds that such person obtained, directly or indirectly, as a result of such violation. (2) The criminal forfeiture of property under this subsection, any seizure and disposition thereof, and any judicial proceeding in relation thereto, shall be governed by the provisions of section 413 of the Comprehensive Drug Abuse Prevention and Control Act of 1970 ( 21 U.S.C. 853 ), except subsection (d) of that section. For purposes of subsection (i), the following shall be subject to forfeiture to the United States and no property right shall exist in them: (1) Any personal property used or intended to be used to commit or to facilitate the commission of any violation of this section, or a conspiracy to violate this section. (2) Any property, real or personal, which constitutes or is derived from proceeds traceable to any violation of this section, or a conspiracy to violate this section 6 6 So in original. Probably should be followed by a period. Pub. L. 98–473, title II, § 2102(a) Oct. 12, 1984 98 Stat. 2190 Pub. L. 99–474, § 2 Oct. 16, 1986 100 Stat. 1213 Pub. L. 100–690, title VII, § 7065 Nov. 18, 1988 102 Stat. 4404 Pub. L. 101–73, title IX, § 962(a)(5) Aug. 9, 1989 103 Stat. 502 Pub. L. 101–647, title XII, § 1205(e) Nov. 29, 1990 104 Stat. 4831 Pub. L. 103–322, title XXIX, § 290001(b) Sept. 13, 1994 108 Stat. 2097–2099 Pub. L. 104–294, title II, § 201 Oct. 11, 1996 110 Stat. 3491 Pub. L. 107–56, title V, § 506(a) Oct. 26, 2001 115 Stat. 366 Pub. L. 107–273, div. B, title IV Nov. 2, 2002 116 Stat. 1807 Pub. L. 107–296, title XXII, § 2207(g) Nov. 25, 2002 116 Stat. 2158 Pub. L. 115–278, § 2(g)(2)(I) Nov. 16, 2018 132 Stat. 4178 Pub. L. 110–326, title II Sept. 26, 2008 122 Stat. 3561 Pub. L. 116–179, § 2 Oct. 20, 2020 134 Stat. 855 Editorial Notes” Source: 18 U.S.C. § 1030; https://www.neochart.com/catalog/federal/title_18/section_1030/title18_sec1030_41f1f6480d2a/1030_fraud_and_related_activity_in_connection_with_computers_0001/index.html; data via neochart.com, snapshot 2026-08.
Pin the synthetic asset and data record
A synthetic strict-handoff packet folds identity-fraud report records into person, account and transaction rows, disputes and corrections, agency and furnisher fields, report versions, permissible-purpose and adverse-action labels, security logs, incident and forensic records, affected-person and jurisdiction matrices, notification decisions, notice deliveries, regulator events, complaints, evidence custody and reviewer handoffs.
Work the source-bound application
The unfamiliar account remains a reported event while institutions and authorized investigators evaluate it. The consumer-report branch classifies agency, furnisher and user roles before any operative FCRA duty, and does not infer permissible purpose from system access. The security event is mapped across state definitions and encryption or risk branches; the model stores the organization's signed notification decision but neither declares a breach nor gives identity-restoration steps.
Read the populated audit record
The identity-and-breach record contains person, identifier, account, transaction, inquiry, fraud allegation, report, document, institution, freeze field, block field, consumer reporting agency, furnisher, user, report version, data source, permissible-purpose claim, accuracy field, dispute, reinvestigation, response, correction, score, adverse action, security incident, system, data type, access, acquisition, encryption, resident, jurisdiction, threshold, timing source, notification decision, notice, delivery, regulator, evidence, custody, complaint, and reviewer. The artifact contains 17 populated rows.
Jurisdiction: US; as of 2026-08-28; not legal advice; Render structure, refuse interpretation, cite, abstain, and hand off.
RENDER STRUCTURE · REFUSE INTERPRETATION · CITE · ABSTAIN · HAND-OFF: render structure, refuse interpretation, cite provenance, abstain when unsupported, and hand off to human review.
Read the complete record
The complete record keeps sources, stated facts, and questions for review separate. Pinned authorities: Verbatim statute or bounded case excerpt. 15 U.S.C. § 1681: FCRA findings and purpose: The provision pins congressional concerns about accuracy, fairness, efficiency, privacy and consumer reporting without substituting for operative sections.. 15 U.S.C. § 45: Unfairness and deception coordinate: FTC Act text anchors separate representations, security practices and enforcement predicates.. 18 U.S.C. § 1030: Unauthorized-computer-access coordinate: CFAA text anchors specified computer conduct but does not make every identity or breach event a CFAA offense.. Synthetic asset and data record: Classroom facts, not ownership or compliance conclusions. Identity event: Person reports unfamiliar account, transaction, address, inquiry and collection item with dates, institutions, identifiers, documents and dispute status. Consumer report: Agency, furnisher, user, report version, data source, permissible-purpose claim, score, dispute, reinvestigation, result, notice and adverse-action record. Security event: Organization detects access anomaly, affected systems and data, containment record, forensic facts, state residents, notification-law matrix, regulator and consumer communications. Legal and technical trace: Regime, scope, elements, limits, provenance, safeguards and handoff. Identity record: Person, identifier, account, transaction, inquiry, impersonation allegation, report, law-enforcement document label, affidavit, institution notice, block or freeze request, correction and restoration status. No crime finding: Identity-theft or fraud labels remain allegations or report categories until an authorized process establishes statutory elements and actor intent. FCRA actors: Consumer reporting agency, furnisher, user, consumer, consumer report and investigative report are role- and purpose-specific; section Sixteen-Eighty-One supplies purpose only. Consumer-report lifecycle: Collection, source, matching, permissible-purpose claim, disclosure, accuracy, dispute, reinvestigation, furnisher response, deletion or modification, file notice, score and adverse action. Breach analysis: Security incident, unauthorized acquisition or access standard, personal-information definition, encryption or redaction, harm or risk threshold, jurisdiction, timing source, content, recipients, substitute notice, regulator and exception. Evidence and response: Log, image, timestamp, custody, privilege, investigation, containment, preservation, notice version, delivery, bounce, call, complaint, correction, audit and review. Strict firewall: No identity-restoration, fraud, credit, debt, consumer-report entitlement, breach, notification, law-enforcement, financial, safety or crisis decision; no resource promise.
Narrow summary
Keep identity allegations, consumer-report duties and breach decisions separate, preserve evidence and corrections, and retain strict no-restoration/no-reporting-decision handoff.