Maryland Scam and Fraud Laws: Where to Report, Your Right to Sue (2026)

Maryland's Consumer Protection Act lets any person sue to recover for an injury or loss caused by a practice the Act prohibits, and if you are awarded damages the court may also award reasonable attorney's fees. The Act does not provide triple damages or a set minimum award. It targets unfair, abusive or deceptive practices in consumer transactions, such as selling consumer goods or services, extending consumer credit and collecting consumer debts, so not every scam fits it.

Two newer Maryland laws matter to scam victims and their families. Since October 1, 2026, a bank or credit union may delay a payment out of the account of a Maryland customer who is 65 or older, or a vulnerable adult, when it reasonably believes the payment may be financial exploitation. And Maryland caps how much a person can put through crypto ATMs in a day and requires the operator to refund its fee, though not the money sent, on a transaction verified as fraudulent. The Attorney General's Consumer Protection Division mediates complaints against businesses, but it cannot force a business to cooperate.

Information last verified on October 2, 2026. This article has not been reviewed by a licensed lawyer.

Jurisdiction scope: This guide covers Maryland state law: the Maryland Consumer Protection Act (Commercial Law Title 13), Maryland complaint offices, Maryland protections for older and vulnerable adults, Maryland's crypto ATM (virtual currency kiosk) law, door-to-door and telephone sales rules, and Maryland court deadlines and small claims. Federal refund and reporting rights are summarized briefly and covered in depth on our national guides. Out of scope: criminal defense, and the law of other states (if the scammer or business is elsewhere, that state's law may also matter).

First steps if you were scammed in Maryland

Call the bank, card issuer, payment app, wire company or crypto exchange that moved your money right away. That company is usually the only one that can stop or reverse a payment, and your federal rights depend on how you paid. Our guide on how to get money back after a scam walks through each payment method, the Zelle and payment app guide covers app transfers, and what to do if your bank refused a scam refund covers the next step after a denial.

Then report the scam. Most scams go to the FTC at ReportFraud.ftc.gov and online crime to the FBI's IC3; our where to report a scam guide lists every federal channel. The Maryland offices below are in addition to those, not instead of them.

Where to report a scam in Maryland

You can also mail a consumer complaint to the Office of the Attorney General, Consumer Protection Division, 200 St. Paul Place, 16th Floor, Baltimore, MD 21202, or email it to mediator@oag.maryland.gov. The Division suggests calling 410-528-8662 before you file to make sure you are contacting the right agency.

Be realistic about what a complaint does. The Division says: "we cannot force a business to cooperate with our mediation efforts, and we are not authorized to provide legal advice or serve as private attorneys on individual cases." Mediation can work against a real business that wants to keep its reputation. It does little against an anonymous scammer, which is why the payment company comes first.

Maryland's consumer protection law: can you sue?

Yes, if your loss came from a practice the Act prohibits. Section 13-408(b) of the Commercial Law Article gives the private right to sue:

"any person may bring an action to recover for injury or loss sustained by him as the result of a practice prohibited by this title."

"Person" is broad: under section 13-101(h) it includes an individual as well as a business or other entity. The limit is the second half of the sentence. The practice that caused your loss has to be one the Act prohibits, and section 13-303 bars unfair, abusive or deceptive trade practices in a defined list of transactions, including:

1. The sale, lease, rental, loan or bailment of consumer goods, consumer realty or consumer services, and offers to sell them.
2. The extension of consumer credit.
3. The collection of consumer debts.
4. A purchase, or offer to purchase, of consumer goods or consumer realty from a consumer by a merchant whose business includes paying off consumer debt in connection with the purchase.

A deceptive practice includes a "False, falsely disparaging, or misleading oral or written statement, visual description, or other representation of any kind which has the capacity, tendency, or effect of deceiving or misleading consumers," and a "Failure to state a material fact if the failure deceives or tends to deceive" (section 13-301(1) and (3)). Section 13-105 says the Act is to be "construed and applied liberally," with due weight given to interpretations of the Federal Trade Commission Act.

Does it cover your scam?

A seller who lied to get you to buy goods or services, a fake repair or home-improvement job, or a misleading credit offer fits the transactions listed in section 13-303. A scam where you bought nothing, such as a romance scam, an impostor who asked you to move money, or a fake investment, is harder to place in that list. We have not verified how Maryland courts apply the Act to those scams, so this page does not say either way. A Maryland lawyer can tell you whether your facts fit.

