Maryland Identity Theft Laws

Maryland's identity fraud statute tiers penalties by dollar value up to 20 years in prison, requires local police to prepare a report on request, and runs its own Identity Theft Passport program, though acceptance of that passport by any given police department or creditor is entirely at their discretion. A 2026 amendment adds new AI and deepfake-specific identity fraud provisions, but it does not take effect until October 1, 2026.

This page covers Maryland's identity fraud statute and penalty tiers, the mandatory police report right, the Identity Theft Passport program, Maryland's broad protected-consumer freeze law, and the upcoming AI/deepfake amendment. For the federal rights that apply everywhere, see our identity theft laws hub.

Maryland's Identity Fraud Statute and Penalty Tiers

Md. Code, Criminal Law § 8-301, titled Identity Fraud, prohibits knowingly, willfully, and with fraudulent intent obtaining another person's personal identifying information without consent to use it, or to help someone else use it, to obtain a benefit, credit, good, service, or other thing of value, or to access health-related information. It separately prohibits assuming another person's identity with fraudulent intent, and unauthorized use of skimming devices or re-encoders.

The penalty structure, confirmed directly against subsection (g), is tiered by the dollar value involved. At $100 up to just under $1,500, it is a misdemeanor carrying up to 1 year and up to a $500 fine. From $1,500 up to just under $25,000, up to 5 years and up to a $10,000 fine. From $25,000 up to just under $100,000, up to 10 years and up to a $15,000 fine. At $100,000 or more, up to 20 years and up to a $25,000 fine. A separate provision penalizes manufacturing or distributing another person's identifying information at up to 10 years and a $25,000 fine.

Beyond the general restitution available under Maryland's Criminal Procedure Title 11, Subtitle 6, subsection (i) of § 8-301 authorizes a court to order restitution for reasonable costs, including attorney's fees, to clear the victim's credit history, clear health-information or health-care records, or resolve a debt, lien, judgment, or other obligation that arose from the violation, a more specific and often more useful remedy than general restitution alone.

Maryland's Mandatory Police Report Right

Maryland gives identity fraud victims a mandatory police report right similar to Maine's. Under Criminal Law § 8-304, a local law enforcement agency with jurisdiction, either where the victim resides or where the crime occurred, must promptly prepare and file a report, and give the victim a copy, when contacted by someone who reasonably suspects they are an identity fraud victim. The statute specifically notes that the report does not have to be counted as an «open case» for the agency's case-statistics purposes, which removes a disincentive an agency might otherwise have for taking the report at all.

Maryland's Identity Theft Passport Program

Criminal Law § 8-305 creates the Identity Theft Passport program. A victim who has filed a § 8-304 police report may apply through law enforcement, and the Attorney General issues the card or certificate only after running a background check on the applicant. The statute contains an important caveat confirmed directly in the text: acceptance is entirely discretionary. «A law enforcement agency or creditor that is presented with an identity theft passport... has sole discretion to accept or reject» it. There is no mandatory-acceptance requirement, so a passport is a helpful tool for a victim to present, not a guarantee that a specific agency or creditor will honor it. The passport application itself is confidential and is not a public record.

Maryland's Protected-Consumer Credit Freeze Law

Maryland's protected-consumer freeze statute, Commercial Law § 14-1212.2, covers a notably broader set of people than the federal baseline. A «protected consumer» under this statute is: an individual under age 16; an incapacitated person or someone under guardianship or conservatorship; a person age 85 or older; an eligible service member; or an incarcerated person in a state correctional facility. The federal baseline (15 U.S.C. § 1681c-1(j)) reaches only minors and incapacitated adults, so Maryland's own statute independently extends free freeze protection to elderly, military, and incarcerated Marylanders as well. No fee may be charged for any service under the section, and agencies must place the freeze within 30 days of a complete request from an authorized representative.

Reporting Identity Theft to the Maryland Attorney General

The Office of the Attorney General's Consumer Protection Division runs a dedicated Identity Theft Unit that gives victims step-by-step recovery guidance: identifying what happened, disputing fraudulent accounts, filing police and federal reports, and submitting dispute documentation. The unit also helps with creditors and collection agencies and administers the Identity Theft Passport described above. Contact the unit by phone at (410) 576-6491, by email at idtheft@oag.state.md.us, by fax at (410) 576-6566, or by mail at 200 St. Paul Place, 25th Floor, Baltimore, MD 21202. The page also points victims to the federal IdentityTheft.gov and to the FBI's IC3.gov for internet-crime complaints.

