EASTERBROOK, Chief Judge.

Christopher Spears made a counterfeit handgun permit for Tirsah Payne, who was awaiting trial on a drug charge and could not obtain a legitimate permit. Payne used the fake credential — which contained her own name and birthdate — when trying to buy a gun. The dealer was not deceived and did not sell Payne the weapon she wanted. An investigation led to Spears's arrest and the discovery that he had sold other fake credentials, such as drivers' licenses. He was convicted of five felonies, including aggravated identity theft, 18 U.S.C. § 1028A, and sentenced to 34 months in prison: 10 months on four of the five counts, to run concurrently, plus two years' imprisonment under § 1028A, which prescribes a mandatory consecutive term of that length.

Spears appealed three of the five convictions. A panel affirmed two while reversing the third. 697 F.3d 592 (7th Cir.2012). Spears then asked for rehearing en banc. Our order granting that petition vacated the panel's opinion and judgment, which we now reinstate with respect to the convictions other than the one under § 1028A.

Section 1028A(a)(1) provides that anyone who, in connection with a list of other crimes, "knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person shall, in addition to the punishment provided for such felony, be sentenced to a term of imprisonment of 2 years." Section 1028A(c) provides the list of predicate offenses; an unauthorized person's attempt to purchase a weapon, in violation of 18 U.S.C. § 922(a)(6), is on it. Spears acknowledges that he lacked "lawful authority" to sell counterfeit permits. But he contends that a permit is not a "means of identification"; only intangible details such as names and Social Security numbers are "means of identification", he maintains. Spears also contends that he did not "transfer[]" anything "to another person" because Payne used her own name and birthdate; no information was stolen from, or transferred to, anyone who did not consent. He believes that the phrase "without lawful authority" helps to show that "transfer" and "another person" refer to a victim rather than to persons who consent to the transaction.

The panel rejected the first of these arguments, 697 F.3d at 598, and we agree with its conclusion. Nothing in ordinary usage or statutory context limits the phrase "means of identification" to intangible information. People speak of a passport or driver's license as a means of identification. Other physical objects, including firearm-owners' cards, also come within that phrase because they identify their owners. The Supreme Court's only encounter with § 1028A, Flores-Figueroa v. United States, 556 U.S. 646, 129 S.Ct. 1886, 173 L.Ed.2d 853 (2009), treats both personal information and documents containing it as "means of identification". See, e.g., 556 U.S. at 653, 129 S.Ct. 1886. Although the Court did not grant certiorari in Flores-Figueroa to define "means of identification" and did not produce a holding on that subject, the Justices' understanding confirms that the common usage of "means of identification" includes physical objects.

And although § 1028A does not define "means of identification", a neighboring statute — 18 U.S.C. § 1028, dealing with identity fraud — does. Section 1028(d)(7) provides a list, some members of which (e.g., "iris image") are physical objects. Section 1028A(a)(1) forbids not only transferring but also possessing a "means of identification". Although it is possible to "possess" information without committing it to paper, many forms of possession entail embodiment in an object such as a passport, Social Security card, or alien registration document. We therefore conclude that the document sold to Payne was a "means of identification". Accord, United States v. Sash, 396 F.3d 515, 524 (2d Cir.2005) (counterfeit police badge is a "means of identification" under § 1028A).

Spears insists that he did not "transfer" the means to Payne, because she knew her own name and birthdate. Because the "means of identification" was the counterfeit card, however, it was indeed "transfer [red]" from Spears to Payne. But a transfer is not enough. The "means of identification" must be that of "another person". From Payne's perspective, the card she received did not pertain to "another"; it had her own identifying details. The prosecutor says that this is irrelevant because, from Spears's perspective, Payne was the "another". On this view, Spears could give Payne a card bearing Spears's name but not anyone else's. If the prosecutor is right, § 1028A acquires a surprising scope. It would, for example, require a mandatory two-year consecutive sentence every time a tax-return preparer claims an improper deduction, because the return is transferred to the IRS, concerns a person other than the preparer, includes a means of identifying that person (a Social Security number), and facilitates fraud against the United States (which § 1028A(c)(4) lists as a predicate crime).

In trying to understand the meaning of "another person" we draw on the statute's caption — "Aggravated identity theft." Providing a client with a bogus credential containing the client's own information is identity fraud but not identity theft; no one's identity has been stolen or misappropriated. A caption cannot override a statute's text, but it can be used to clear up ambiguities. Florida Department of Revenue v. Piccadilly Cafeterias, Inc., 554 U.S. 33, 47, 128 S.Ct. 2326, 171 L.Ed.2d 203 (2008); Porter v. Nussle, 534 U.S. 516, 528, 122 S.Ct. 983, 152 L.Ed.2d 12 (2002). Flores-Figueroa used the caption of § 1028A to help explicate its text. 556 U.S. at 655, 129 S.Ct. 1886. The phrase "another person" is ambiguous: neither text nor context tells us whether "another" means "person other than the defendant" or "person who did not consent to the information's use". That § 1028A deals with identity theft helps resolve the ambiguity in favor of the latter understanding, while reading "another person" to mean "person other than the defendant" treats § 1028A as forbidding document counterfeiting and other forms of fraud, a crime distinct from theft.

