Arizona State Victim Resources:
Phone Number: (602) 542-4266
Department of Corrections
Secretary of State
Department of Motor Vehicles
Agencies that offer legal assistance to IDT victims:
Community Legal Services, Inc.
Program Phone: (602) 258-3434
Legal Assistance: (800) 852-9075
DNA-Peoples Legal Services, Inc.
Program Phone: (928) 871-5630
Legal Assistance: (800) 789-7287
Southern Arizona Legal Aid, Inc.
Program Phone: (520) 623-9465
Legal Assistance: (520) 623-9461
Arizona Identity Theft Coalition
Coordinated by Arizona Attorney General’s Office
Free Legal Self Help Forms Online
Arizona Identity Theft Laws:
Security Freeze Law:
All Arizona consumers are allowed to place security freezes on their consumer credit reports to prevent new accounts from being opened in their names. Such a freeze enables the consumer to prevent anyone from looking at his/her credit file for the purpose of granting credit unless the consumer chooses to allow a particular business look at the information. To request a freeze, a consumer must request one in writing by certified mail or by telephone, fax, the Internet, or other electronic media if the credit reporting agency has developed procedures for consumers to do so.
The reporting agency must place the freeze within ten business days after receiving the request, and within ten days of placing the request, must send a written confirmation of the freeze and provide the consumer with a unique personal identification number or password to be used by the consumer when providing authorization for the release of his credit for a specific party or period of time. Requests for a temporary unlocking of the freeze must be completed within three business days if received by mail. If a consumer reporting agency offers the option to consumers to request a temporary unlocking of the freeze through Internet and telephonic methods, the freeze must be placed within 15 minutes after the consumer’s request is received by the agency during normal business hours.
Consumer reporting agencies may charge a fee of $5 to place the original security freeze or to temporarily unlock the freeze. However, victims of identity theft with a valid police report or investigative complaint may not be charged.
Mandatory Police Report Law for Identity Theft Victims:
State law requires a peace officer in any jurisdiction in which an element of the offense is committed, a result of the offense occurs, or the person whose identity is taken resides or locates to take a police report upon request. The officer may provide a copy of the report to any other law enforcement agency that is located in a jurisdiction in which the violation occurred.
Identity Theft Passport Law:
No State law at this time.
Other Identity Theft Laws:
A person commits the crime of taking the identity of another person if he/she knowingly takes, purchases, manufactures, records, possesses or uses any personal identifying information of another person without consent and with the intent to use the other person’s identity for an unlawful purpose or to cause loss. The crime occurs even if the other person does not suffer any economic loss as a result of the offense.
Violations are a class 4 felony, punishable by up to two and a half years in jail and/or a fine up to /$150,000. Prosecutors can consolidate identity theft crime complaints against one defendant so that violations committed in different precincts or counties can be heard in one court. This section does not apply to people under 21 who use false identification to gain access to an establishment licensed to sell alcohol.
Statute: §13-2008: http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/13/02008.htm&Title=13&DocTy
The crime becomes aggravated identity theft if it involves the personal identifying information of five or more persons or causes one person to suffer an economic loss of $3000 or more. This is a class 3 felony, punishable by up to three and a half years in jail and/or a fine up to $150,000.
Statute: §13-2009: http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/13/02009.htm&Title=13&DocTy
A person commits the crime of trafficking in the identity of another person if he/she knowingly sells, transfers, or transmits any personal identifying information of another person without consent and for any unlawful purpose, to cause loss, or to allow another person to obtain or continue employment. It does not matter if the person suffers no economic loss as a result. It is a class 2 felony, punishable by up to five years in prison and/or a fine up to $150,000.
Statute: §13-2010: http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/13/02010.htm&Title=13&DocTy
“Personal identifying information” includes any written document or electronic data that provides information concerning a name, signature, electronic identifier or screen name, electronic mail signature, address or account, biometric identifier, driver or professional license number, access device, residence or mailing address, telephone number, employer, student or military identification number, social security number, tax identification number, employment information, citizenship status or alien identification number, personal identification number, photograph, birth date, savings, checking or other financial account number, credit card, charge card or debit card number, mother’s maiden name, fingerprint or retinal image, the image of an iris or deoxyribonucleic acid or genetic information.
Statute: §13-2001: http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/13/02001.htm&Title=13&DocTy
Other Related Laws:
Criminal Identity Theft: Starting January 1, 2009, state law will allow a person who reasonably believes that he or she is the victim of identity theft to petition the superior court for a judicial determination of his or her factual innocence, if as a result of the person’s personal identifying information being taken, the person’s name was either used by another person who was arrested, cited, or charged with a criminal offense, or entered as of record in a judgment of guilt in a criminal case. If the court finds by a clear and convincing evidence that the person is factually innocent, the court will issue an order certifying this determination.
