Access Device Fraud Defense Lawyer

Most people learn the phrase access device fraud from a federal agent. The account numbers, the card stock, the point-of-sale terminal, the shipping addresses tied to a set of orders: by the time anyone knocks, the government has usually already gathered the records it will use to explain them. Charges of this kind are brought under 18 U.S.C. § 1029, and prosecutors in the Eastern District of Virginia bring them regularly because so much payment and network infrastructure sits inside the district. What starts as a dispute with a bank has a way of becoming a federal criminal matter without any intermediate step the person can see. The statute reaches conduct that many people would describe as ordinary account misuse, and it reaches people who never touched a physical card. If you have been contacted about card numbers, account credentials, or equipment used to encode them, the decisions made before charges are filed usually matter more than anything argued afterward. Law Offices Of SRIS, P.C. represents individuals and businesses in federal access device matters from the earliest contact through trial and sentencing. To discuss a matter under 18 U.S.C. § 1029, call (888) 437-7747 to request a consultation.

On this page

What 18 U.S.C. § 1029 Prohibits

Access device is a defined term, and the definition does most of the work in these cases. It covers cards, plates, codes, account numbers, personal identification numbers, and other means of account access that can be used, alone or together with another device, to obtain money, goods, services, or anything else of value, or to initiate a transfer of funds. A card in a wallet qualifies. So does a sequence of characters typed into a checkout page, a stored token held by a merchant, or a credential that unlocks a payment application.

The section is not a single offense. It is a set of related prohibitions: producing, using, or trafficking in counterfeit access devices; trafficking in or using unauthorized access devices; possessing unauthorized or counterfeit access devices; producing, trafficking in, or possessing device-making equipment; effecting transactions with an access device issued to another person; soliciting a person for the purpose of offering an access device; and using or trafficking in telecommunications instruments modified to obtain unauthorized service. Several of these subsections carry a threshold as an element, either a count of devices or a value obtained within a stated period. Those thresholds are fixed by the statute rather than by the sentencing guidelines. They are not verified in the sources this page relies on, so they are not reproduced here; confirm the current figures against the statutory text with counsel.

Each subsection also carries a jurisdictional element requiring an effect on interstate or foreign commerce. In a modern payment case that element is rarely contested, because authorization traffic crosses state lines by design. Attempt and conspiracy are addressed within the section itself, so an agreement that never produced a completed transaction can still be charged. Forfeiture provisions reach personal property used or intended to be used to commit the offense, which in practice means laptops, encoders, phones, and sometimes vehicles.

How Federal Agents Build an Access Device Case

These investigations usually begin with data rather than with a witness. A card network or issuing bank identifies a common point of purchase across a set of compromised accounts. A processor flags a merchant whose chargeback pattern departs from its stated business. A parcel carrier reports repeat deliveries to an address that matches no cardholder. From there the government works outward with subpoenas to banks, processors, carriers, and platform operators, and with search warrants for email and cloud storage. The Secret Service and Homeland Security Investigations both handle this work, and postal inspectors join when goods moved by mail.

By the time an agent asks to speak with someone, the account-level record is generally complete. What the government usually lacks is attribution: proof that a particular person, rather than a household, a shared device, or a co-worker, sat behind a session. Interviews are where that gap gets closed, which is why an unprepared conversation is the most costly step available in the period before charges. A person who volunteers a benign explanation for a transaction can supply the intent element that documents alone do not establish.

Defense work at this stage is concrete. Preserve devices and account data before they rotate out of retention. Obtain the client’s own records from banks and platforms rather than waiting to see them in discovery. Identify who else held credentials, physical access, or administrative rights. Where a business is involved, separate the conduct of individual employees from the entity, because the two can be charged very differently. Written submissions to prosecutors before a charging decision are read, and they cost least when they arrive before an indictment locks a theory in place.

Skimming, Card-Not-Present Conduct, and Device-Making Equipment

Three fact patterns dominate. The first is physical compromise: a skimmer placed on a terminal or a fuel pump, or a handheld reader used during a legitimate transaction. Cases of this kind turn on placement, recovery, and the forensic link between recovered hardware and the accounts later used. The second is card-not-present activity, where numbers obtained elsewhere are used online. These cases turn on session data, device fingerprints, and shipping logistics, and the person charged is frequently a downstream buyer rather than whoever compromised the data. The third involves device-making equipment: encoders, embossers, blank card stock, and software used to write track data. Possession offenses of this type appeal to prosecutors because they do not require proof that any account was ever charged.

The three patterns produce different defenses. A skimming case is a physical evidence case and lives or dies on chain of custody and on who had access to the location. A card-not-present case is an attribution case, and shared networks, resold credentials, and account takeover all cut against the government’s inference. An equipment case is an intent case, because the hardware involved has lawful uses in loyalty programs, access control, and hotel systems, so the question becomes what the person intended to encode.

Reshipping and money-movement roles sit alongside these patterns. People recruited through job postings often handle goods or funds without knowing the source, and the distance between a knowing participant and a person used as a conduit is frequently the whole case.

Sentencing Exposure Under 18 U.S.C. § 1029

This page does not state a statutory maximum for any subsection of § 1029. The ceiling varies by subsection and by whether the offense followed a prior conviction under the same section, and those figures are not verified in the sources relied on here. Confirm the maximum that applies to a specific charge against the current statutory text with counsel.

