Colorado Identity Theft and Financial Exploitation Charges: Penalties, Defenses, and the 2026 ASSET Act

By H. Michael Steinberg  |  Law Office of H. Michael Steinberg  |  November 8, 2026  | 

Few allegations land harder than being accused of taking someone else’s identity or money. The charge can be a felony, the evidence often arrives as a stack of bank statements and phone records, and the person who made the report is frequently a relative, a spouse, a business partner, or an elderly parent. In Colorado, these cases rest on three bodies of law: the identity theft statute, the exploitation statute for older and at-risk adults, and, since August 2026, a new law that lets banks pause suspicious transactions and send reports to law enforcement.

This guide explains how each law works, what the penalties look like, where the defenses tend to be, and what to do in the first days after you learn of an investigation.

The Law Office of H. Michael Steinberg has defended Colorado felony and theft and property crime cases for more than forty years, and the same questions come up again and again: Did I have permission? Who actually used the account? Is this a crime, or a family money dispute?

Key takeaways

Identity theft under C.R.S. 18-5-902 is a class 4 felony when charged as use of another person’s information or as a forged instrument.

Exploitation of an at-risk person under C.R.S. 18-6.5-103 reaches a class 3 felony at $500 or more, with a presumptive prison range of 4 to 12 years.

Permission and lawful authority are central. A power of attorney, a joint account, or a long-standing family arrangement can change the entire case.

The ASSET Act took effect August 12, 2026 and lets banks hold suspicious transactions for up to 180 days while they report to authorities.

Early choices matter. Do not explain yourself to the bank, the family, or detectives before speaking with a defense lawyer.

How Colorado Defines Identity Theft

Colorado’s identity theft law is in C.R.S. 18-5-902, with the definitions in C.R.S. 18-5-901. The statute is broader than most people expect. It covers not only using a stolen Social Security number, but also possessing identifying information with intent to use it, altering or uttering a written instrument that contains another person’s information, and seeking a government-issued document with it. The statute has five separate ways to commit the offense, and the classification depends on which one the prosecutor chooses.

Two terms do much of the work. “Personal identifying information” includes items such as a Social Security number, date of birth, and similar identifiers. “Financial identifying information” and “financial device” cover account numbers, cards, and checks. The conduct must also be “without permission or lawful authority,” and that phrase is where many real-world cases are won or lost.

Statute at a glance: C.R.S. 18-5-902

Use (1)(a): knowingly using another person’s identifying information or a financial device, without permission or lawful authority, to obtain cash, credit, property, services or anything of value, or to make a financial payment.

Forged instrument (1)(c): with intent to defraud, falsely making, completing, altering or uttering a written instrument or financial device that contains another person’s identifying information.

Possession and related prongs (1)(b), (1)(d), (1)(e): knowing possession with the required intent, including intent to apply for credit or obtain a government document.

The statute turns on what you knew, what you intended, and whether anyone authorized you to act. Those three questions shape almost every identity theft defense.

Colorado Identity Theft Penalties

Under C.R.S. 18-5-902(2), identity theft by use under subsection (1)(a), or by forged instrument under (1)(c), is a class 4 felony. The remaining prongs, (1)(b), (1)(d) and (1)(e), are class 2 misdemeanors unless the person possessed three or more financial devices, or the information of three or more people, which raises the charge to a class 5 felony.

The presumptive sentencing ranges are set in C.R.S. 18-1.3-401. A class 4 felony carries a presumptive prison range of 2 to 6 years and a fine of $2,000 to $500,000, followed by mandatory parole. A class 5 felony carries 1 to 3 years and a fine of $1,000 to $100,000. A court may order restitution on top of any sentence, and probation or other alternatives may be on the table depending on the facts, the person’s record, and the plea.

Prosecutors can also bring separate counts for separate uses of the same information, so a single set of facts, such as a month of card transactions, may be filed as many counts. That makes the number and value of transactions a key battleground.

Financial Exploitation of an At-Risk Person

When the alleged victim is 70 or older, or is an at-risk adult, prosecutors often turn to C.R.S. 18-6.5-103. Under the definitions in C.R.S. 18-6.5-102, an “at-risk elder” is any person 70 or older, and “at-risk person” also includes at-risk adults, adults with an intellectual or developmental disability, and at-risk juveniles.

Criminal exploitation occurs when a person knowingly uses deception, harassment, intimidation, or undue influence to permanently or temporarily deprive an at-risk person of the use, benefit, or possession of anything of value. It is a class 5 felony if the value is under $500 and a class 3 felony at $500 or more. A separate provision treats theft from an at-risk person as a felony as well, and theft from the person of an at-risk person by means other than force or threats is a class 4 felony regardless of value.

Because the dollar amount controls the felony class in many theft-based counts, the valuation of the property is worth scrutiny. The general theft tiers in C.R.S. 18-4-401 show how quickly exposure grows.

Strong defenses to these charges often start with the words “knowingly,“ “deception,” and “undue influence.” Helping an aging parent manage money, being named on an account, or receiving a gift is not exploitation. The question is whether the state can prove improper means and a criminal state of mind, not whether a family member later disagreed about the money.

