Massachusetts Identity Theft Laws: Penalties and Victim Rights

This page covers identity theft and identity fraud law in Massachusetts under M.G.L. c.266, Section 37E, plus the state's credit-freeze, breach-notification, and consumer-protection statutes that apply once someone has misused your identifying information. It does not cover federal identity theft law in depth; for that layer, see our identity theft laws hub and our guide to reporting identity theft.

Massachusetts's Identity Fraud Statute

M.G.L. c.266, Section 37E, «Use of personal identification of another; identity fraud; penalty; restitution,» defines «personal identifying information» as any name or number usable, alone or with other information, to assume an individual's identity. The statute prohibits three overlapping categories of conduct, and each carries a mens rea element that the prosecution must prove. Subsection (b) reaches a person who, «with intent to defraud,» poses as another without that person's express authorization and uses their identifying information to obtain or attempt to obtain money, credit, goods, services, anything of value, an identification card or other evidence of identity, «or to harass another.» Subsection (c) reaches obtaining another person's identifying information without express authorization, again «with intent to defraud,» either intending to pose as that person or to assist someone else in posing, for those same purposes or to harass. Subsection (c1/2) reaches possessing a tool or instrument adapted, designed, or commonly used for accessing another person's account numbers, codes, passwords, or unique biometric data «under circumstances evincing an intent to use or knowledge that some person intends to use the same in the commission of larceny.»

Two elements matter when reading Section 37E against a real set of facts. Intent to defraud is an element of both (b) and (c), so unauthorized use of someone's information without that intent does not fit either subsection. And «harass» is a defined term rather than an everyday one: subsection (a) limits it to willfully and maliciously engaging in an act directed at a specific person that seriously alarms or annoys them and would cause a reasonable person to suffer substantial emotional distress. Because harassment is listed as an alternative prohibited purpose, the statute reaches identity misuse aimed at tormenting someone, not only misuse aimed at financial gain.

Unlike many states, Massachusetts does not tier this penalty by the dollar value obtained or by repeat offense. All three prohibited categories carry the identical maximum penalty: a fine of not more than $5,000 or imprisonment in a house of correction for not more than two and one-half years, or both. Section 37E(e) separately authorizes a warrantless arrest on probable cause of a violation, giving police the ability to act immediately rather than waiting to obtain a warrant.

Your Right to a Police Report Within 24 Hours

Section 37E(f) gives Massachusetts identity fraud victims a specific, enforceable right that many states leave discretionary: a law enforcement officer must accept the victim's incident report and, if the victim requests it, provide a copy within 24 hours. The report can be filed in any of four qualifying counties: where the victim resides, where the identifying information was stored or used, where the responsible business operates, or where the underlying breach occurred. This flexibility matters in practice, since identity fraud frequently crosses county lines between where a victim lives and where the fraud was actually committed.

Restitution and the Consumer Protection Act

Restitution to an identity fraud victim in Massachusetts is mandatory, not left to the sentencing judge's discretion. Section 37E(d) states that a person found guilty «shall, in addition to any other punishment, be ordered to make restitution for financial loss sustained by a victim,» and the statute specifically lists the costs of correcting credit history, the costs of civil or administrative proceedings needed to satisfy wrongly incurred debts, liens, or judgments, lost wages, and attorney's fees.

Separately, Massachusetts's general Consumer Protection Act, c.93A Section 9, gives a private right of action for an «unfair or deceptive act or practice,» with a guaranteed minimum recovery of actual damages or $25, whichever is greater, 2 to 3 times damages for a willful or knowing violation, and mandatory attorney's fees and costs for a prevailing plaintiff. This is a real, verified statute, but its application to a given identity theft case is fact-dependent: c.93A reaches a business's unfair or deceptive data-handling conduct more directly than it reaches the fraudster's own conduct, which Section 37E's criminal and restitution track already addresses. Anyone considering a c.93A claim tied to identity theft should discuss the specific facts with a Massachusetts-licensed attorney rather than assume the statute automatically applies.

No Massachusetts-Specific Minor Credit Freeze Law

Massachusetts's general security-freeze statute, c.93 Section 62A, applies to «a consumer» with no age threshold and no separate provision for minors or other protected consumers. A full review of Chapter 93's table of contents found no adjacent minor or protected-consumer freeze section. That means Massachusetts residents, including parents trying to freeze a child's credit file before it is ever opened, rely entirely on the federal protected-consumer security freeze right created by 15 U.S.C. Section 1681c-1(j) in 2018, not on any state-specific mechanism. For the practical steps involved in placing a freeze, see our guide to credit freeze vs. fraud alert.

Reporting Identity Theft in Massachusetts

Under Section 37E(f) above, local police in Massachusetts must accept your report and, on request, provide a copy within 24 hours. This page could not independently confirm current contact details, complaint procedures, or hotline information for the Massachusetts Attorney General's consumer protection resources, because every attempted fetch of mass.gov returned a 403 response during research. Rather than repeat unverified information, this page directs Massachusetts residents to the free federal process at IdentityTheft.gov, which does not depend on any state-specific resource, and recommends checking mass.gov directly for the state office's current identity theft page and contact information. See our guide to how to report identity theft for the full federal reporting process.

The Federal Layer

Regardless of state, identity theft is also a federal crime under 18 U.S.C. Section 1028. The Federal Trade Commission's free recovery site, IdentityTheft.gov, walks victims through reporting what happened, building a personal recovery plan, and, with an account, pre-filling the letters most victims need. Once you have an FTC Identity Theft Report, FCRA Section 605B, codified at 15 U.S.C. Section 1681c-2, lets you get fraudulent information blocked from your credit report. Federal law has also required free credit freezes and free fraud alerts at all three credit bureaus since 2018. See our identity theft laws hub for the full federal picture, including the one-year versus seven-year fraud alert distinction.

2025-2026 Legislative Currency

A review of Massachusetts's 2025 Session Laws, covering Acts 1 through 101 as published on the legislature's session-laws page, found no amendment to c.266 Section 37E, c.93 Section 62A or 62B, or c.93H Section 3A. This coverage may not be exhaustive for the full 2025-2026 legislative session, so treat it as the most current information available rather than a guarantee that nothing has changed since.

Information last verified on 2026-08-13, drawn directly from M.G.L. c.266 Section 37E, c.93 Section 62A, c.93H Section 3A, and c.93A Section 9 on malegislature.gov. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.