18 USC 1029 Credit Card Fraud: The Federal Crime Where Possession Alone Sends You to Prison

You don't have to swipe a stolen card. You don't have to make a single purchase. You don't have to cause anyone a dime of financial loss. Under 18 USC 1029, simply having 15 credit card numbers on your computer - numbers you never used, never charged, never touched - is a federal crime punishable by up to 10 years in prison. And if you possess the equipment to make fake cards? That's 15 years. The federal government punishes having the tools more harshly than having the stolen goods.

Welcome to Spodek Law Group. Our goal is to give you real information about federal access device fraud - not the sanitized version you find on other websites. Most articles about 18 USC 1029 focus on penalties for credit card fraud. We're going to show you something more important: how the federal government has turned possession into a crime, why the arbitrary thresholds can double your sentence, and what defense options actually exist when you're facing these charges.

Todd Spodek has handled federal access device cases for years. The pattern is always the same: clients walk in thinking they need to prove they never used the cards. They don't understand that under federal law, possession with intent to defraud IS the crime. The transaction never has to happen. The loss never has to occur. The victim never has to report anything. If the Secret Service can prove you had 15 or more access devices and intended to use them fraudulently, you're going to federal prison.

The Crime That Doesn't Require a Transaction

Most people hear "credit card fraud" and picture someone using a stolen card at a store. Thats not how 18 USC 1029 works. The statute lists ten seperate prohibited acts, and several of them criminalize possession itself - not use.

Subsection (a)(3) makes it a federal crime to "knowingly and with intent to defraud, possess fifteen or more devices which are counterfeit or unauthorized access devices." Read that again. Possess. Not use. Not attempt to use. Just possess. If the Secret Service executes a search warrant on your home and finds 15 credit card numbers in a file on your laptop, you've commited a federal felony. It dosent matter that you never swiped a card. It dosent matter that no victim ever lost a dollar. The possession is the crime.

Heres the thing that trips people up. An "access device" under this statute isnt just a physical credit card. The definition includes:

• Account numbers
• PINs
• Passwords
• Electronic serial numbers
• Mobile identification numbers
• "Other means of account access"

Your basically looking at anything that can be used to obtain money, goods, or services. A list of account numbers on a spreadsheet? Those are access devices. Each number counts toward the 15-device threshold.

This creates a situation where digital data becomes physical evidence of a felony. Clients come to Spodek Law Group after discovering that card numbers they never asked for, never used, and sometimes didnt even know existed on there computer are now the basis for a federal indictment.

The 15-Device Threshold: Where One Extra Card Doubles Your Sentence

The federal goverment drew a line at 15 devices. Below that line, you might face state charges or lesser federal exposure. Above that line, your facing 10 years in federal prison. But wait - it gets worse.

Under subsection (c)(1), the penalty for possessing 15 or more devices is "imprisonment for not more than 10 years." But under subsection (c)(2), if you've been convicted of a prior offense under this section, the penalty jumps to "imprisonment for not more than 20 years." So the differance between 14 cards and 15 cards isnt just a technicality. Its the differance between a case the government might decline to prosecute federaly and a case with a 10-year statutory maximum.

And heres were it gets really dangerous. The courts have held that devices dont have to be functional to count toward the threshold:

• An expired credit card? Counts.
• A cancelled account number? Counts.
• A card that was never activated? Still counts.

The card dosent have to work. It dosent have to be capable of completing a transaction. If its an access device and you possessed it with intent to defraud, it goes toward your total.

This means the government can inflate device counts by including cards that would of been useless in any actual fraud scheme. Defense attorneys fight hard to challenge what qualifies as a device and weather each item should count. But the statutory language is broad, and courts have generaly sided with the government's expansive interpretation.

Equipment Gets Punished More Harshly Than Cards

Heres the paradox that nobody explains. Possessing 15 stolen credit cards carries a 10-year maximum under subsection (a)(3). But possessing a card skimmer - the equipment used to make counterfeit cards - carries a 15-year maximum under subsection (a)(5). The federal goverment treats the tools of fraud worse then the fruits of fraud.

