Michigan Identity Theft Laws: Penalties and Victim Resources

(1) A person shall not do any of the following: (a) With intent to defraud or violate the law, use or attempt to use the personal identifying information of another person to do either of the following: (i) Obtain credit, goods, services, money, property, a vital record, a confidential telephone record, medical records or information, or employment. (ii) Commit another unlawful act. (b) By concealing, withholding, or misrepresenting the person's identity, use or attempt to use the personal identifying information of another person to do either of the following: (i) Obtain credit, goods, services, money, property, a vital record, a confidential telephone record, medical records or information, or employment. (ii) Commit another unlawful act. (2) A person who violates subsection (1)(b)(i) may assert 1 or more of the following as a defense in a civil action or as an affirmative defense in a criminal prosecution, and has the burden of proof on that defense by a preponderance of the evidence: (a) That the person gave a bona fide gift for or for the benefit or control of, or use or consumption by, the person whose personal identifying information was used.

Official text (excerpt) · last checked 2026-09-02 · Read the full text in our law library · Verify at legislature.mi.gov

(1) Subject to subsection (6), a person who violates section 5 or 7 is guilty of a felony punishable as follows: (a) Except as otherwise provided in subdivisions (b) and (c), by imprisonment for not more than 5 years or a fine of not more than $25,000.00, or both. (b) If the violation is a second violation of section 5 or 7, by imprisonment for not more than 10 years or a fine of not more than $50,000.00, or both. (c) If the violation is a third or subsequent violation of section 5 or 7, by imprisonment for not more than 15 years or a fine of not more than $75,000.00, or both. (2) Sections 5 and 7 apply whether an individual who is a victim or intended victim of a violation of 1 of those sections is alive or deceased at the time of the violation. (3) This section does not prohibit a person from being charged with, convicted of, or sentenced for any other violation of law committed by that person using information obtained in violation of this section or any other violation of law committed by that person while violating or attempting to violate this section.

Official text (excerpt) · last checked 2026-07-30 · Read the full text in our law library · Verify at legislature.mi.gov

(1) A person shall not do any of the following: (a) Make any electronic mail or other communication under false pretenses purporting to be by or on behalf of a business, without the authority or approval of the business, and use that electronic mail or other communication to induce, request, or solicit any individual to provide personal identifying information. (b) Create or operate a webpage that represents itself as belonging to or being associated with a business, without the authority or approval of that business, and induces, requests, or solicits any user of the internet to provide personal identifying information. (c) Alter a setting on a user's computer or similar device or software program through which the user may access the internet and cause any user of the internet to view a communication that represents itself as belonging to or being associated with a business, which message has been created or is operated without the authority or approval of that business, and induces, requests, or solicits any user of the internet to provide personal identifying information.

Official text (excerpt) · last checked 2026-07-30 · Read the full text in our law library · Verify at legislature.mi.gov

(1) A person shall not do any of the following in the conduct of trade or commerce: (a) Deny credit or public utility service to or reduce the credit limit of a consumer solely because the consumer was a victim of identity theft, if the person had prior knowledge that the consumer was a victim of identity theft. A consumer is presumed to be a victim of identity theft for the purposes of this subdivision if he or she provides both of the following to the person: (i) A copy of a police report evidencing the claim of the victim of identity theft. (ii) Either a properly completed copy of a standardized affidavit of identity theft developed and made available by the federal trade commission under 15 USC 1681g or an affidavit of fact that is acceptable to the person for that purpose. (b) Solicit to extend credit to a consumer who does not have an existing line of credit, or has not had or applied for a line of credit within the preceding year, through the use of an unsolicited check that includes personal identifying information other than the recipient's name, address, and a partial, encoded, or truncated personal identifying number.

Official text (excerpt) · last checked 2026-07-30 · Read the full text in our law library · Verify at legislature.mi.gov

Also relied on in: Michigan Data Breach Notification Laws: Reporting Rules & Timelines (2026)

(1) Unless the person or agency determines that the security breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to, 1 or more residents of this state, a person or agency that owns or licenses data that are included in a database that discovers a security breach, or receives notice of a security breach under subsection (2), shall provide a notice of the security breach to each resident of this state who meets 1 or more of the following: (a) That resident's unencrypted and unredacted personal information was accessed and acquired by an unauthorized person. (b) That resident's personal information was accessed and acquired in encrypted form by a person with unauthorized access to the encryption key.

Official text (excerpt) · last checked 2026-08-28 · Read the full text in our law library · Verify at legislature.mi.gov

Also relied on in: Michigan Data Privacy Laws: Consumer Rights & Protections (2026), Michigan Biometric Privacy Laws: Collection, Consent & Penalties (2026)

(1) As used in this section only, "victim" means an individual who suffers direct or threatened physical, financial, or emotional harm as a result of the commission of a crime. As used in subsections (2), (3), (6), (8), (9), and (13) only, victim includes a sole proprietorship, partnership, corporation, association, governmental entity, or any other legal entity that suffers direct physical or financial harm as a result of a crime. (2) Except as provided in subsection (8), when sentencing a defendant convicted of a crime, the court shall order, in addition to or in lieu of any other penalty authorized by law or in addition to any other penalty required by law, that the defendant make full restitution to any victim of the defendant's course of conduct that gives rise to the conviction or to the victim's estate. For an offense that is resolved by assignment of the defendant to youthful trainee status, by a delayed sentence or deferred judgment of guilt, or in another way that is not an acquittal or unconditional dismissal, the court shall order the restitution required under this section.

