Can You Sue for Identity Theft? Legal Claims, Damages & Your Rights Explained
Yes, you can sue someone for identity theft. Identity theft victims have legal options beyond criminal prosecution, including filing civil lawsuits against perpetrators, credit bureaus, and businesses that failed to protect data. Under the Fair Credit Reporting Act, victims can recover actual damages or statutory damages between $100 and $1,000, plus attorney’s fees. The Identity Theft Enforcement and Restitution Act also allows federal courts to order restitution for time spent recovering from identity theft.
Legal Basis for Identity Theft Lawsuits
Federal laws including the Fair Credit Reporting Act and the Identity Theft Enforcement and Restitution Act of 2008 provide legal frameworks for identity theft victims to pursue civil claims. Many states also have specific identity theft statutes that allow victims to bring civil lawsuits for damages.
The legal landscape gives identity theft victims multiple pathways to recover losses and hold responsible parties accountable through civil litigation.
Who Can You Sue for Identity Theft?
Identity theft lawsuits can target multiple defendants:
Individual Perpetrators: You can sue the thief directly as they are responsible for your harm, though finding them and recovering assets can be difficult.
Credit Reporting Agencies: Credit bureaus or businesses that disclosed your credit information improperly may be liable. Credit reporting agencies must follow reasonable procedures to verify accuracy of data they collect and can be held accountable for reporting inaccurate information.
Companies and Financial Institutions: Recent data breaches have led to major class action settlements, including MarineMax’s $1 million settlement and Capital One’s ongoing lawsuits for failing to implement reasonable cybersecurity measures.
Data Furnishers: Creditors and other entities that report false information to credit bureaus after identity theft occurs.
Available Legal Claims for Identity Theft Victims
Identity theft victims can pursue multiple legal theories:
- Fair Credit Reporting Act violations – For inaccurate credit reporting
- Negligence – When businesses fail to protect personal data
- Fraud – Against the perpetrator
- Breach of contract – When companies violate data protection agreements
- Violation of state identity theft statutes
- Emotional distress claims
- Defamation – When false information damages reputation
The specific legal theories available depend on the facts of your case and the defendants involved.
Damages Available in Identity Theft Lawsuits
Identity theft victims can recover substantial compensation:
Compensatory Damages: Actual damages cover losses or financial injuries suffered due to identity theft violations. This includes:
- Lost money from fraudulent accounts
- Credit repair costs
- Lost wages from time spent resolving issues
- Medical bills from fraud-related stress
Statutory Damages: Under the FCRA, victims can receive statutory damages between $100 and $1,000 without proving harm if violations were willful.
Punitive Damages: Available when credit reporting agencies or entities acted recklessly or knew they were violating FCRA obligations.
Time-Based Restitution: The Identity Theft Enforcement and Restitution Act requires compensation equal to the value of time reasonably spent remedying identity theft harm, including getting new Social Security numbers or correcting tax documents.
Attorney’s Fees: Successful FCRA claims allow recovery of attorney fees and investigative costs.
Recent settlements demonstrate recovery potential. The MarineMax data breach settlement provides up to $5,000 for documented identity theft losses and up to $2,000 for out-of-pocket expenses. Communication Federal Credit Union’s settlement offers up to $7,500 for documented costs from their data breach.
Statute of Limitations for Identity Theft Claims
Timing matters critically for identity theft lawsuits.
Under the Fair Credit Reporting Act, you have two years from discovering the violation or five years from when the violation occurred, whichever comes sooner. If you discover an error four years after inaccurate reporting, you only have one year left to file, not two.
Each transmission of an incorrect credit report may constitute a separate violation with its own statute of limitations under the continuing violation doctrine, though courts vary on this interpretation.
State identity theft laws may have different limitation periods. Some states follow the two-year discovery rule, while others impose different timelines.
Federal Laws Enabling Identity Theft Lawsuits
Fair Credit Reporting Act (FCRA): FCRA governs accuracy and privacy of credit reports, requiring credit reporting agencies and creditors to help identity theft victims recover. Victims can dispute inaccurate information and place fraud alerts on credit files.
Fair and Accurate Credit Transactions Act (FACTA): FACTA amended FCRA in 2003 to strengthen protections for identity theft victims, allowing fraud alerts and requiring agencies to investigate claims.
Identity Theft Enforcement and Restitution Act: This 2008 law expanded federal prosecution of identity theft, eliminated the $5,000 damage requirement, and authorized restitution orders compensating victims for time spent remedying harm.
Fair Debt Collection Practices Act: FDCPA allows consumers to challenge debt validity if contacted by collectors about fraudulent debts from identity theft.
State Identity Theft Laws
Many states provide additional civil remedies. New York’s State Fair Credit Reporting Act allows victims of knowing and willful identity theft to pursue damages in civil court. Texas’s Identity Theft Enforcement and Protection Act imposes civil penalties of $2,000 to $50,000 per violation for data breaches.
South Carolina law treats identity theft as a felony punishable by five years in prison and potential restitution to victims. California Penal Code Section 530.5 defines identity theft as unlawful use of personal information without consent, with both criminal and civil consequences.
