Are Clone Cards Illegal? Federal and State Laws Explained

Yes, clone cards are illegal in the United States. Federal law under 18 U.S.C. § 1029 makes it a crime to knowingly produce, use, traffic in, or possess counterfeit access devices with intent to defraud[1]. Possessing 15 or more counterfeit cards is a federal crime even without using them[2]. State laws may also apply even for small transactions or when no purchase is completed[1].

What Clone Cards Are and Why the Law Targets Them

A clone card is a counterfeit payment card that carries data copied from a legitimate cardholder's account. Criminals obtain the victim's card number, expiration date, and magnetic-stripe or chip data—often through skimming devices at ATMs or point-of-sale terminals—then encode that information onto blank plastic or another card. The result is a physical duplicate that can be used to make purchases or withdraw cash as if it were the original.

Federal law does not limit its definition to the physical card itself. Under 18 U.S.C. § 1029, an access device includes any card, plate, code, account number, personal identification number, or other means of account access that can be used to obtain money, goods, or services[4]. A counterfeit access device is any such device that is counterfeit[4]. This broad scope means that prosecutors can charge offences involving copied magnetic-stripe data, cloned EMV chips, stolen card numbers used online, or even account credentials typed into a fraudulent website. The statute covers schemes involving account information and devices used to obtain money, goods, or services, including knowingly producing or trafficking in counterfeit access devices with intent to defraud[1].

Why does the law cast such a wide net? Payment-card fraud imposes direct losses on cardholders, merchants, and issuers, and undermines trust in electronic payments. By targeting the unauthorised copying and fraudulent use of payment-card data—not just the plastic—federal law addresses the full lifecycle of a cloning operation: the initial data theft, the encoding of counterfeit cards, the distribution of those cards, and their eventual use. Each step can trigger separate criminal liability, and a single cloning scheme may violate multiple provisions of 18 U.S.C. § 1029 as well as state fraud statutes[3].

For readers seeking to understand how cloning techniques work in practice, see our guide on Clone Card: How Skimming Works and How to Protect Your Card.

Federal Laws That Make Clone Cards Illegal

The primary federal statute criminalising clone cards is 18 U.S.C. § 1029, which prohibits knowingly producing, using, trafficking in, or possessing counterfeit or unauthorised access devices with intent to defraud[1]. Each of these verbs describes a separate offence. Producing means creating or encoding a counterfeit card; using means presenting it for payment or account access; trafficking means selling, distributing, or transferring cards to others; and possessing means holding one or more cards with the intent to commit fraud. The statute requires that the defendant acted knowingly and with intent to defraud—accidental possession of a counterfeit card, or carrying your own genuine card, does not violate the law[1].

Possession of Fifteen or More Counterfeit Devices

Under 18 U.S.C. § 1029(a)(3), possessing fifteen or more counterfeit or unauthorised access devices is a federal crime even without using them or making any purchases[2]. This provision targets bulk possession, which prosecutors treat as evidence of an intent to distribute or commit large-scale fraud. The fifteen-card threshold means that law enforcement can charge an individual who stockpiles cloned cards before any transaction occurs. For example, if investigators find a suspect with twenty blank cards encoded with stolen magnetic-stripe data, that possession alone satisfies the elements of the offence—no completed sale or ATM withdrawal is required.

The $1,000 Threshold and What It Does Not Mean

Certain provisions of 18 U.S.C. § 1029 require that the value obtained or intended to be obtained totals at least $1,000 during any one-year period[1]. Federal law separately criminalises using or trafficking in one or more unauthorised access devices when the value obtained totals $1,000 or more in any one-year period[5]. This threshold applies to specific subsections—typically those involving the use or trafficking of unauthorised (rather than counterfeit) devices—and serves to focus federal resources on higher-value schemes.

The $1,000 figure is not a general licence to clone or use a card below that amount[1]. State statutes and other federal laws may still apply even if the transaction is small or no purchase is completed[1]. A single fraudulent purchase of £50 may not meet the federal $1,000 threshold, but it can still trigger state charges for unauthorised use, possession of a counterfeit card, or fraud. In practice, prosecutors often charge both federal and state offences simultaneously, ensuring that no cloning activity falls outside criminal liability[3].