State law requires businesses and state and local government agencies (excluding law enforcement agencies, prosecution agencies, and courts) that own or license computerized data that include consumers’ personal information to notify consumers when their personal information is compromised during a security breach, putting them at risk of identity theft. If a business or agency becomes aware of an incident of unauthorized acquisition and access to unencrypted or un-redacted computerized data that includes an individual’s personal information, it must conduct a reasonable investigation to promptly determine if there has been a breach in the security system. If so, it must notify consumers in the most expedient manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the nature and scope of the breach or to identify the individuals affected or to restore the reasonable integrity of the data system. A business or agency is not required to disclose a breach of the security of the system if the person or a law enforcement agency, after a reasonable investigation, determines that a breach of the security of the system has not occurred or is not reasonably likely to occur.
A security breach is defined as “an unauthorized acquisition of and access to unencrypted or un-redacted computerized data that materially compromises the security or confidentiality of personal information maintained by a person as part of a database of personal information regarding multiple individuals and that causes or is reasonably likely to cause substantial economic loss to an individual.”
Personal information means an individuals’ first name or first initial and last name, in combination with any one or more of the following data elements, when the data element is not encrypted, redacted, or secured by any other method rendering the element unreadable or unusable: Social Security number; driver’s license or non-operating identification license number; or a financial account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to the individual’s financial account. Publicly available information is not included.
Notification can be provided to the affected persons by mail, e-mail, or by telephone. If the cost of providing regular notice would exceed $50,000, the amount of people to be notified exceeds 100,000, or the business does not have sufficient contact information, substitute notice may be provided. When substitute notice is used, it must consist of all of the following, as applicable: e- mail notice, conspicuous posting on the business’s web site, and notification to major statewide media.
Statute: §44-7501: http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/44/07501.htm&Title=44&DocTy
A person commits theft of a credit card or obtaining a credit card by fraudulent means if the person controls a credit card without the cardholder’s or issuer’s consent; or sells, transfers, or conveys a credit card with intent to defraud. Violations are a class 5 felony, punishable by up to one and a half years in prison and/or a fine up to $150,000.
Statute: §13-2102: http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/13/02102.htm&Title=13&DocTy
A person commits fraudulent use of a credit card if the person:
- With intent to defraud, uses, for the purposes of obtaining or attempting to obtain money,
- goods, services or any other thing of value, a credit card or credit card number obtained or retained fraudulently or a credit card or credit card number which the person knows is forged, expired, cancelled or revoked; or
- Obtains or attempts to obtain money, goods, services or any other thing of value by representing, without the consent of the cardholder, that the person is the holder to a specified card or by representing that the person is the holder of a credit card and the card has not in fact been issued.
- Violations are a class 1 misdemeanor. However, if the value of the money, goods, services or other things of value is between $250 and $999 in a six-month period, it is a class 6 felony, and a class 5 felony is over $1000 in a six-month period.
Statute: §13-2015: http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/13/02105.htm&Title=13&DocTy
- The same penalties apply to a third party who receives anything of value obtained by the fraudulent use of a credit card by buying or receiving or attempting to buy or receive money, goods, services or any other thing of value obtained fraudulently, knowing or believing that it was so obtained.
Statute: §13-2103: http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/13/02103.htm&Title=13&DocTy
- It is a class 4 felony for a person, other than the cardholder, with intent to defraud, to sign the name of any actual or fictitious person to a credit card or instrument for the payment of money that evidences a credit card transaction.
Statute: §13-2104: http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/13/02104.htm&Title=13&DocTy
- It is a class 5 felony to make a false statement as to financial condition or identity when applying for a credit card, if the person knows it to false.
Statute: §13-2107: http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/13/02107.htm&Title=13&DocTy
State law prohibits the possession or use of a scanning device or re-encoder that is used to obtain or record encoded information from the magnetic strip of a payment card to defraud the authorized user, the issuer of the card, or a merchant. Scanning devices are defined as a scanner, reader, or any other electronic device that is used to access, read, scan, obtain, memorize, or store, temporarily or permanently, information encoded on the magnetic strip or stripe of a payment card. A re-encoder is an electronic device that places encoded information from the magnetic strip or stripe of a payment card onto the magnetic strip or stripe of a different card. Violations are a class 6 felony, punishable by up to one year in prison and/or a fine up to $150,000.
