Access Device Fraud: Charges and Federal Criminal Defense

Under §1029(e)(1), an access device includes a card, account number, PIN, code, electronic identifier, or another means of account access capable of obtaining value or initiating a qualifying funds transfer. Information stored in a spreadsheet or database may qualify.

Unlike disputes about particular credit card transactions, access device cases may involve credentials collected or circulated before any purchase. Their source, movement, and possible use become important investigative questions.

Section 1029(a)(1) prohibits knowingly producing, using, or trafficking in counterfeit access devices with intent to defraud, without a separate $1,000 threshold.

Section 1029(a)(2) applies when a person knowingly and with intent to defraud uses or traffics in unauthorized access devices and, through that conduct, obtains at least $1,000 in value during a one-year period. Section 1029(a)(5) instead concerns knowingly effecting transactions with devices issued to others, with intent to defraud, to receive payments or other things of value totaling at least $1,000 within a year.

Prosecutors must connect the amount to the act covered by the charged subsection. Dates, payment records, and the recipient's identity can affect that calculation.

Under §1029(a)(3), knowing possession of 15 or more counterfeit or unauthorized access devices with intent to defraud can be charged without completed purchases. Qualifying electronic account numbers may count, but the government must establish which entries meet the statutory definition.

Section 1029(a)(4) separately covers knowing production, trafficking, control, custody, or possession of device-making equipment with intent to defraud. Equipment must be designed or primarily used to make access devices; an ordinary computer alone does not establish that element.

Section 1029(a)(6) covers solicitation without an issuer's authorization and with intent to defraud, for purposes including offering an access device or selling information or an application to obtain one. Section 1029(a)(10) addresses arranging for another person to present access-device transaction records for payment to a credit card system member or agent, without its authorization and with fraudulent intent.

Other provisions cover altered telecommunications instruments, scanning receivers, and hardware or software configured to manipulate telecommunications identifying information. The charged subsection makes the equipment's design, configuration, and alleged use significant.

Investigators review transaction histories, messages, file metadata, cloud synchronization data, and forensic images of seized devices. Creation dates, login histories, permissions, and transfer logs help reconstruct when and by whom credentials were handled.

An IP address or device identifier can connect an event to a system without identifying its user. Shared accounts, remote access, and other users may affect the attribution.

Under §1029(c)(1), maximum imprisonment for a subsection (a) offense is:

Up to 10 years for §1029(a)(1), (2), (3), (6), (7), and (10).

Up to 15 years for §1029(a)(4), (5), (8), and (9).

Up to 20 years when the offense follows a prior §1029 conviction.

Attempts under §1029(b)(1) carry the penalties of the attempted offense. Conspiracy under §1029(b)(2) requires an agreement of at least two people and conduct by a participant in furtherance of the offense; the maximum imprisonment is half that of the underlying crime.

Courts consider the advisory Federal Sentencing Guidelines and 18 U.S.C. §3553(a), including losses, offense role, and criminal history. Fines, restitution, forfeiture, and separately charged identity theft offenses may create additional consequences.