Massachusetts Identity Theft Laws: Penalties and Victim Rights

This page covers identity theft and identity fraud law in Massachusetts under M.G.L. c.266, Section 37E, plus the state's credit-freeze, breach-notification, and consumer-protection statutes that apply once someone has misused your identifying information. It does not cover federal identity theft law in depth; for that layer, see our identity theft laws hub and our guide to reporting identity theft.

Massachusetts's Identity Fraud Statute

M.G.L. c.266, Section 37E, «Use of personal identification of another; identity fraud; penalty; restitution,» defines «personal identifying information» as any name or number usable, alone or with other information, to assume an individual's identity. The statute prohibits three overlapping categories of conduct, and each carries a mens rea element that the prosecution must prove. Subsection (b) reaches a person who, «with intent to defraud,» poses as another without that person's express authorization and uses their identifying information to obtain or attempt to obtain money, credit, goods, services, anything of value, an identification card or other evidence of identity, «or to harass another.» Subsection (c) reaches obtaining another person's identifying information without express authorization, again «with intent to defraud,» either intending to pose as that person or to assist someone else in posing, for those same purposes or to harass. Subsection (c1/2) reaches possessing a tool or instrument adapted, designed, or commonly used for accessing another person's account numbers, codes, passwords, or unique biometric data «under circumstances evincing an intent to use or knowledge that some person intends to use the same in the commission of larceny.»

Two elements matter when reading Section 37E against a real set of facts. Intent to defraud is an element of both (b) and (c), so unauthorized use of someone's information without that intent does not fit either subsection. And «harass» is a defined term rather than an everyday one: subsection (a) limits it to willfully and maliciously engaging in an act directed at a specific person that seriously alarms or annoys them and would cause a reasonable person to suffer substantial emotional distress. Because harassment is listed as an alternative prohibited purpose, the statute reaches identity misuse aimed at tormenting someone, not only misuse aimed at financial gain.

Unlike many states, Massachusetts does not tier this penalty by the dollar value obtained or by repeat offense. All three prohibited categories carry the identical maximum penalty: a fine of not more than $5,000 or imprisonment in a house of correction for not more than two and one-half years, or both. Section 37E(e) separately authorizes a warrantless arrest on probable cause of a violation, giving police the ability to act immediately rather than waiting to obtain a warrant.

Your Right to a Police Report Within 24 Hours

Section 37E(f) gives Massachusetts identity fraud victims a specific, enforceable right that many states leave discretionary: a law enforcement officer must accept the victim's incident report and, if the victim requests it, provide a copy within 24 hours. The report can be filed in any of four qualifying counties: where the victim resides, where the identifying information was stored or used, where the responsible business operates, or where the underlying breach occurred. This flexibility matters in practice, since identity fraud frequently crosses county lines between where a victim lives and where the fraud was actually committed.

Restitution and the Consumer Protection Act

Restitution to an identity fraud victim in Massachusetts is mandatory, not left to the sentencing judge's discretion. Section 37E(d) states that a person found guilty «shall, in addition to any other punishment, be ordered to make restitution for financial loss sustained by a victim,» and the statute specifically lists the costs of correcting credit history, the costs of civil or administrative proceedings needed to satisfy wrongly incurred debts, liens, or judgments, lost wages, and attorney's fees.

Separately, Massachusetts's general Consumer Protection Act, c.93A Section 9, gives a private right of action for an «unfair or deceptive act or practice,» with a guaranteed minimum recovery of actual damages or $25, whichever is greater, 2 to 3 times damages for a willful or knowing violation, and mandatory attorney's fees and costs for a prevailing plaintiff. This is a real, verified statute, but its application to a given identity theft case is fact-dependent: c.93A reaches a business's unfair or deceptive data-handling conduct more directly than it reaches the fraudster's own conduct, which Section 37E's criminal and restitution track already addresses. When a business did deceive you directly, our guide to Massachusetts scam and fraud laws covers how a c.93A claim works, including the written demand that generally has to come first. Anyone considering a c.93A claim tied to identity theft should discuss the specific facts with a Massachusetts-licensed attorney rather than assume the statute automatically applies.