Statute: §13-2110: http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/13/02110.htm&Title=13&DocTy
State law prohibits phishing scams, in which identity thieves try to trick consumers out of personal information by sending fraudulent e-mails, purporting to originate from a familiar institution, such as a bank. It is a class 5 felony to use a web page or electronic mail message or otherwise using the Internet to solicit, request or take any action to induce another person to provide identifying information by representing that the person, either directly or by implication, is an on-line business without the authority or approval of the on-line business.
In addition to the criminal penalty, violators may be targeted in a civil action. The attorney general, Internet service providers, or a person who owns a Web site or trademark that has been adversely affected may bring an action to stop further violations, and recover the greater of actual damages or $500,000 for each violation. If the court determines there is a pattern of violations (multiple violations resulting from one act are a single violation), damages can be trebled.
Statute: §44-7201 through 7204 (must click on “next document” link to scroll through the four sections): http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/44/07201.htm&Title=44&DocTy
State law prohibits the use of spyware to covertly gather personal information through a person’s Internet connection. The law prohibits any person from transmitting, through intentionally deceptive means, computer software and using the software to change Internet control settings; collect personally identifiable information, prevent the operator’s efforts to block the installation or execution of the software; falsely claim that software will be disabled by the operator’s actions; remove or disable security software installed on the computer; or take control of the computer. The attorney general, computer software provider or a Web site or trademark adversely affected can bring action against a violator to stop further violations or recover the greater of actual damages or $100,000 for each separate violation. The court may increase the damages up to three times if the defendant has a pattern of violating the law, and may also award costs and reasonable attorney fees to the prevailing party.
Statute: 44-7301 through 7304 (must click on “next document” link to scroll through the four sections): http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/44/07301.htm&Title=44&DocTy
Disposal of Customer Records:
To prevent identity theft, state law restricts how businesses can dispose of paper records with confidential information about individuals. The law prohibits businesses from knowingly discarding paper records or documents with sensitive identifying data without first redacting the data or shredding or otherwise destroying the documents. It applies to data that includes a person’s name and Social Security, driver’s license and financial account numbers. Violations are punishable by a civil penalty of $500 for the first offense, $1,000 for a second, and $5,000 for each subsequent one.
Statute: §44-7601: http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/44/07601.htm&Title=44&DocTy
Social Security Numbers:
It is unlawful for any person or entity to:
- Intentionally communicate or otherwise make an individual’s Social Security number
- available to the general public.
- Print an individual’s Social Security number on any card required for the individual to
- receive products or services provided by the person or entity.
- Require the transmission of an individual’s Social Security number over the Internet unless the connection is secure or the social security number is encrypted.
- Require the use of an individual’s Social Security number to access an Internet web site, unless a password or unique personal identification number or other authentication device is also required to access the site.
- Print a number that the person or entity knows to be an individual’s Social Security number on any materials that are mailed to the individual, unless state or federal law requires the social security number to be on the document to be mailed. This does not prohibit the mailing of documents that include Social Security numbers sent as part of an application or enrollment process or to establish, amend or terminate an account, contract or policy or to confirm the accuracy of the social security number.
- However, a person or entity that before January 1, 2005 used an individual’s Social Security number in a manner inconsistent the above provisions may continue using that individual’s Social Security number in that manner subject to the following conditions:
- The use of the Social Security number must be continuous. If the use is stopped for any reason, the above provisions apply.
- The person or entity must provide the individual with an annual written disclosure of the individual’s right to stop the use of the Social Security number in a manner prohibited by state law.
- If the individual requests in writing, the person or entity must stop using the Social Security number in a manner prohibited by state law within thirty days after receiving the request. No fee or charge is allowed for implementing the request, and the person or entity may not deny services to the individual because of the request.
State law also prohibits any state or political subdivision of the state from using an individual’s SSN on state-issued or political subdivision-issued forms of identification.
Statute: §44-1373: http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/44/01373.htm&Title=44&DocTy
Beginning on January 1, 2009, a person or entity may not knowingly:
- Print any sequence of more than five numbers that are reasonably identifiable as being part of an individual’s Social Security number on any card required for the individual to receive products or services provided by the person or entity.
- Print any sequence of more than five numbers that are reasonably identifiable as being part of an individual’s Social Security number on any materials that are mailed to the individual, unless state or federal law requires the social security number to be on the document to be mailed. This does not prohibit the mailing of documents to the individual that include Social Security numbers that is sent as part of an application or enrollment process or to establish, amend or terminate an account, contract or policy or to confirm the accuracy of the social security number or sequence of numbers.
Change of Address:
State law requires creditors to verify a consumer’s address before extending credit if the address differs from the one on record and verify the identity of a consumer if they do not use consumer credit reports.