Official text (excerpt) · last checked 2026-07-30 · Read the full text in our law library · Verify at legislature.mi.gov

(1) A consumer reporting agency shall place a security freeze on a protected consumer's credit report if all of the following are met: (a) The consumer reporting agency receives a request from the representative of the protected consumer for the placement of the security freeze. (b) The protected consumer's representative does all of the following: (i) Submits the request to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency. (ii) Provides to the consumer reporting agency sufficient proof of identification for the protected consumer and the representative. (iii) Provides to the consumer reporting agency his or her sufficient proof of authority. (2) If a consumer reporting agency does not have a file pertaining to a protected consumer when the consumer reporting agency receives a request under subsection (1), the consumer reporting agency shall create a record for the protected consumer. (3) Within 30 days after receiving a request that meets the requirements of subsection (1), a consumer reporting agency shall place a security freeze for the protected consumer.

Official text (excerpt) · last checked 2026-07-30 · Read the full text in our law library · Verify at legislature.mi.gov

(1) A consumer reporting agency shall place a security freeze on a consumer's credit report if all of the following are met: (a) The consumer reporting agency receives a request from the consumer for the placement of the security freeze under this act. (b) The consumer does all of the following: (i) Submits the request described in subdivision (a) to the consumer reporting agency at the address or other point of contact and in the manner specified by the consumer reporting agency. (ii) Provides to the consumer reporting agency sufficient proof of identification of the consumer. (2) Within 5 business days after receiving a request that meets the requirements of subsection (1), a consumer reporting agency shall place a security freeze for the consumer.

Official text (excerpt) · last checked 2026-07-30 · Read the full text in our law library · Verify at legislature.mi.gov

As used in this act: (a) "Agency" means a department, board, commission, office, agency, authority, or other unit of state government of this state. The term includes an institution of higher education of this state. The term does not include a circuit, probate, district, or municipal court. (b) "Breach of the security of a database" or "security breach" means the unauthorized access and acquisition of data that compromises the security or confidentiality of personal information maintained by a person or agency as part of a database of personal information regarding multiple individuals. These terms do not include unauthorized access to data by an employee or other individual if the access meets all of the following: (i) The employee or other individual acted in good faith in accessing the data. (ii) The access was related to the activities of the agency or person. (iii) The employee or other individual did not misuse any personal information or disclose any personal information to an unauthorized person. (c) "Child or spousal support" means support for a child or spouse, paid or provided pursuant to state or federal law under a court order or judgment.

Official text (excerpt) · last checked 2026-07-30 · Read the full text in our law library · Verify at legislature.mi.gov

This act shall be known and may be cited as the "identity theft protection act".

Official text (excerpt) · last checked 2026-07-30 · Read the full text in our law library · Verify at legislature.mi.gov

As used in this act: (a) "Consumer" means an individual who resides in this state. (b) "Consumer reporting agency" means any person that, for monetary fees or dues or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing credit reports to third parties and that uses any means or facility of interstate commerce for the purpose of preparing or furnishing credit reports. (c) "Credit report" means any written, oral, or other communication of any information by a consumer reporting agency that is related to a consumer's creditworthiness, credit standing, or credit capacity, and is issued or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for credit. (d) "File" means all of the information about a consumer that is recorded and retained by a consumer reporting agency regardless of how the information is stored.

Official text (excerpt) · last checked 2026-07-30 · Read the full text in our law library · Verify at legislature.mi.gov

Whoever, in a circumstance described in subsection (c) of this section— knowingly and without lawful authority produces an identification document, authentication feature, or a false identification document; knowingly transfers an identification document, authentication feature, or a false identification document knowing that such document or feature was stolen or produced without lawful authority; knowingly possesses with intent to use unlawfully or transfer unlawfully five or more identification documents (other than those issued lawfully for the use of the possessor), authentication features, or false identification documents; knowingly possesses an identification document (other than one issued lawfully for the use of the possessor), authentication feature, or a false identification document, with the intent such document or feature be used to defraud the United States; knowingly produces, transfers, or possesses a document-making implement or authentication feature with the intent such document-making implement or authentication feature will be used in the production of a false identification document or another document-making implement or authentication feature which will…

Official text (excerpt) · last checked 2026-09-16 · Read the full text in our law library · Verify at uscode.house.gov

Also relied on in: Identity Theft Laws: Federal Rules and State Penalties, Indiana Identity Theft Laws, Phishing, Smishing and Vishing: Spot Them and What to Do If You Clicked