What "Counterfeit" and "Unauthorised" Mean

Federal law distinguishes between counterfeit and unauthorised access devices, though both categories are illegal. A counterfeit access device is any device that is counterfeit—meaning it has been altered, duplicated, or fabricated to appear genuine[4]. An unauthorised access device includes stolen, lost, revoked, cancelled, or fraudulently obtained cards, as well as cards issued to another person that the defendant has no right to use[5]. Clone cards typically fall into the counterfeit category because they are physical duplicates encoded with copied data. However, if a criminal uses a genuine card that was stolen or obtained through identity theft, that card may be charged as unauthorised rather than counterfeit. The practical consequence is the same: both types of device are covered by 18 U.S.C. § 1029, and both carry the same penalty ranges.

Key Takeaways for Federal Liability

• Producing, using, trafficking in, or possessing even one counterfeit card with intent to defraud is a federal crime[1].
• Possessing fifteen or more counterfeit devices is illegal regardless of whether you use them[2].
• The $1,000 threshold applies only to certain provisions and does not make cloning legal below that amount[1].
• Federal law covers not just physical cards but also account numbers, PINs, and any means of account access[4].

These rules mean that every stage of a cloning operation—from copying card data to encoding blanks to selling or using the finished product—can trigger federal charges. The next section examines how state laws add further layers of criminal liability.

When Possession of a Clone Card Becomes a Crime

Possession of a clone card is criminal when the person knows the card is counterfeit or unlawfully obtained and possesses it with intent to defraud[1]. The law does not punish accidental possession or ignorance. A genuine cardholder carrying their own card is not committing a crime by possession[1]. The offence requires two elements: knowledge that the device is counterfeit or unauthorised, and intent to use it fraudulently. Without both, prosecutors cannot establish possession as a crime under federal or most state statutes.

Knowledge and Intent: What Prosecutors Must Prove

Knowledge means the defendant was aware that the card in their possession was counterfeit, stolen, or otherwise unauthorised. Intent to defraud means the defendant planned to use the card to obtain money, goods, or services without authorisation. These mental states are typically proven through circumstantial evidence: the number of cards found, the presence of encoding equipment, communications about selling or using the cards, or attempts to make purchases. If you unknowingly receive a counterfeit card—perhaps handed to you by mistake—and you do not intend to use it fraudulently, you have not committed the possession offence. Once you become aware that the card is counterfeit and continue to hold it with the aim of using it, possession becomes criminal.

The Fifteen-Card Federal Threshold

Under 18 U.S.C. § 1029(a)(3), possessing fifteen or more counterfeit or unauthorised access devices is a federal crime even without using them or making any purchases[2]. This provision eliminates the need for prosecutors to prove that the defendant completed a transaction or intended a specific fraudulent act beyond the possession itself. Bulk possession—fifteen or more cards—is treated as inherently indicative of intent to defraud, because few legitimate reasons exist for holding that many counterfeit devices. Law enforcement can charge this offence the moment they discover the cards, whether in a suspect's home, vehicle, or storage unit.

For example, if investigators execute a search warrant and find twenty blank cards encoded with magnetic-stripe data copied from victims' accounts, the defendant can be charged under § 1029(a)(3) immediately. No completed ATM withdrawal, no attempted purchase, and no sale to a third party is required. The fifteen-card count itself satisfies the elements of the offence. This threshold does not mean that possessing fewer than fifteen cards is legal; it means that possessing fifteen or more triggers a specific federal provision with no additional proof of use required[2].

Possessing Fewer Than Fifteen Cards

Possessing one to fourteen clone cards can still be a federal crime if prosecutors prove that the defendant knew the cards were counterfeit and possessed them with intent to defraud[1]. The same knowledge-and-intent standard applies, but the government must present evidence of that intent—such as messages discussing fraudulent purchases, attempts to use the cards, or possession of skimming equipment. State laws may also criminalise holding card data with intent to use it fraudulently, or using a card without the owner's consent, and may apply even if the transaction is small or no purchase is completed[1]. In practice, a single cloned card found during a traffic stop, combined with evidence that the defendant planned to use it, can result in both federal and state charges[3].

What Counts as a "Counterfeit or Unauthorised Access Device"

Federal law defines an access device as any card, plate, code, account number, personal identification number, or other means of account access that can be used to obtain money, goods, or services[4]. Possession is not limited to holding a physical plastic card. If you possess a list of stolen card numbers, magnetic-stripe data stored on a laptop, or a USB drive containing account credentials, and you intend to use that information to create or use counterfeit cards, you may be charged with possessing counterfeit or unauthorised access devices. The statute's broad definition ensures that criminals cannot evade liability by storing data electronically rather than encoding physical cards.