The 2026 ASSET Act: How Bank Reports Start Investigations

Many of these cases begin with a phone call from a bank. Colorado’s Adults’ Security and Safeguards from Exploitation in Transactions Act, HB26-1110, added a new article 113 to title 11 of the Colorado statutes and took effect on August 12, 2026. News coverage describes bipartisan support for the measure, including from the banking industry (KUNC; Denver7). The enrolled bill text sets out how it works.

• Who is protected: an “eligible adult” is a person 70 or older, or an adult 18 or older who is susceptible to mistreatment or self-neglect or lacks the capacity to make and communicate responsible decisions (C.R.S. 11-113-102).
• Who must report: a bank or credit union employee who reasonably believes exploitation has occurred, been attempted, or is occurring must notify local law enforcement or the county adult protective services agency (C.R.S. 11-113-103).
• Transaction holds: an institution may delay a disbursement it reasonably believes is part of exploitation, give written notice within two business days to the parties authorized on the account other than the suspected person, and make its determination within 90 days. A hold can be extended another 90 days, for a total of 180, if the matter is reported and under investigation (C.R.S. 11-113-105).
• Immunity: institutions and staff who act in good faith and with reasonable care are shielded from civil and administrative liability.
• Records: banks must make relevant records available to adult protective services and law enforcement, and those records are not public records (C.R.S. 11-113-107).

For a person under suspicion, the practical effect is that a bank can freeze a transaction and start a paper trail before anyone has asked for your side. The Act does not decide guilt, and it does not replace the separate mandatory reporting duties in C.R.S. 18-6.5-108. But the report it generates is often the first page of the prosecutor’s file.

Permission and Authority Can Decide the Case

Identity theft requires use without “permission or lawful authority,” and exploitation requires improper means. Real families do not run on paperwork. Parents give debit cards to adult children, spouses share logins, and caregivers pay bills from a client’s account for years without a written agreement. Evidence that can matter includes:

• Durable powers of attorney, guardianship or conservatorship orders, and representative payee records
• Joint account agreements and signature cards
• Texts, emails, and voicemails in which the account holder asks for help or approves spending
• Receipts and bills showing the money went to the account holder’s care or household
• A history of the same arrangement continuing for months or years without complaint
• Medical or capacity evidence relevant to whether consent was real and informed

Authority can also have limits. A power of attorney does not always allow self-dealing, and a caregiver may owe fiduciary duties. A careful defense looks at both sides of that line before deciding how to present the case.

Key Defense Issues in Colorado Identity Theft and Exploitation Cases

Knowledge that the information belonged to a real person

In People v. Perez, 2016 CO 12, the Colorado Supreme Court held that the culpable mental state of “knowingly” applies to the phrase “of another,” so the prosecution must prove the accused knew the information belonged to an actual person. The court also held that this knowledge can be proven circumstantially, and it found the evidence sufficient in that case because the same number had been used repeatedly with multiple employers. The court reaffirmed the rule in People v. Molina, 2017 CO 7.

Who the victim is:

In People v. Rodriguez-Morelos, 2025 CO 2, the Colorado Supreme Court held that the “personal identifying information” prong of subsection (1)(a) applies to information about single, identified human beings, not to a nonprofit’s name or tax-exempt document. The ruling affirmed vacating that identity theft conviction. When the alleged victim is a business or organization, prosecutors must instead rely on the organization’s financial identifying information or a financial device, and an accurate charging theory becomes an issue worth testing.

Jurisdiction and venue

In People v. Brennan, 2025 COA 68, the Court of Appeals vacated convictions for identity theft and unauthorized use of a financial transaction device. A parent had a New York summer camp charge a card that her former spouse, who lived in Colorado, had given the camp. The court held Colorado lacked jurisdiction because the conduct elements occurred in New York. The case shows both how a family money dispute can become a felony prosecution and how a threshold legal issue can end it.

Intent, value, and victim status

• Intent to obtain value or to defraud, not mistaken belief, reimbursement, or paying the account holder’s own bills
• Whether the value proven supports the felony class charged
• Whether the victim actually meets the 70-or-older or at-risk definition
• Whether the count is properly charged under the correct prong and statute

Electronic Records Can Be Powerful, and Incomplete

Bank logs, card records, IP addresses, and device extractions tell the prosecutor that something happened. They do not always say who did it. A shared home network, a family laptop, a phone with several users, or a saved password can all break the link between an account and the person charged. Defense work often includes requesting native-format discovery, reviewing the full extraction rather than a summary, and identifying every person with access during the relevant dates.

Statute of Limitations: When Does the Clock Start?

The general felony filing limit in C.R.S. 16-5-401 is three years. But subsection (4.5) starts the clock on discovery of the criminal act for certain offenses, and the list includes theft and identity theft offenses under part 9 of article 5 of title 18. How courts define “discovery” has been litigated for years, including in theft cases such as People v. McKinney, which addressed whether the discovery rule applies to theft from at-risk adults. When the alleged conduct happened years before the report, the date a bank, a relative, or an agency first discovered it can matter as much as the evidence itself.