Subsection (a)(5) covers anyone who "knowingly and with intent to defraud, effects transactions, with 1 or more access devices issued to another person or persons, to receive payment or any other thing of value during any 1-year period the aggregate value of which is equal to or greater than $1,000." But it also covers possessing device-making equipment with the intent to defraud.

Think about what this means. You can possess a card skimmer, a magnetic stripe encoder, or card embossing equipment - items that havent been used to steal anything yet - and face 15 years in federal prison. Meanwhile, someone who actualy possesses 15 stolen cards faces a 10-year maximum. The law punishes preparation more severly then possession of the end product.

Every defense attorney knows this creates leverage problems during plea negotiations. Prosecutors can threaten to add equipment charges to inflate sentencing exposure. At Spodek Law Group, we've seen how the threat of a (a)(5) charge can pressure defendants into accepting plea deals they wouldnt otherwise consider.

The Stacking Game: How Federal Charges Multiply

Access device fraud rarely comes alone. Federal prosecutors stack charges to maximize pressure during plea negotiations. Understanding how these charges interact is critical to understanding your real exposure.

The first add-on is almost always wire fraud under 18 USC 1343. Any transaction involving electronic communications - which is basicly every modern fraud - triggers potential wire fraud charges. Wire fraud carries a 20-year maximum. Suddenly your 10-year access device case becomes a 30-year exposure.

Then theres 18 USC 1028 - identity theft. If any of the access devices contain information belonging to real people, identity theft charges can be added. Another 15 years of potential exposure.

But the charge that really changes everything is 18 USC 1028A - aggravated identity theft. This statute carries a mandatory 2-year consecutive sentence. Not concurrent. Consecutive. That means its added on top of whatever sentence you recieve for the underlying offense. And there's no parole in the federal system. If your sentenced to 5 years for access device fraud plus 2 years for aggravated identity theft, your doing 7 years.

This is where alot of defendants get blindsided. They negotiate what they think is a reasonable plea deal on the 1029 charges, only to discover that the 1028A enhancement locks in mandatory additional time. The 2-year add-on is not discretionary. The judge cant reduce it. The prosecutor cant waive it after indictment without dropping the charge entirely.

When the Secret Service Comes Knocking

Credit card fraud cases are investigated by the United States Secret Service, not the FBI. This matters because the Secret Service has specialized in access device fraud since 1984, when Congress passed the original statute. There investigators understand the technology, the methods, and the digital forensics in ways that general law enforcement does not.

A typical 1029 investigation often starts with a financial institution reporting suspicious activity. The Secret Service traces the activity, identifies potential suspects, and builds a case over months - sometimes years - before executing a search warrant. By the time they knock on your door, they've usually gathered substantial evidence.

Heres what most people dont understand about federal searches. When the Secret Service seizes your computer, they have forensic tools that can recover deleted files, identify hidden partitions, and trace the origin of data. Saying "I didnt know those card numbers were on my computer" is not a defense if the government can prove you downloaded them, recieved them, or created them.

The Secret Service also works closley with state and local law enforcement. What starts as a local investigation can become a federal case if the Secret Service believes the scope justifies federal prosecution. At Spodek Law Group, we've seen cases where clients thought they were dealing with a local matter, only to discover federal agents had been building a case in the background.

What You Didn't Know About "Knowingly"

Every 18 USC 1029 charge requires the government to prove you acted "knowingly and with intent to defraud." This sounds like a high bar. Its not as high as most people think.

"Knowingly" means you were conscious and aware of your actions. It dosent mean you knew the conduct was illegal. Ignorance of the law is never a defense. If you possessed access devices and understood what they were, you acted "knowingly" - even if you had no idea that possession itself was a federal crime.