Practical Scenarios: When Possession Is and Is Not a Crime

• Not a crime: You carry your own debit card issued in your name by your bank. You are the authorised user, and the card is genuine[1].
• Not a crime (initially): Someone hands you a card at a petrol station, claiming it is theirs and asking you to hold it briefly. You do not know it is counterfeit, and you return it immediately. You lacked knowledge and intent.
• A crime: You purchase five cloned cards from an online vendor, intending to use them to buy electronics. You possess fewer than fifteen cards, but your intent to defraud is clear from the purchase and planned use[1].
• A crime: Police find sixteen encoded blank cards in your flat, along with a card reader and software for writing magnetic-stripe data. Possession of fifteen or more counterfeit devices is a federal offence even if you have not yet used any of them[2].
• A crime: You keep a spreadsheet of stolen card numbers and CVV codes, planning to sell the data to others. Although you do not hold physical cards, you possess unauthorised access devices in digital form with intent to defraud[4].

These examples show that the line between lawful and criminal possession turns on knowledge and intent, not merely on the number of cards or their physical form. If you are uncertain whether a card in your possession is genuine, and you have no intent to use it fraudulently, you are not committing the possession offence. Once you know the card is counterfeit and you hold it with the aim of fraud, possession becomes a crime under both federal and state law.

State Laws and Dual Prosecution for Card Cloning

A single card-cloning operation can trigger charges at both the federal and state levels simultaneously, because states have their own credit card fraud statutes covering payment-card theft, forgery, possession of counterfeit cards, unauthorised use, and identity theft[3]. Federal law does not pre-empt state prosecution. Both jurisdictions may charge the same conduct under their respective statutes, and both sets of penalties can apply. This means that a defendant convicted of federal access-device fraud under 18 U.S.C. § 1029 may also face separate state charges for the same cloning scheme, leading to consecutive prison sentences and multiple fines.

What State Statutes Cover

State laws may criminalise making a counterfeit card, holding card data with intent to use it fraudulently, or using a card without the owner's consent, and may apply even if the transaction is small or no purchase is completed[1]. Most states have enacted statutes that mirror federal prohibitions but with lower thresholds and broader definitions. For example, a state may make it a crime to possess any counterfeit payment card with intent to defraud, without requiring a minimum number of cards or a $1,000 value threshold. State statutes often cover:

• Forgery and counterfeiting: Creating, altering, or duplicating a payment card or the data encoded on it.
• Unauthorised possession: Holding a counterfeit or stolen card with knowledge and intent to defraud.
• Unauthorised use: Using a card without the owner's permission, even for a single small purchase.
• Identity theft: Obtaining or using another person's card details to commit fraud.
• Trafficking: Selling, distributing, or transferring counterfeit cards or card data to others.

These provisions ensure that state prosecutors can charge cloning activity that might fall outside certain federal thresholds or that occurs entirely within one state's borders.

Dual Prosecution in Practice

When federal and state authorities investigate the same cloning operation, they may coordinate charges or proceed independently. A defendant arrested for possessing twenty cloned cards may be indicted in federal court under 18 U.S.C. § 1029(a)(3) for possessing fifteen or more counterfeit devices[2], and simultaneously charged in state court for possession of counterfeit instruments, identity theft, and fraud. Both prosecutions can proceed to trial, and convictions in both courts can result in separate sentences. Courts have consistently held that this dual prosecution does not violate double-jeopardy protections, because federal and state governments are separate sovereigns with independent authority to enforce their own laws[3].

For example, if you clone cards in Bristol and use them to make purchases in London, you may face federal charges for producing and using counterfeit access devices, as well as charges under the laws of England for fraud by false representation under the Fraud Act 2006. (Note that UK law applies differently; this example illustrates the principle of overlapping jurisdictions.) In the United States, a similar scenario—cloning cards in one state and using them in another—can trigger both federal interstate-commerce provisions and the fraud statutes of each state involved.

Why State Laws Apply to Small Transactions

State statutes do not require a minimum transaction value or a completed purchase to establish criminal liability[1]. If you attempt to use a cloned card to buy a coffee for £3 and the transaction is declined, you can still be charged with attempted fraud, possession of a counterfeit card, and unauthorised use under state law. The federal $1,000 threshold does not shield you, because state law operates independently[1]. Prosecutors may choose state charges when the value is low, when the defendant has no prior federal record, or when state penalties are more severe for the specific conduct.