Some services are excluded from the Act entirely. Section 13-104 lists, among others, the professional services of lawyers, accountants, architects, engineers, clergy, veterinarians, and medical and dental practitioners, as well as authorized insurance companies and producers, real estate brokers, public service companies to the extent the Public Service Commission regulates them, and media outlets that only carry someone else's ads. Section 13-408(e) separately bars a private suit over the professional services of a health care provider.

What you can recover

The remedy is recovery "for injury or loss sustained." Section 13-408 contains no provision for triple damages, a statutory minimum award or punitive damages. If you read elsewhere that the Maryland act multiplies damages or sets a minimum award, check the statute text: section 13-408 says nothing of the kind.

Attorney's fees are possible but not automatic. Section 13-408(c):

"Any person who brings an action to recover for injury or loss under this section and who is awarded damages may also seek, and the court may award, reasonable attorney's fees."

Two conditions follow from those words: you must be awarded damages, and the award of fees is up to the court. The risk can also run the other way. Under section 13-408(d), the court may order fees paid to the other side if an action is "brought in bad faith or is of a frivolous nature."

Notice and deadline

The text of section 13-408 contains no requirement to send the business a notice or demand before you sue. It also sets no filing deadline of its own. Maryland's general rule, Courts and Judicial Proceedings section 5-101, is that "A civil action at law shall be filed within three years from the date it accrues unless another provision of the Code provides a different period." Because the deadline can decide a case, confirm with a Maryland lawyer which period applies to your claim and when it started.

Penalties the state collects

The Attorney General enforces the Act separately. A merchant who violates it is subject to a fine of up to $10,000 for each violation, and up to $25,000 for a repeat violation (section 13-410), and a violation is also a misdemeanor punishable by a fine of up to $1,000, up to one year in prison, or both (section 13-411). Those are penalties paid to the state, not money a victim receives. Section 13-408(b) keeps your private suit available "In addition to any action by the Division or Attorney General."

The honest limit

A lawsuit needs a defendant you can identify, serve and collect from. That often works against a Maryland business, contractor or seller with a real address. It usually does not work against an anonymous scammer who called from a spoofed number or disappeared with crypto, and a judgment does not help if nobody can be found to pay it.

Protections for older adults in Maryland

Exploiting a vulnerable or older adult is a crime

Criminal Law section 8-801(b) says a person "may not knowingly and willfully obtain by deception, intimidation, or undue influence the property of an individual that the person knows or reasonably should know is a vulnerable adult with intent to deprive" the individual of the property, and applies the same rule to an individual who is "at least 68 years old." The statute does not require a position of trust, so it reaches a stranger who scams an older person as well as a relative or caregiver. A vulnerable adult under Criminal Law section 3-604 is, in general, an adult who lacks the physical or mental capacity to provide for their daily needs.

The penalty depends on the value taken:

A person convicted "shall restore the property taken or its value" to the victim. Section 8-801(g) also makes a violation an unfair, abusive or deceptive trade practice under Title 13 of the Commercial Law Article and subjects it to that Title's enforcement and penalty provisions.

Banks must report suspected abuse

Under Financial Institutions section 1-306(d), a bank or other fiduciary institution "shall make an abuse report" when an employee who deals with an elder adult (a Maryland resident 65 or older) or reviews the elder adult's transactions comes to know or have reasonable cause to suspect that the elder adult is a victim of financial abuse. The report goes by phone within 24 hours and in writing within 3 business days to Adult Protective Services, local law enforcement or the State's Attorney. That section is a reporting duty only; it does not itself authorize a hold.

Banks may now delay a suspicious payment

A newer law fills that gap. Chapter 511 of 2026 (Senate Bill 753, the Vulnerable Adult Banking Protection Act) added Financial Institutions section 1-307, which took effect on October 1, 2026. It covers an "eligible adult," meaning a Maryland resident who is at least 65 or who is a vulnerable adult. The operative words:

"A FIDUCIARY INSTITUTION MAY DELAY OR DENY A DISBURSEMENT FROM AN ACCOUNT OF AN ELIGIBLE ADULT ... IF: (I) THE FIDUCIARY INSTITUTION REASONABLY BELIEVES THAT THE REQUESTED DISBURSEMENT MAY RESULT IN THE FINANCIAL EXPLOITATION OF THE ELIGIBLE ADULT; AND (II) WITHIN 4 BUSINESS DAYS ... [it] SENDS WRITTEN NOTICE ... AND NOTIFIES THE ADULT PROTECTIVE SERVICES PROGRAM ..., A LAW ENFORCEMENT AGENCY, OR A STATE'S ATTORNEY."