"Intent to defraud" means you planned to deceive someone for financial gain. The government dosent have to prove you actualy deceived anyone. They dont have to prove any loss occured. They just have to prove you intended to use the devices fraudulently.

This intent element is were most defenses focus. If you possessed access devices for a legitimate purpose - security research, for example, or testing your own company's systems - you may not have had intent to defraud. Similarly, if someone else put the devices on your computer without your knowlege, you may not have possessed them knowingly.

But heres the uncomfortable truth. These defenses are hard to prove. The government has sophisticated forensic tools. They can trace when files were created, accessed, and modified. They can recover deleted communications. They can establish patterns of conduct. Clients who think "I can just say I didnt know" discover quickly that federal prosecutors have extensive evidence.

The Interstate Commerce Trap

One thing that surprises alot of defendants is how easily credit card fraud becomes a federal crime. The answer is interstate commerce. Under 18 USC 1029, the government must prove that your conduct "affected interstate or foreign commerce." This sounds like a limiting requirement. It isnt.

In the modern economy, almost every financial transaction touches interstate commerce. If you use the internet to access account information, thats interstate commerce. If the credit card issuer is in a differant state than where you live, thats interstate commerce. If the merchant you planned to defraud is in another state, thats interstate commerce. Even using a credit card at a local gas station involves interstate commerce because the transaction is processed through networks that cross state lines.

The courts have interpreted this requirement broadly. A federal prosecutor dosent have to prove that your specific transaction crossed state lines. They just have to show that your conduct had some effect on interstate commerce - and virtually every credit card transaction does.

This is were people get trapped. You might think your facing local charges for something that happened entirely in your home state. Then you discover that the federal government has jurisdiction because the card issuer was out of state, or the data passed through servers in another state, or the intended victim was in another state. What seemed like a state case with state penalties becomes a federal case with federal sentencing guidelines.

At Spodek Law Group, we've handled cases were clients were genuinly shocked that federal prosecutors took interest. They thought there exposure was limited to state fraud charges. The interstate commerce element is almost always satisfied in access device cases. Dont assume your case will stay local.

The Forfeiture Reality

Conviction under 18 USC 1029 triggers federal forfeiture provisions. Under 18 USC 982, the court must order forfeiture of any property derived from the offense or used to commit the offense. This isnt discretionary. Its mandatory.

What does this mean practically?

• The computer you used to store card numbers - forfeited
• The car you drove to install a skimmer - potentially forfeited
• Money in your bank account that the government can trace to fraudulent transactions - forfeited

Even property purchased with legitimately earned money can be at risk if its connected to the offense.

The forfeiture process runs parallel to the criminal case. The government files a civil forfeiture action against the property itself. Even if your acquitted of the criminal charges, the government can still pursue forfeiture using a lower burden of proof. This means you might beat the charges and still loose your property.

Many defendants dont understand that forfeiture exposure can exceed there prison exposure in real-world impact. Loosing your home, your car, your savings - these consequences follow you after prison. When evaluating a federal access device case, we look at forfeiture exposure as carefully as sentencing exposure.

The Restitution Obligation

Beyond prison time and fines, federal access device convictions require restitution. Under 18 USC 3663A, the court must order defendants to compensate victims for actual losses. The judge has no discretion to waive this requirement in fraud cases.

Restitution can be staggering. If the government calculates that 10,000 compromised card numbers resulted in $50 per card in fraud prevention costs to financial institutions, your looking at a $500,000 restitution order. Add actual fraud losses to cardholders, and the number climbs higher.

Restitution obligations survive bankruptcy. They cant be discharged. The government can garnish wages, seize tax refunds, and pursue collection for decades after your released from prison. Even if you have no ability to pay the full amount, the obligation remains.

This is another area were charge stacking matters. More counts often mean more victims, which means higher restitution. During plea negotiations, the scope of admitted conduct directly affects restitution calculations. An experienced defense attorney evaluates restitution exposure as carefully as prison time.