This means that every stage of a cloning operation—from copying card data to encoding a blank card to attempting a single purchase—can be prosecuted under state law, regardless of the amount involved. The absence of a federal charge does not imply that the conduct is legal; it simply means that state authorities are handling the case.

Key Takeaways for State Liability

• A single cloning scheme can result in both federal and state charges simultaneously[3].
• State laws cover card theft, forgery, possession, unauthorised use, and identity theft, often with no minimum value threshold[1].
• State charges can apply even if no purchase is completed or the transaction is declined[1].
• Convictions in both federal and state courts can lead to consecutive sentences and separate fines.

Understanding that state and federal laws operate in parallel is essential for anyone assessing the legal risks of clone cards. The next section will examine the penalties and sentencing guidelines that apply once charges are filed.

Criminal Penalties for Clone Card Offenses

Federal prosecutors can seek penalties of up to 20 years in prison and $250,000 in fines for repeat offenders convicted under federal access-device fraud statutes[3]. These maximum sentences apply to defendants with prior convictions for similar offences, or to cases involving aggravating factors such as large-scale operations, organised criminal groups, or significant financial harm to victims. First-time offenders typically face lower sentences, but even a single conviction under 18 U.S.C. § 1029 can result in years of imprisonment and substantial fines. The severity of the penalty depends on the specific conduct charged, the amount of loss, the defendant's criminal history, and whether the offence involved interstate commerce or sophisticated technology.

Federal Sentencing Guidelines

Federal judges follow the United States Sentencing Guidelines when determining prison terms and fines. For access-device fraud, the base offence level starts at a moderate point and increases based on the number of victims, the total loss amount, and whether the defendant was part of a conspiracy. A loss of $1,000 to $6,500 adds two levels; a loss exceeding $250,000 can add twelve or more levels. Possessing fifteen or more counterfeit devices under § 1029(a)(3) carries a base level that reflects the presumed intent to cause significant harm[2]. If the defendant used sophisticated means—such as skimming equipment, custom software, or encrypted communications—the court may add further levels. Each increase in offence level corresponds to a longer recommended prison range.

For example, a defendant with no prior record convicted of possessing twenty cloned cards and causing $50,000 in losses might face a guideline range of 18 to 24 months in prison. A repeat offender convicted of the same conduct could face 41 to 51 months. If the operation involved trafficking cards to others or using them across state lines, the range increases further. The $250,000 maximum fine applies per count, so a defendant convicted on multiple counts can face fines totalling hundreds of thousands of pounds. Courts may also order restitution to victims, requiring the defendant to repay all documented losses.

State Penalties and Variation by Jurisdiction

A single card-cloning operation can trigger charges at both the federal and state levels simultaneously, because states have their own credit card fraud statutes covering payment-card theft, forgery, possession of counterfeit cards, unauthorised use, and identity theft[3]. State penalties vary widely by jurisdiction. Some states classify possession of a single counterfeit card as a misdemeanour punishable by up to one year in county gaol and a fine of a few thousand pounds. Others treat it as a felony with a maximum sentence of five to ten years in state prison. Repeat offenders, or defendants whose conduct caused large losses, face enhanced penalties under state habitual-offender statutes.

State laws may criminalise making a counterfeit card, holding card data with intent to use it fraudulently, or using a card without the owner's consent, and may apply even if the transaction is small or no purchase is completed[1]. This means that attempting to use a cloned card to buy groceries worth £20 can result in a state felony charge, even if the transaction is declined. State prosecutors often pursue charges when the conduct does not meet federal thresholds or when they believe state penalties are more appropriate. Because state and federal governments are separate sovereigns, a defendant can be convicted and sentenced in both systems for the same cloning operation[3]. The sentences may run consecutively, meaning the defendant serves the federal term followed by the state term, or concurrently, depending on the judge's order and the jurisdictions' policies.

Practical Implications of Dual Liability

If you are arrested for clone card offences, you may face federal charges, state charges, or both. Federal authorities typically take cases involving interstate commerce, large-scale operations, or sophisticated technology. State authorities handle cases with local victims, smaller amounts, or defendants with no prior federal record. In practice, a single search warrant that uncovers cloned cards can lead to parallel investigations by the FBI and state police, each building a separate case under their own statutes[3]. Both prosecutions can proceed to trial, and both can result in convictions and sentences.

