Massachusetts Identity Theft Laws: Penalties and Victim Rights

This page covers identity theft and identity fraud law in Massachusetts under M.G.L. c.266, Section 37E, plus the state's credit-freeze, breach-notification, and consumer-protection statutes that apply once someone has misused your identifying information. It does not cover federal identity theft law in depth; for that layer, see our identity theft laws hub and our guide to reporting identity theft.

Massachusetts's Identity Fraud Statute

M.G.L. c.266, Section 37E, «Use of personal identification of another; identity fraud; penalty; restitution,» defines «personal identifying information» as any name or number usable, alone or with other information, to assume an individual's identity. The statute prohibits three overlapping categories of conduct: posing as another person without authorization and using their identifying information to obtain money, credit, goods, services, or identification documents; obtaining another person's identifying information without authorization, either to impersonate them or to help someone else do so; and possessing tools or instruments designed to access financial accounts or biometric data with intent to commit larceny.

Unlike many states, Massachusetts does not tier this penalty by the dollar value obtained or by repeat offense. All three prohibited categories carry the identical maximum penalty: a fine of not more than $5,000 or imprisonment in a house of correction for not more than two and one-half years, or both. Section 37E(e) separately authorizes a warrantless arrest on probable cause of a violation, giving police the ability to act immediately rather than waiting to obtain a warrant.

Your Right to a Police Report Within 24 Hours

Section 37E(f) gives Massachusetts identity fraud victims a specific, enforceable right that many states leave discretionary: a law enforcement officer must accept the victim's incident report and, if the victim requests it, provide a copy within 24 hours. The report can be filed in any of four qualifying counties: where the victim resides, where the identifying information was stored or used, where the responsible business operates, or where the underlying breach occurred. This flexibility matters in practice, since identity fraud frequently crosses county lines between where a victim lives and where the fraud was actually committed.

Restitution and the Consumer Protection Act

Restitution to an identity fraud victim in Massachusetts is mandatory, not left to the sentencing judge's discretion. Section 37E(d) states that a person found guilty «shall, in addition to any other punishment, be ordered to make restitution for financial loss sustained by a victim,» and the statute specifically lists the costs of correcting credit history, the costs of civil or administrative proceedings needed to satisfy wrongly incurred debts, liens, or judgments, lost wages, and attorney's fees.

Separately, Massachusetts's general Consumer Protection Act, c.93A Section 9, gives a private right of action for an «unfair or deceptive act or practice,» with a guaranteed minimum recovery of actual damages or $25, whichever is greater, 2 to 3 times damages for a willful or knowing violation, and mandatory attorney's fees and costs for a prevailing plaintiff. This is a real, verified statute, but its application to a given identity theft case is fact-dependent: c.93A reaches a business's unfair or deceptive data-handling conduct more directly than it reaches the fraudster's own conduct, which Section 37E's criminal and restitution track already addresses. Anyone considering a c.93A claim tied to identity theft should discuss the specific facts with a Massachusetts-licensed attorney rather than assume the statute automatically applies.

No Massachusetts-Specific Minor Credit Freeze Law

Massachusetts's general security-freeze statute, c.93 Section 62A, applies to «a consumer» with no age threshold and no separate provision for minors or other protected consumers. A full review of Chapter 93's table of contents found no adjacent minor or protected-consumer freeze section. That means Massachusetts residents, including parents trying to freeze a child's credit file before it is ever opened, rely entirely on the federal protected-consumer security freeze right created by 15 U.S.C. Section 1681c-1(j) in 2018, not on any state-specific mechanism. For the practical steps involved in placing a freeze, see our guide to credit freeze vs. fraud alert.

Reporting Identity Theft in Massachusetts

Under Section 37E(f) above, local police in Massachusetts must accept your report and, on request, provide a copy within 24 hours. This page could not independently confirm current contact details, complaint procedures, or hotline information for the Massachusetts Attorney General's consumer protection resources, because every attempted fetch of mass.gov returned a 403 response during research. Rather than repeat unverified information, this page directs Massachusetts residents to the free federal process at IdentityTheft.gov, which does not depend on any state-specific resource, and recommends checking mass.gov directly for the state office's current identity theft page and contact information. See our guide to how to report identity theft for the full federal reporting process.

The Federal Layer

Regardless of state, identity theft is also a federal crime under 18 U.S.C. Section 1028. The Federal Trade Commission's free recovery site, IdentityTheft.gov, walks victims through reporting what happened, building a personal recovery plan, and, with an account, pre-filling the letters most victims need. Once you have an FTC Identity Theft Report, FCRA Section 605B, codified at 15 U.S.C. Section 1681c-2, lets you get fraudulent information blocked from your credit report. Federal law has also required free credit freezes and free fraud alerts at all three credit bureaus since 2018. See our identity theft laws hub for the full federal picture, including the one-year versus seven-year fraud alert distinction.

2025-2026 Legislative Currency

A review of Massachusetts's 2025 Session Laws, covering Acts 1 through 101 as published on the legislature's session-laws page, found no amendment to c.266 Section 37E, c.93 Section 62A or 62B, or c.93H Section 3A. This coverage may not be exhaustive for the full 2025-2026 legislative session, so treat it as the most current information available rather than a guarantee that nothing has changed since.

Information last verified on 2026-08-13, drawn directly from M.G.L. c.266 Section 37E, c.93 Section 62A, c.93H Section 3A, and c.93A Section 9 on malegislature.gov. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.