To appreciate the difference, one need look no farther than § 1028, the aggravated-identity-theft statute's next-door neighbor. Section 1028, captioned "Fraud and related activity in connection with identification documents", makes it a crime to do any of the following under circumstances (specified in § 1028(c)) that bring the activity within the scope of national authority:

18 U.S.C. § 1028(a). The transaction between Spears and Payne fits comfortably within paragraphs (1) and (2). And in a statute about identity fraud it would make sense to say that Spears violated paragraph (7) as well, because he made a document that aided and abetted Payne's effort to obtain a gun by fraud. But instead of using § 1028, the prosecutor charged Spears under § 1028A — which, if it means what the prosecutor says, would convert most identity fraud into identity theft and add a mandatory, consecutive, two-year term to every conviction, even though § 1028 lacks any equivalent sentencing provision.

Congress borrowed and modified the language of § 1028(a)(7), which stems from 1982, to produce § 1028A(a)(1), which was enacted in 2004. Section 1028(a)(7) deals with document fraud committed with intent to aid or abet any federal crime, or any state felony. Section 1028A(a)(1) deals with identity theft in connection with a short list of serious crimes. The abbreviation of the list of predicate offenses is one reason why § 1028A carries a harsher sentence; the fact that identity theft has a victim other than the public at large is another. The usual victim of identity theft may be out of pocket (if the thief uses information to buy from merchants) or may be put to the task of rehabilitating a damaged reputation or credit history. Flores-Figueroa observed that the examples in the legislative history of § 1028A involve people injured when a third party used their names or financial information (credit card or Social Security numbers) without their consent. 556 U.S. at 655, 129 S.Ct. 1886. And the Court also observed that "Congress separated the fraud crime from the theft crime in the statute itself" (ibid.) by giving § 1028 and § 1028A different titles and placing the rules in different sections.

The Solicitor General told the Supreme Court that "[t]he statutory text makes clear that the sine qua non of a Section 1028A(a)(1) offense is the presence of a real victim." Brief for the United States in Flores-Figueroa v. United States, No. 08-108, at 20 (Jan.2009). Pages 19-22 of that brief give several reasons why the Solicitor General concluded that identity-theft crimes entail a victim whose information has been used without consent. The United States Attorney has not explained why his position in this prosecution differs so dramatically from the Solicitor General's in Flores-Figueroa.

The most one could say for the United States' current position is that "another" in § 1028A(a)(1) is ambiguous. If that ambiguity is not resolved by the statutory caption and the contrast between § 1028 and § 1028A, it must be resolved by the Rule of Lenity, under which conviction is possible only when a law declares in understandable words what is forbidden. See, e.g., Skilling v. United States, ___ U.S. ___, 130 S.Ct. 2896, 2932, 177 L.Ed.2d 619 (2010); Rewis v. United States, 401 U.S. 808, 812, 91 S.Ct. 1056, 28 L.Ed.2d 493 (1971). Crimes are supposed to be defined by the legislature, not by clever prosecutors riffing on equivocal language. A reasonable person reading § 1028A(a)(1) would not conclude that Congress has definitely used the word "another" to specify every person other than the defendant, as opposed to a person whose information has been misappropriated.

We have not located any appellate decision discussing the meaning of "another person". Although one court of appeals stated that the phrase means "anyone other than the defendant" (United States v. Zuniga-Arteaga, 681 F.3d 1220, 1224 (11th Cir.2012)), the parties had not contested that issue, and the court did not explain why it chose that definition over "anyone other than a person consenting to the use of the information" or something similar. The sole question at issue in Zuniga-Arteaga was whether the "person" had to be alive; the eleventh circuit held, as we also had done, see United States v. LaFaive, 618 F.3d 613 (7th Cir.2010), that unauthorized use of a dead person's identifying information can violate § 1028A. The eleventh circuit's decision does not resolve other issues not contested by the parties.

Section 1028A, we hold, uses "another person" to refer to a person who did not consent to the use of the "means of identification". This decision, in conjunction with the panel's disposition of the convictions under statutes other than § 1028A, mean that two of Spears's convictions have been reversed, while three remain. The district court's judgment is vacated, and the case is remanded for resentencing on those three convictions.