This dual liability means that the total penalty for clone card offences can far exceed the federal maximum alone. A defendant sentenced to five years in federal prison and three years in state prison may serve eight years if the sentences run consecutively. Fines and restitution orders from both courts add up, and the defendant's criminal record will reflect convictions in both systems. Understanding this risk is essential: even if you believe your conduct falls below a federal threshold, state law may still apply, and the combined penalties can be severe.

Key Takeaways on Penalties

• Federal law allows up to 20 years in prison and $250,000 in fines for repeat offenders[3].
• First-time offenders face lower sentences, but even a single conviction can result in years of imprisonment.
• State penalties vary by jurisdiction and can apply to small transactions or attempted use[1].
• A single cloning operation can trigger both federal and state charges, leading to consecutive sentences[3].
• Courts may order restitution to victims, adding to the financial burden of a conviction.

These penalties reflect the serious harm that clone card fraud causes to victims, financial institutions, and the payment system as a whole. The next section will address common questions about the legal status and consequences of clone cards.

Common Mistakes and Misconceptions

Believing the physical card is what makes cloning illegal

Many people assume the crime lies in possessing a fake plastic card, but federal law defines the offence around access devices and data. An access device includes any card, plate, code, account number, personal identification number, or other means of account access that can be used to obtain money, goods, or services[4]. This means copying account data onto a blank card, or even holding that data with intent to defraud, can be unlawful regardless of whether a physical clone card is ever produced. The legal act of cloning is the unauthorised copying and use of account information, not the plastic itself.

Assuming possession is only illegal if you use the card

A common misconception is that simply holding a cloned card without making purchases is safe. Federal law makes it a crime to knowingly and with intent to defraud possess fifteen or more counterfeit or unauthorised access devices, even without using them or making purchases[2]. Below that number, state laws may still criminalise possession of a counterfeit card when the person knows it is counterfeit and intends to use it fraudulently[1]. The difference between possession and use matters for which charge applies, but both can be prosecuted.

Thinking the $1,000 threshold makes small cloning legal

Some people read the $1,000 value requirement in certain provisions of 18 U.S.C. § 1029 as a licence to clone or use cards below that amount. That is incorrect. The threshold is not a general defence, because state statutes and other federal laws may still apply[1]. State laws may criminalise making a counterfeit card, holding card data with intent to use it fraudulently, or using a card without the owner's consent, and may apply even if the transaction is small or no purchase is completed[1]. A declined £3 coffee purchase can still lead to state charges.

Confusing possession of your own card with possession of a clone

Carrying a genuine card that belongs to you is not card cloning, and this distinction sometimes causes confusion. Possession of a cloned card can be a crime when the person knows the card is counterfeit or unlawfully obtained and possesses it with intent to defraud, while a genuine cardholder carrying their own card is not committing card cloning by possession[1]. The legal element is knowledge plus intent to defraud, not the mere act of holding a card. If you did not know the card was cloned and had no fraudulent purpose, the required mental state is absent.

Believing one jurisdiction's rules cover the whole situation

People often look only at federal law or only at their local state law, assuming one set of rules decides the case. A single card-cloning operation can trigger charges at both the federal and state levels simultaneously, because states have their own credit card fraud statutes covering payment-card theft, forgery, possession of counterfeit cards, unauthorised use, and identity theft[3]. This means you can be prosecuted in two separate systems for the same conduct, and convictions in both can lead to consecutive sentences. Checking only one jurisdiction gives an incomplete picture of the legal exposure.

Assuming no completed purchase means no crime

Another common error is thinking that if a transaction fails or no money is actually taken, no offence has occurred. State laws may criminalise making a counterfeit card, holding card data with intent to use it fraudulently, or using a card without the owner's consent, and may apply even if the transaction is small or no purchase is completed[1]. Attempting to use a cloned card and having it declined can still support charges for attempted fraud or possession of a counterfeit instrument. The criminal act is the intent and the unauthorised use, not the successful transfer of funds.

Conclusion

• Clone cards are illegal under federal law, and possession of fifteen or more counterfeit access devices is a crime even without use[2].
• State statutes can criminalise small transactions or attempted use, so a declined purchase does not remove liability[1].
• A single cloning operation can trigger federal and state charges simultaneously, with sentences that may run consecutively[3].
• Repeat offenders face up to 20 years in prison and $250,000 in fines under federal statutes[3].
• The $1,000 threshold in some provisions is not a licence to clone below that amount, because state and other federal laws still apply[1].

If you suspect your card has been cloned, start by contacting your bank and reviewing What to Do If My Card Is Cloned.

Explore More on Card Fraud Laws

Discover additional resources and insights on identification laws.