No Massachusetts-Specific Minor Credit Freeze Law

Massachusetts's general security-freeze statute, c.93 Section 62A, applies to «a consumer» with no age threshold and no separate provision for minors or other protected consumers. A full review of Chapter 93's table of contents found no adjacent minor or protected-consumer freeze section. That means Massachusetts residents, including parents trying to freeze a child's credit file before it is ever opened, rely entirely on the federal protected-consumer security freeze right created by 15 U.S.C. Section 1681c-1(j) in 2018, not on any state-specific mechanism. For the practical steps involved in placing a freeze, see our guide to credit freeze vs. fraud alert.

Reporting Identity Theft in Massachusetts

Under Section 37E(f) above, local police in Massachusetts must accept your report and, on request, provide a copy within 24 hours. This page could not independently confirm current contact details, complaint procedures, or hotline information for the Massachusetts Attorney General's consumer protection resources, because every attempted fetch of mass.gov returned a 403 response during research. Rather than repeat unverified information, this page directs Massachusetts residents to the free federal process at IdentityTheft.gov, which does not depend on any state-specific resource, and recommends checking mass.gov directly for the state office's current identity theft page and contact information. See our guide to how to report identity theft for the full federal reporting process.

The Federal Layer

Regardless of state, identity theft is also a federal crime under 18 U.S.C. Section 1028. The Federal Trade Commission's free recovery site, IdentityTheft.gov, walks victims through reporting what happened, building a personal recovery plan, and, with an account, pre-filling the letters most victims need. Once you have an FTC Identity Theft Report, FCRA Section 605B, codified at 15 U.S.C. Section 1681c-2, lets you get fraudulent information blocked from your credit report. Federal law has also required free credit freezes and free fraud alerts at all three credit bureaus since 2018. See our identity theft laws hub for the full federal picture, including the one-year versus seven-year fraud alert distinction.

2025-2026 Legislative Currency

A review of Massachusetts's 2025 Session Laws, covering Acts 1 through 101 as published on the legislature's session-laws page, found no amendment to c.266 Section 37E, c.93 Section 62A or 62B, or c.93H Section 3A. This coverage may not be exhaustive for the full 2025-2026 legislative session, so treat it as the most current information available rather than a guarantee that nothing has changed since.

Information last verified on 2026-08-13, drawn directly from M.G.L. c.266 Section 37E, c.93 Section 62A, c.93H Section 3A, and c.93A Section 9 on malegislature.gov. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.

Frequently Asked Questions

Is identity theft a felony in Massachusetts?

Massachusetts's identity fraud statute, M.G.L. c.266 Section 37E, sets a flat maximum penalty across its main provisions: a fine of not more than $5,000 or imprisonment in a house of correction for not more than two and one-half years, or both. The statute does not tier the penalty by dollar value or by repeat offense.

Does Massachusetts have a minor or child credit freeze law?

No. Massachusetts's general security-freeze statute, c.93 Section 62A, applies uniformly to all consumers with no age threshold or minor-specific provision. Massachusetts minors rely on the federal protected-consumer freeze right under 15 U.S.C. Section 1681c-1(j), in effect since 2018.

How quickly must Massachusetts police give me a copy of my identity fraud report?

Within 24 hours of your request, under M.G.L. c.266 Section 37E(f). You can file the report in any county where you live, where the information was stored or used, where the responsible business operates, or where the breach occurred.

Can I get restitution if someone is convicted of identity fraud against me in Massachusetts?

Yes, and it is mandatory. Section 37E(d) requires a court to order a convicted defendant to pay restitution covering the victim's costs of correcting credit history, related legal proceedings, lost wages, and attorney's fees.

Can I sue the person who stole my identity in Massachusetts?

Massachusetts's Consumer Protection Act, c.93A Section 9, provides a private right of action for unfair or deceptive practices, but its application to identity theft is fact-dependent and generally reaches a business's data-handling conduct rather than the thief's own conduct directly. Discuss your specific situation with a Massachusetts-licensed attorney.

What free protection do I get if a company's data breach exposed my Social Security number?

Under M.G.L. c.93H Section 3A, you are entitled to free credit monitoring, 18 months from the breached entity or 42 months if a consumer reporting agency itself was breached, and the offer cannot be conditioned on waiving your legal rights.

Where do I report identity theft in Massachusetts?

Local police must accept your report and, on request, provide a copy within 24 hours under Section 37E(f). The federal site IdentityTheft.gov also provides a free, state-independent reporting and recovery process; check mass.gov directly for the Attorney General's current consumer-protection contact information.