When 20 Years Actually Becomes 20 Years

In March 2010, Albert Gonzalez was sentenced to 20 years in federal prison - the longest sentence ever imposed for computer crimes at that time. His crime? Leading a hacking ring that stole over 170 million credit and debit card numbers from retailers including TJX, Heartland Payment Systems, and others.

Gonzalez's case illustrates what happens when 1029 charges combine with other statutes. He wasnt just charged with access device fraud. He faced conspiracy charges, computer fraud charges, wire fraud charges, and aggravated identity theft. The stacking of charges created a sentencing exposure that no plea deal could reduce to probation.

Another case worth studying is Max Butler, who recieved 13 years - the longest hacking sentence before Gonzalez. Butler operated CardersMarket, an online forum were cybercriminals bought and sold stolen card data. He personaly stole nearly 2 million credit card numbers.

These cases represent the extreme end of federal access device prosecution. But even small-scale defendants face serious time. The federal sentencing guidelines calculate offense levels based on the number of victims, the amount of loss, and the sophistication of the scheme. An offense level of 18 translates to 27-33 months for a first offender. An offense level of 26 means 63-78 months.

The federal conviction rate is 93%. If the government is charging you, they believe they can prove the case. This dosent mean every case should plead guilty - far from it. But it does mean understanding that fighting a federal access device case requires experienced counsel who knows were the government's evidence is weak.

Your Defense Options

Despite the challenges, defenses exist. At Spodek Law Group, we evaluate every 1029 case for the following potential weaknesses in the government's case:

Lack of Intent: If you possessed access devices for a legitimate purpose - security testing, research, employment purposes - you may not have had the required intent to defraud. This defense requires documenting the legitimate purpose and demonstrating that your actions were consistant with that purpose.

Authorization: Some defendants believed they had permission to access the devices. A spouse's card used with implicit permission. An employer's systems accessed as part of job duties. If you reasonably believed you were authorized, the "unauthorized" element may not be satisfied.

Challenging Device Counts: The 15-device threshold is critical. Defense attorneys scrutinize what the government is counting. Duplicate numbers? Non-functional devices that shouldnt count? Items that dont meet the legal definition of "access device"? Every device that can be excluded from the count matters.

Fourth Amendment Issues: If the search that uncovered the devices was unconstitutional, the evidence may be suppressed. Federal searches require warrants based on probable cause. Defects in the warrant or its execution can provide grounds for suppression.

Sentencing Mitigation: Even if conviction is likely, reducing the sentence is critical. Minor role adjustments, acceptance of responsibility reductions, and cooperation credit can significantly reduce guideline calculations. The differance between offense level 18 (27-33 months) and offense level 14 (15-21 months) is substantial. As Todd Spodek tells clients facing guideline calculations - every two-level reduction can mean years off your sentence.

The worst mistake we see is defendants who talk to investigators before consulting counsel. Every statement you make becomes evidence. Every explanation becomes a potential admission. Federal agents are trained to build cases, not to help you explain yourself.

What Happens Next

If your under investigation for federal access device fraud, the worst thing you can do is wait. Federal cases move slowly until they move quickly. By the time agents show up with an arrest warrant, the grand jury has already indicted you. The evidence has already been assembled. Your options have already narrowed.

Call Spodek Law Group at 212-300-5196 before you talk to anyone else. Not after the search. Not after the arrest. Not after you've already made statements to investigators. Before.

Weve handled federal fraud cases for years. We know how the Secret Service investigates, how prosecutors think, and were the weaknesses in there cases typically lie. This isnt marketing. Its what we wish someone had told our clients before they made critical mistakes.

The federal government has made possession a crime. They've created arbitrary thresholds that double your exposure. They've designed a charging system that stacks offenses to maximize pressure. But within that system, strategic defense is still possible. The question is weather you'll engage counsel who understands how the system actualy works.

Your freedom depends on decisions you make in the next few days. Dont make them alone.