Related State and Federal Charges

Identity theft cases rarely travel alone. Depending on the facts, a prosecutor may add forgery, criminal impersonation, criminal possession of a financial device, gathering identity information by deception, possession of identity theft tools, unauthorized use of a financial transaction device, theft, or exploitation of an at-risk person.

Federal exposure is also possible when interstate wires, federal programs, or large schemes are involved. Federal statutes include 18 U.S.C. 1028 (fraud in connection with identification documents), 18 U.S.C. 1028A (aggravated identity theft), and 18 U.S.C. 1343 (wire fraud). Anyone who receives a federal target letter or agent visit should treat it as a separate and serious matter.

Collateral Consequences of a Conviction

A felony conviction can affect more than the sentence. It can limit employment, professional licensing, housing, and firearm rights; under federal law, a person convicted of a crime punishable by more than a year is generally barred from possessing firearms (18 U.S.C. 922). Non-citizens should speak with a defense lawyer and an immigration lawyer before any plea, because a theft or fraud conviction can carry immigration consequences. These effects are why a plea that looks modest on paper deserves careful review.

A Financial Dispute Is Not Automatically a Crime

Disagreements about inheritance, loans, caregiving expenses, and who spent what are common, and many belong in probate or civil court rather than criminal court. The criminal law asks about knowledge, intent, deception, and lack of authority. Persuading a prosecutor that the evidence describes a family disagreement, not a crime, is often the heart of the defense, and it is easier to do early, before positions harden.

What to Do If You Are Under Investigation

• Do not give a statement. Politely decline interviews with bank investigators, detectives, or relatives about the money until you have spoken with counsel.
• Call a criminal defense lawyer. Counsel can contact the investigator, learn whether you are a target, and arrange any contact on your terms.
• Preserve everything. Keep bank records, messages, powers of attorney, receipts, and device data. Deleting anything can create a far bigger problem.
• Avoid contact with the accuser. Bond conditions or a protection order can follow, and messages can become evidence.
• Do not move money without advice. Repaying or transferring funds can look like an admission or a new offense unless it is handled through counsel.

If you believe your own identity was stolen, the Federal Trade Commission’s IdentityTheft.gov explains how to report it and create a recovery plan.

Frequently Asked Questions

Is identity theft a felony in Colorado?

Often, yes. Using another person’s identifying information or a financial device to obtain value, or making or altering a written instrument that contains such information, is a class 4 felony under C.R.S. 18-5-902. Simple possession can be a class 2 misdemeanor, but a class 5 felony when three or more persons or devices are involved.

What is financial exploitation of an elderly person in Colorado?

Under C.R.S. 18-6.5-103, criminal exploitation occurs when someone knowingly uses deception, harassment, intimidation, or undue influence to deprive an at-risk person, including anyone 70 or older, of something of value. It is a class 5 felony under $500 and a class 3 felony at $500 or more.

Can I be charged if the account holder gave me permission?

Permission and lawful authority are elements the prosecution must overcome in identity theft cases. Evidence of consent, a power of attorney, or a joint account can be central. Whether consent was real and informed may be disputed in exploitation cases.

What is the Colorado ASSET Act?

HB26-1110 allows banks and credit unions to delay suspicious disbursements involving eligible adults, requires reports to law enforcement or adult protective services, and limits a hold to 90 days with a possible extension to 180. It took effect August 12, 2026.

How long can Colorado wait to file identity theft charges?

The general felony limit is three years, but for identity theft and theft offenses the period begins on discovery of the criminal act under C.R.S. 16-5-401. The exact date can be contested.

Should I talk to the bank or police before hiring a lawyer?

No. Statements can be used as evidence, and explanations given without counsel often create problems. Speak with a criminal defense lawyer first.

Talk to a Denver Metro Criminal Defense Lawyer

If you are being investigated, or you have already been charged, with identity theft, theft, or exploitation of an at-risk person, the Law Office of H. Michael Steinberg can review the evidence, explain your options, and speak with investigators and prosecutors on your behalf.

Learn more about attorney H. Michael Steinberg, read the firm’s background, and to browse all practice areas. More Colorado criminal law articles are on the Colorado Criminal Lawyer Blog. To talk through your situation, contact the firm or call 303-627-7777 for a free consultation.

This article is general information about Colorado law as of November 8, 2026. It is not legal advice and does not create an attorney-client relationship. Statutes and court decisions change, and every case turns on its own facts. Verify citations against the official Colorado Revised Statutes and the Colorado Judicial Branch before relying on them.

Sources:

• C.R.S. 18-5-902, identity theft
• C.R.S. 18-6.5-103, crimes against at-risk persons
• C.R.S. 18-6.5-102, definitions
• C.R.S. 18-1.3-401, presumptive sentencing
• C.R.S. 16-5-401, limitation periods
• HB26-1110 bill page
• HB26-1110 enrolled text
• People v. Perez, 2016 CO 12
• People v. Rodriguez-Morelos, 2025 CO 2
• People v. Brennan, 2025 COA 68
• KUNC: bill to protect seniors from scammers