Michigan Identity Theft Laws: Penalties and Victim Resources

This page covers identity theft law in Michigan under the Identity Theft Protection Act, Act 452 of 2004 (MCL 445.61 through 445.79d), plus the state's restitution rules, its narrow civil-action provision, and the Attorney General's Michigan Identity Theft Support program. It does not cover federal identity theft law in depth; for that layer, see our identity theft laws hub and our guide to reporting identity theft.

Michigan's Identity Theft Protection Act

Michigan's Identity Theft Protection Act, Act 452 of 2004, prohibits identity theft in two overlapping ways under MCL 445.65. First, with intent to defraud or violate the law, using or attempting to use another person's personal identifying information to obtain credit, goods, services, money, property, vital records, telephone records, medical records, or employment, or to commit any other unlawful act. Second, doing the same thing by concealing, withholding, or misrepresenting the person's identity. Four affirmative defenses apply specifically to the second category: bona fide gifts, lawful pursuit of legal rights, authorization by law or court order, and consent when not for an unlawful purpose.

MCL 445.69 makes a violation of either prohibited category a felony, with penalties that escalate by conviction count rather than by dollar value. A first offense carries up to 5 years imprisonment and a fine of up to $25,000. A second offense carries up to 10 years and up to $50,000. A third or subsequent offense carries up to 15 years and up to $75,000. Courts may order a sentence to run consecutively to a sentence for any other crime committed using the same stolen identity information, meaning the prison terms stack rather than run at the same time.

Restitution and the Limits of Civil Recovery

The Identity Theft Protection Act itself contains no restitution provision. MCL 445.69 provides only the felony penalty tiers and consecutive-sentencing authority. Restitution instead comes from Michigan's general Crime Victim's Rights Act, MCL 780.766, which mandates full restitution for any felony conviction, including one under the Identity Theft Protection Act: the court shall order that the defendant make full restitution to any victim.

Civil recovery is narrower than in some states. The Act does not create a broad private lawsuit right for a typical identity theft victim against the person who stole their identity. MCL 445.71 and 445.72 each preserve, rather than create, «any civil remedy» available under the Michigan Consumer Protection Act or other law. The one explicit civil-action provision in the Act, MCL 445.67a(3), lets the Attorney General or a harmed internet service provider sue over phishing or spoofing violations for actual damages plus attorney fees, or statutory damages of up to $5,000 per violation or $250,000 per day. That right reaches internet service providers and the state, not the ordinary identity theft victim suing their thief directly.

No Michigan-Specific Minor Credit Freeze Law

A full review of the Identity Theft Protection Act's section index, MCL 445.61 through 445.79d, found no section addressing credit freezes at all, for minors or adults. The Act's 24 defined terms in MCL 445.63 include no definition for «protected consumer,» «minor,» or «security freeze.» That means Michigan residents, including parents of minors, rely entirely on the federal protected-consumer security freeze right under 15 U.S.C. Section 1681c-1(j), in place since 2018. The Attorney General's own identity-theft recovery guidance directs victims to the federal and credit-bureau fraud-alert system rather than to any state freeze statute. See our guide to credit freeze vs. fraud alert for how that federal right works in practice.

Data Breach Notification

MCL 445.72 requires Michigan residents to be notified «without unreasonable delay» of a security breach involving their personal information. This notification duty runs against the business that experienced the breach and is separate from the Identity Theft Protection Act's criminal provisions, but it is often the first sign a Michigan resident has that their information may have been misused.

Michigan Identity Theft Support (MITS)

The Michigan Department of Attorney General runs Michigan Identity Theft Support (MITS), the state's dedicated assistance program. Residents complete a «Request for Identity Theft Assistance» web form, and MITS staff follow up «if they can be of service.» The program is explicit about its limits: «MITS cannot provide personal legal representation.» A companion «What to Do if Your Identity is Stolen» page lays out a six-step plan: confirm the warning signs, identify what was compromised, contact affected financial institutions, check your credit reports and freeze your credit if needed, file an FTC IdentityTheft.gov report or a police report, and then use the MITS form for further help. The page also flags the federal $50 cap under the Electronic Fund Transfer Act on unauthorized ATM or debit card charges, if reported within 60 days. The Consumer Protection division can also be reached at 517-335-7599, or toll-free at 877-765-8388, or by mail at P.O. Box 30213, Lansing, MI 48909.

2025-2026 Legislative Currency: SB 360-364

Senate Bills 360 through 364, introduced in the 2025-2026 legislative session, would substantially rewrite the Identity Theft Protection Act's data-security and breach-notification framework. The package would mandate security procedures and a designated «security coordinator,» create a safe harbor for entities that conform to a recognized cybersecurity framework, add enhanced breach-notice content requirements, require Attorney General notification for breaches affecting 100 or more residents, and impose civil fines ranging from $250 up to $750,000. The package passed the Senate 19 to 15 on August 26, 2025, and as of this page's last verification remains pending in the House Government Operations Committee, meaning it is not yet law and carries no Public Act number. No minor or protected-consumer freeze provision appears anywhere in the bill.

The Federal Layer

Regardless of state, identity theft is also a federal crime under 18 U.S.C. Section 1028. The Federal Trade Commission's free recovery site, IdentityTheft.gov, walks victims through reporting what happened and building a personal recovery plan. Federal law has also required free credit freezes and free fraud alerts at all three credit bureaus since 2018, and FCRA Section 605B lets a victim with an FTC Identity Theft Report get fraudulent information blocked from their credit report. See our identity theft laws hub for the complete federal picture.

Information last verified on 2026-08-13, drawn directly from MCL 445.65, 445.69, 445.72, 445.67a, and 780.766 on legislature.mi.gov, and the Michigan Identity Theft Support program page. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.