How the delay works:

1. It ends when the institution determines there is no exploitation, or 15 business days after the institution receives the disbursement request.
2. It can be extended to up to 25 business days, at the request of Adult Protective Services, law enforcement or a State's Attorney, or by the institution itself.
3. Adult Protective Services, the agency, a State's Attorney or a court may issue an order that ends or extends the delay.
4. The institution may notify the adult's trusted contact, such as a close family member, a person authorized on the account or someone the adult named, unless it suspects that person of the exploitation.

The key word is "may." The law permits a bank or credit union to delay a payment; it does not require one. If you are worried about a parent who is about to send money, tell the bank or credit union directly that you suspect a scam, and consider naming a trusted contact on the account.

Reporting to Adult Protective Services

Under Family Law section 14-302(c), anyone other than a health practitioner, human service worker or police officer who has reason to believe a vulnerable adult has been subjected to "abuse, neglect, self-neglect, or exploitation may file with the local department an oral or written report." Contact your county's local department of social services. For fraud against anyone 60 or older, the federal DOJ National Elder Fraud Hotline (833-372-8311) can also help you report; see our elder fraud guide.

Maryland scam laws on the books

Crypto ATMs (virtual currency kiosks)

Maryland regulates crypto ATMs in Financial Institutions sections 12-1201 through 12-1208, enacted in 2025. Scammers who pose as the government, a bank or a relative often push victims to feed cash into these machines; our government impersonation scams guide and crypto and investment scams guide explain how. The core rules:

• Registration. Since January 1, 2026, an operator must register each kiosk with the Commissioner of Financial Regulation before operating it in Maryland (section 12-1203(a)).
• Daily limits. Section 12-1204(a) caps transactions per day at $2,000 for a new user and $10,500 for an experienced user. A new user is someone transacting with that kiosk operator for the first time, or in the 72 hours after their first transaction with that operator.
• Fee cap. An operator may not charge a fee greater than $5 or 15 percent of the transaction, whichever is greater (section 12-1204(b)).
• Fee refund, not a money refund. The operator "Shall refund any fee imposed on a transaction that is verified as fraudulent in a manner established by the Commissioner through regulation." That is the fee only. The statute does not require the operator to return the money you put into the machine.
• ID and receipt. The operator collects your name, date of birth, address, email, phone and a copy of a government ID, and gives a receipt that includes a toll-free support number (section 12-1204(c) and (d)).
• A scam warning on screen. Section 12-1205(b)(3) requires this disclosure, which the user must acknowledge:

"WARNING: losses due to fraudulent or accidental virtual currency transactions may not be recoverable and transactions in virtual currency are irreversible. Virtual currency transactions may be used by scammers impersonating loved ones, threatening jail time, and insisting you withdraw money from your bank account to purchase virtual currency."

• Live help. Operators must offer live customer support by toll-free phone "Monday through Friday between 8 a.m. and 6 p.m." (section 12-1206).
• Penalties. A civil penalty of up to $1,000 applies to each knowing and willful violation, and each day counts as a separate violation (section 12-1208(b)(2)). That penalty is not paid to the victim.

Amendments in Chapter 417 of 2026 (Senate Bill 741) took effect on October 1, 2026. They extend the definition of a kiosk operator to "A PERSON WHO INSTALLS OR OPERATES SOFTWARE THAT ENABLES A STAND-ALONE AUTOMATED DEVICE TO PROVIDE VIRTUAL CURRENCY SERVICES IN THE STATE," and they do not change the daily limits, the fee cap or the fee refund.

If a kiosk let you go over a daily limit or charged more than the cap, report it to the Office of Financial Regulation, and contact the operator's support line and your bank right away.

Door-to-door sales: three business days to cancel

Under Commercial Law section 14-302, a door-to-door seller must give you the contract and a notice that you "may cancel this transaction at any time prior to midnight of the third business day after the date of this transaction." Section 14-304 makes a seller who violates the law "liable to the person affected by the violation for all damages proximately caused by the violation and for reasonable attorney fees incurred by the person damaged."