Maryland's breach-notification statute, Commercial Law § 14-3504, requires a business to notify affected Maryland residents as soon as reasonably practicable, and no later than 45 days, after discovering a breach; the business must also notify the Maryland Attorney General before notifying consumers, and the consumer notice itself must include contact information for the consumer reporting agencies, the FTC, and the Maryland Attorney General's identity theft resources.

The 2026 AI and Deepfake Amendment (Not Yet in Force)

Maryland's 2026 legislative session produced Senate Bill 8, enacted as Chapter 445 and approved by the Governor on May 12, 2026. It amends § 8-301 to define «artificial intelligence» by reference to the State Finance and Procurement Article, to define a «deepfake representation» as an image, video, or audio recording indistinguishable from an actual and identifiable human being, and to define «harm» as physical injury, serious emotional distress, or economic damages.

The core new prohibition is subsection (f)(2). It bars knowingly, willfully, and with fraudulent intent using artificial intelligence or a deepfake representation either to cause harm to someone by impersonating, falsely depicting, or claiming to represent that person or anyone else, or to create or distribute false records intending to cause harm, induce someone to hand over personal identifying information, or obtain a benefit, credit, good, service, or other thing of value. A separate new subsection (b-2) bars using another person's identifying information, without consent, with fraudulent intent to cause harm.

The enrolled chapter text sets the penalties for violating subsection (f)(2) directly. Where one victim is involved, it is a felony carrying imprisonment of up to 5 years or a fine of up to $10,000 or both. Where two or more victims are involved, it is a felony carrying up to 10 years or a fine of up to $15,000 or both.

The amendment also creates a private right of action, and its scope is narrow and specific. New subsection (h) lets a person who is the victim of an act that would constitute a violation of subsection (f)(2) bring a civil action, in a court of competent jurisdiction, against the person or persons who committed the act. The court may issue an injunction to prevent or restrain the act and may grant any other appropriate relief. Two limits are worth noting: the civil action attaches only to the new AI and deepfake conduct in subsection (f)(2), not to identity fraud under § 8-301 generally, and because the statute reaches an act that «would constitute» a violation, it does not on its face require a criminal conviction first. Most importantly for anyone reading this today: the amendment does not take effect until October 1, 2026, so it is not yet part of Maryland law.

The Federal Layer

Maryland's own protections sit alongside the federal baseline available to every state. Since 2018, federal law has required free credit freezes and free freeze removals nationwide, a right Maryland's own statute already extends to a broader group. A fraud alert placed with one credit bureau is shared with the other two, lasts one year by default, and extends to seven years once you have filed an FTC Identity Theft Report. Under FCRA § 605B (15 U.S.C. § 1681c-2), a victim with an identity theft report can get specific fraudulent information blocked from a credit report. IdentityTheft.gov, the FTC's free recovery site, builds a personalized recovery plan and, for account holders, pre-fills the letters and forms most victims need. See our guide to reporting identity theft and our comparison of credit freezes versus fraud alerts for more.

If You Are a Victim of Identity Theft in Maryland

Contact local law enforcement and request your police report; a Maryland agency must promptly prepare one for you under § 8-304. Contact the Attorney General's Identity Theft Unit at (410) 576-6491 or idtheft@oag.state.md.us for recovery guidance and to ask about the Identity Theft Passport, keeping in mind that acceptance of the passport is discretionary for any individual agency or creditor. Report to the FTC through IdentityTheft.gov, and place a freeze with all three major credit bureaus, which Maryland's own law extends for free to minors, incapacitated adults, people 85 or older, eligible service members, and incarcerated Marylanders alike.

Information last verified on 2026-09-02, drawn directly from Md. Code, Criminal Law §§ 8-301, 8-304, and 8-305, Commercial Law §§ 14-1212.2 and 14-3504, the enrolled text of 2026 Chapter 445 (Senate Bill 8), and the Maryland Attorney General's identity theft page. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert
• Child Identity Theft: Warning Signs, Credit Checks, and the Minor Freeze Right

---

Last updated: 2026-09-02.