What can be described is how a federal sentence is actually built, because in fraud cases the guideline calculation usually matters more than the ceiling. The starting point is a base offense level for economic offenses, adjusted upward by loss. Loss in access device cases is not simply the amount charged to accounts; the guidelines direct a minimum loss figure for each unauthorized access device, and with a long list of compromised numbers that convention can drive the calculation well past anything the person received. The number of victims adds levels. So can the use of sophisticated means, possession of device-making equipment, relocation of a scheme to another jurisdiction, and derivation of a substantial part of income from the offense.

Adjustments then run in both directions: aggravating role for organizers and leaders, mitigating role for couriers and packers, abuse of a position of trust for insiders at a bank or a merchant, obstruction for destroyed devices, and acceptance of responsibility for an early resolution. Criminal history sets the other axis of the table. The court then weighs the statutory sentencing factors and may impose a sentence outside the range. Restitution to issuers and cardholders is ordered on top of any term of imprisonment, and supervised release with computer-use conditions is common.

Frequently Asked Questions

Is access device fraud the same thing as identity theft?

They overlap, but they are not the same charge. Access device fraud is defined by the instrument used to reach an account. Identity theft charges are defined by the use of another person’s identifying information. A single set of facts can support both, and they are frequently charged together in one indictment, which changes the sentencing picture considerably. Ask counsel which statutes appear in your charging document, because that answer determines what the government must prove and what exposure the case carries.

Can I be charged if I only bought numbers and never stole any?

Yes. Trafficking in and use of unauthorized access devices are prohibited by 18 U.S.C. § 1029 independently of how the numbers were obtained. Buying a list, receiving one in a message, or using a single number that someone else supplied can each fall within the section if the government proves knowledge and intent to defraud. Downstream purchasers are charged regularly. A buyer’s knowledge is often harder to prove than a seller’s, and the volume attributable to a buyer is usually smaller, which affects the guideline calculation.

The bank already reversed the charges. Does that end the matter?

No. A reversal resolves the civil relationship between a cardholder and an issuer. It has no effect on whether a federal offense occurred, and issuers report suspected fraud to law enforcement whether or not they absorbed the loss. Reversals can matter later, at restitution and in the loss calculation, so keep every statement and letter. They do not close a criminal investigation, and treating a resolved chargeback as the end of the matter is a common and expensive mistake.

Agents came to my home and said I am only a witness. Should I talk to them?

Treat that description as provisional. Witness, subject, and target are working categories that shift as an investigation develops, and nothing prevents a person described one way at the door from being charged later. A voluntary interview is not a neutral event, because a false or incomplete answer to a federal agent is itself a crime, separate from the underlying conduct. Decline politely, take the agent’s card, and have counsel make contact. That course keeps every option open and forecloses none.

What happens to my laptop and phone if they are seized?

Devices taken under a warrant go into a forensic queue and are held while images are examined, which can take months. You may ask for a copy of your own data, and counsel can move for return of property in appropriate cases, although courts are reluctant while an investigation remains open. Assume that anything on the device, including deleted material recoverable from unallocated space and synced cloud content, will be reviewed. Never wipe or reset a device that may be sought.

Does an access device case have to be brought in the Eastern District of Virginia?

Not necessarily, but it often is. Venue in a federal fraud case can lie in any district where an element of the offense occurred, and payment authorization, hosting, and data traffic routinely touch the Eastern District of Virginia even when no participant lives there. The district’s schedule moves faster than most, which compresses the time available for investigation and motions after arraignment. Counsel should evaluate venue early, because the objection can be lost if it is not raised in time.

How Mr. Sris and the Firm’s Of Counsel Attorneys Handle Access Device Cases

Access device matters reward early and unglamorous work. Preserving devices and account records, mapping who else could have used a credential, and keeping the client from supplying an unprepared account of a transaction all matter more at the outset than any argument available later.

Mr. Sris, Owner and Founder of Law Offices Of SRIS, P.C., is a former prosecutor and founded the firm in 1997. He is admitted in Virginia, Maryland, the District of Columbia, New Jersey, and New York. His background at George Mason University in accounting and information systems is applied to complex financial and technology-related cases, which is the category these matters fall into. Mr. Sris and the firm’s Of Counsel attorneys, who contract directly with the firm, work on federal criminal matters together.

The firm represents individuals and businesses in access device matters at every stage, from a first agent contact or preservation letter through charged cases, trial, and sentencing. To discuss a matter under 18 U.S.C. § 1029, call (888) 437-7747 to request a consultation.

Disclaimers

This page describes federal access device fraud charges under 18 U.S.C. § 1029 in general terms for people trying to understand a federal process. It is not legal advice, and reading it does not create an attorney-client relationship with Law Offices Of SRIS, P.C. Federal statutes and the decisions interpreting them change over time, so confirm anything stated here against the current statutory text with counsel before acting on it.

Every federal matter turns on facts that belong to that matter alone. Case results depend on a variety of factors unique to each case. Results may vary.

Attorney responsible for this advertising: Mr. Sris. Law Offices Of SRIS, P.C. Call (888) 437-7747 to request a consultation; the firm’s intake line is staffed 24/7.

Attorney advertising. Prior results do not guarantee a similar outcome.

An access device fraud case is one part of fraud & financial crimes work, and our page on bank fraud defence covers the wider process.