Credit card and debit card fraud is among the most frequently prosecuted federal financial crimes in New Jersey. Cases range from a single person using stolen card numbers to buy merchandise to organized rings that install skimmers on gas pumps and ATMs, recruit people to deposit fake checks, or sell card data on dark web marketplaces. The U.S. Secret Service, Homeland Security Investigations, the U.S. Postal Inspection Service and the FBI investigate these cases, often with help from banks’ fraud departments.
Federal prosecutors usually charge these cases under the access device fraud statute, 18 U.S.C. § 1029, and frequently add a charge of aggravated identity theft that carries a mandatory two-year consecutive prison term. A New Jersey federal credit card fraud lawyer can examine how the government connected you to the transactions, challenge the loss and device counts that drive sentencing, and look for ways to avoid the mandatory consecutive sentence.
Photo: My another account / Wikimedia Commons (CC0)
- 18 U.S.C. § 1029 covers stolen or counterfeit credit and debit card numbers, PINs, account logins and gift card numbers.
- A first offense carries up to 10 or 15 years depending on the subsection, and up to 20 years after a prior § 1029 conviction.
- Aggravated identity theft under 18 U.S.C. § 1028A adds a mandatory 2-year consecutive sentence, although Dubin v. United States (2023) narrowed when it applies.
- The Sentencing Guidelines count each stolen card number as at least $500 of loss, even if it was never used.
What Is an “Access Device”?
The statute defines an access device broadly. It includes any card, plate, code, account number, electronic serial number, mobile identification number, personal identification number or other means of account access that can be used, alone or with another access device, to obtain money, goods, services or anything of value, or to start a transfer of funds. That covers credit and debit card numbers, bank account numbers, PINs, online banking credentials, gift card numbers and some phone and payment app credentials.
A counterfeit access device is one that is fake, altered or forged, such as a re-encoded card. An unauthorized access device is a real one that is lost, stolen, expired, revoked, canceled or obtained with intent to defraud.
Conduct Prohibited by 18 U.S.C. § 1029
Section 1029(a) lists ten separate offenses. The most commonly charged are:
- § 1029(a)(1) – producing, using or trafficking in counterfeit access devices
- § 1029(a)(2) – using or trafficking in unauthorized access devices to obtain $1,000 or more in a one-year period
- § 1029(a)(3) – possessing 15 or more counterfeit or unauthorized access devices
- § 1029(a)(4) – producing, trafficking in or possessing device-making equipment, such as card readers, encoders and embossers
- § 1029(a)(5) – making transactions with access devices issued to another person to obtain $1,000 or more in a one-year period
- § 1029(a)(6) – soliciting someone to offer an access device or sell information about one without the issuer’s authorization
Each offense requires that the conduct be done knowingly and with intent to defraud, and that it affect interstate or foreign commerce, which is almost always satisfied because card networks operate nationwide.
Common Credit Card and Access Device Fraud Cases in New Jersey
- Skimming – placing devices on gas pumps, ATMs or point-of-sale terminals to capture card data and PINs, then cloning cards
- Card cracking – recruiting account holders, often through social media, to provide their debit cards and PINs so fake checks can be deposited and withdrawn
- Carding and dark web sales – buying or selling stolen card data and account logins online
- Retail and gift card schemes – using stolen numbers to purchase gift cards, electronics or luxury goods for resale
- Account takeover – using stolen credentials to change account information and drain bank or payment app accounts
- Mail theft – stealing new cards and checks from mailboxes and postal collection boxes
These cases are often charged together with bank fraud, wire fraud, conspiracy and identity theft.
Penalties for Federal Access Device Fraud
The maximum sentence depends on which subsection is charged and whether the person has a prior conviction under § 1029:
- Up to 10 years for a first offense under subsections (a)(1), (a)(2), (a)(3), (a)(6), (a)(7) or (a)(10)
- Up to 15 years for a first offense under subsections (a)(4), (a)(5), (a)(8) or (a)(9)
- Up to 20 years for an offense committed after a prior conviction under § 1029
A conspiracy charged under § 1029(b)(2) carries up to half of the maximum for the underlying offense, although prosecutors often charge conspiracy under 18 U.S.C. § 371 or the conspiracy provisions of the bank and wire fraud statutes instead. Courts also order restitution and forfeiture of devices, equipment and proceeds.