Telephone sales: no charge before you send the contract

Under the Maryland Telephone Solicitations Act, "A merchant engaging in a telephone solicitation may not make or submit any charge to the consumer's credit account until after the merchant receives from the consumer a copy of the contract which complies with this subtitle" (Commercial Law section 14-2204). Section 14-2202 exempts some sales, including sales to existing customers and sales with a full refund within 7 days, so check the exemptions before relying on this rule.

Suing a scammer or a business in Maryland

Small claims. Under Courts and Judicial Proceedings section 4-405, the District Court has exclusive jurisdiction over a small claim action, "a civil action for money in which the amount claimed does not exceed $5,000 exclusive of interest, costs, and attorney's fees, if attorney's fees are recoverable by law or contract." That is the usual place for a modest claim against a business or person you can identify and serve.

Deadlines. The general deadline for a civil action is three years (section 5-101). For fraud, section 5-203 delays the start of the clock: "If the knowledge of a cause of action is kept from a party by the fraud of an adverse party, the cause of action shall be deemed to accrue at the time when the party discovered, or by the exercise of ordinary diligence should have discovered the fraud." Our Maryland statute of limitations guide covers other civil deadlines.

Who you can actually reach. Lawsuits work against people and businesses with a name, an address and assets. A scammer who hid behind a fake identity, a spoofed caller ID or an overseas account is usually not reachable through a Maryland court. In those cases the payment company, a fast report, and protecting your identity are where your effort pays off. Our guide on when a lawyer helps after a scam covers the cases where legal help is worth it, and a scammer has my information covers locking down your identity.

Related guides

• Scams and fraud: your rights and where to start
• How to get money back after a scam
• Where to report a scam
• Elder fraud
• Crypto and investment scams
• Phishing, smishing and vishing
• Maryland identity theft laws
• Maryland debt collection laws
• Maryland statute of limitations

Last updated: October 2, 2026.

This article is general legal information, not legal advice. For your specific situation, contact your payment company, the Maryland office named above, or a lawyer licensed in Maryland.

Frequently Asked Questions

Can I sue a scammer in Maryland?

Possibly, if you can identify and serve them and your loss came from a practice the Maryland Consumer Protection Act prohibits, which section 13-303 ties to consumer transactions such as sales of goods or services and consumer credit. Section 13-408 lets any person sue for injury or loss from such a practice, but an anonymous or overseas scammer is usually not reachable through a Maryland court.

Does the Maryland Consumer Protection Act award triple damages?

No. Section 13-408 lets a person recover for injury or loss sustained and has no triple-damages, statutory-minimum or punitive-damages provision.

Will the court make the business pay my attorney's fees in Maryland?

It may. Under section 13-408(c), a person who is awarded damages may seek reasonable attorney's fees and the court may award them; it is not required to. A court may also award fees against a party whose suit was brought in bad faith or is frivolous (section 13-408(d)).

How long do I have to sue under the Maryland Consumer Protection Act?

Section 13-408 sets no deadline of its own, and Maryland's general deadline for civil actions is three years (Courts and Judicial Proceedings section 5-101). When fraud kept you from knowing about the claim, section 5-203 starts the clock when you discovered, or should have discovered, the fraud. Confirm the period with a Maryland lawyer.

Will the Maryland Attorney General get my money back?

Do not count on it. The Consumer Protection Division mediates complaints against businesses, but it says it cannot force a business to cooperate and does not act as a private attorney. Contact your payment company first.

Can a Maryland bank stop a payment if it suspects elder fraud?

Yes, since October 1, 2026. Financial Institutions section 1-307 lets a bank or credit union delay a disbursement from the account of a resident 65 or older or a vulnerable adult if it reasonably believes the payment may be financial exploitation, for 15 business days, extendable to up to 25. It is allowed, not required.

Is scamming an elderly person a crime in Maryland?

Yes. Criminal Law section 8-801 makes it a crime to obtain the property of a vulnerable adult or a person 68 or older by deception, intimidation or undue influence, and it applies to anyone. Penalties range from a misdemeanor below $1,500 to up to 20 years for $100,000 or more.

Does Maryland limit crypto ATM transactions?

Yes. Financial Institutions section 12-1204 caps daily transactions at $2,000 for a new user and $10,500 for an experienced user and caps fees at the greater of $5 or 15 percent. On a transaction verified as fraudulent, the operator must refund the fee, not the money sent.

What is the small claims limit in Maryland?

The District Court hears small claims of up to $5,000, not counting interest, costs and attorney's fees where recoverable (Courts and Judicial Proceedings section 4-405).