Aggravated Identity Theft – The Mandatory Two Years
When a person knowingly uses another real person’s means of identification during and in relation to certain felonies, including access device fraud, bank fraud and wire fraud, prosecutors can add a charge under 18 U.S.C. § 1028A. A conviction requires a two-year prison term that must run consecutively to the sentence for the underlying crime, and probation is not permitted.
The Supreme Court narrowed this statute in Dubin v. United States (2023), holding that § 1028A applies only when the use of another person’s identity is at the crux of what makes the conduct criminal, not when it is merely an incidental part of a billing or payment process. Flores-Figueroa v. United States (2009) also requires proof that the defendant knew the identification belonged to a real person. These decisions can provide powerful arguments to dismiss or bargain away the § 1028A count.
How Sentences Are Calculated
Access device fraud is sentenced under § 2B1.1 of the U.S. Sentencing Guidelines, where loss amount drives the offense level. In these cases, the Guidelines treat the loss for each counterfeit or unauthorized access device as at least $500, even if the card was never used. That rule means a person caught with a list of 400 card numbers may face a minimum loss of $200,000 and a 10-level increase, even if actual charges were far smaller. Additional increases can apply for 10 or more victims, sophisticated means, use of device-making equipment and trafficking in unauthorized devices.
Challenging the number of usable devices, duplicates, expired or invalid numbers and the attribution of devices found on shared phones or computers can significantly reduce the guideline range. For more, see our guide to the federal sentencing guidelines.
Defenses to Credit Card and Access Device Fraud Charges
- Lack of knowledge or intent to defraud – you did not know the card or number was stolen or counterfeit, or believed you were authorized to use it
- Card-cracking recruits – many people recruited into card-cracking schemes were themselves deceived about how their accounts would be used
- Identity and attribution – others used the device, account, phone or IP address
- Thresholds not met – fewer than 15 devices, or less than $1,000 in a one-year period, under the relevant subsection
- Fourth Amendment challenges – unlawful traffic stops, vehicle searches and phone searches that led to the discovery of cards or skimmers
- Loss and device count – contesting the government’s spreadsheet of numbers and charges
State prosecutors also charge credit card fraud under N.J.S.A. 2C:21-6. Whether a case stays in state court or is adopted federally can make a major difference in exposure, so it is important to involve a lawyer who handles both systems as early as possible.
Related Federal Defense Guides
- Federal identity theft and aggravated identity theft
- Federal bank fraud
- Federal wire fraud
- Computer fraud and hacking
- How the federal sentencing guidelines work
Frequently Asked Questions
What is the difference between state and federal credit card fraud charges?
New Jersey prosecutes credit card fraud under N.J.S.A. 2C:21-6. Federal prosecutors charge access device fraud under 18 U.S.C. § 1029, usually in larger or multi-state cases, and can add aggravated identity theft with its mandatory two-year consecutive term.
How much prison time is possible for federal credit card fraud?
Up to 10 years for most first offenses under § 1029, up to 15 years for offenses involving device-making equipment or transactions with another person’s card, and up to 20 years after a prior conviction. Actual sentences depend heavily on the Sentencing Guidelines and loss amount.
Is possessing stolen card numbers a crime if I never used them?
It can be. Possessing 15 or more counterfeit or unauthorized access devices with intent to defraud violates § 1029(a)(3), and the Sentencing Guidelines treat each device as at least $500 of loss even if it was never used.
I let someone use my debit card and now I am being investigated. What should I do?
Do not speak with bank investigators or agents before talking to a lawyer. People recruited into card-cracking schemes are sometimes treated as witnesses or victims, but statements made without counsel can turn you into a defendant.
Can aggravated identity theft be dismissed?
Sometimes. After Dubin v. United States, the government must show that using another person’s identity was central to the crime. A defense lawyer may be able to challenge the § 1028A count or negotiate its dismissal in a plea agreement.