Evidence Required for Identity Theft Civil Claims
Winning identity theft lawsuits requires strong documentation:
- Police reports – File a police report evidencing your identity theft claim, which credit agencies require before blocking fraudulent reporting
- FTC Identity Theft Report – Official complaint filed at IdentityTheft.gov
- Credit reports – Showing fraudulent accounts and inaccurate information
- Financial records – Documenting unauthorized transactions
- Communications – With creditors, credit bureaus, and collection agencies
- Timeline documentation – Tracking time spent resolving identity theft
Settlement claims require documentation showing losses were likely caused by the breach, such as debt collection letters, credit reports, and identity theft complaints.
Recent Identity Theft Court Rulings and Settlements (2024-2025)
The legal landscape continues evolving:
Capital One reached a $425 million settlement in 2025 for a 2019 data breach affecting over 100 million customers. Payments vary based on extent of losses, with identity theft victims receiving greater compensation.
HCA Healthcare’s multi-million dollar settlement for their July 2023 breach affecting 11.27 million patients includes credit monitoring, up to $5,000 for documented losses, and security commitments for two years.
A January 2025 Capital One class action alleges the bank failed to timely notify customers of a data breach, with the plaintiff experiencing unauthorized charges.
A massive 2024 National Public Data breach potentially affecting billions prompted class action lawsuits alleging failure to secure Social Security numbers and personal information.
Legal Process for Filing Identity Theft Lawsuits
Step 1: Document Everything – Report identity theft to the FBI’s financial division and file a police report before filing in court. Contact banks and credit bureaus immediately.
Step 2: Dispute with Credit Agencies – Before filing most FCRA lawsuits, dispute problems with credit reporting agencies to trigger consumer protection provisions.
Step 3: Calculate Statute of Limitations – Determine exact dates of violations to correctly calculate your filing deadline.
Step 4: Choose Court Jurisdiction – Federal courts typically handle FCRA claims, while state courts may handle state law claims.
Step 5: File Complaint – Detail violations, defendants, damages sought, and supporting evidence.
Step 6: Discovery and Settlement – Many identity theft cases settle before trial. Settlement approval hearings typically occur months after preliminary approval.
Identity Theft Lawsuits vs. Criminal Prosecution
Civil and criminal proceedings serve different purposes:
Criminal Prosecution: Government prosecutes perpetrators, potential jail time and restitution orders. Restitution orders require thieves to repay losses and compensate for time spent recovering.
Civil Lawsuits: Victims sue for monetary damages, lower burden of proof (preponderance of evidence vs. beyond reasonable doubt), can target businesses and credit agencies, not just perpetrators.
As an identity theft victim, you can file personal injury suits against perpetrators to recover damages for debts, lost tax refunds, and medical bills. Civil suits proceed independently from criminal cases.
Challenges in Winning Identity Theft Cases
Finding perpetrators and recovering assets proves difficult, as thieves typically lack funds to satisfy judgments.
Courts split on whether new disputes refresh the statute of limitations, with some allowing indefinite extensions and others running time from the first dispute.
Defendants commonly raise statute of limitations defenses, claim permissible purposes for accessing credit information, assert no actual harm occurred, or argue FCRA compliance.
Proving causation between data breaches and specific identity theft incidents requires solid documentation linking fraudulent activity to the breach.
When to Hire an Identity Theft Attorney
Consider legal representation when:
- Facing complex FCRA violations or multiple defendants
- Credit bureaus refuse to correct inaccurate information after disputes
- Substantial damages exceed small claims court limits
- Criminal charges arise from the identity theft
- Joining class action lawsuits when numerous users experienced data breaches
- Statute of limitations deadlines approach
Many identity theft attorneys work on contingency fees, meaning no upfront costs. Successful FCRA claims allow recovery of attorney fees.
Immediate Steps After Identity Theft
Contact your bank and financial institutions to report theft and temporarily freeze credit. Report identity theft to Equifax, Experian, and TransUnion, which will place fraud alerts requiring creditors to verify your identity before issuing credit.
Report identity theft to IdentityTheft.gov, the FTC resource for victims. File police reports and keep detailed records of all communications and recovery efforts.
The IRS has experienced massive delays processing identity theft cases, averaging 506 days in fiscal year 2025, making prompt reporting essential.
FAQs About Suing for Identity Theft
Q: Can I sue someone for stealing my identity?
Yes. Identity theft victims can file personal injury suits against perpetrators to recover damages including fraudulent debts, lost tax refunds, and medical bills. However, recovering judgment amounts can be difficult if perpetrators lack assets.
Q: What damages can I recover in an identity theft lawsuit?
Damages include actual provable losses with no limit, or statutory damages between $100 and $1,000 for willful FCRA violations. Victims also receive compensation for time spent recovering from identity theft. Attorney’s fees and punitive damages are available for willful violations.
Q: What is the statute of limitations for identity theft lawsuits?
FCRA claims must be filed within two years of discovering violations or five years from when violations occurred, whichever is sooner. State law claims may have different deadlines. Missing these windows results in case dismissal.
Q: Do I need to file a police report before suing?
While not always required for civil suits, filing police reports is essential before court proceedings and for credit bureau fraud alerts. Many settlement administrators require police reports to document identity theft claims.
Q: Can I sue the company where my data was stolen?
Yes. Recent data breach settlements show companies can be held liable for failing to implement reasonable cybersecurity measures. Lawsuits allege negligence for failing to timely notify customers and protect personal information.
Q: What federal laws help identity theft victims sue?
The Fair Credit Reporting Act, Identity Theft Enforcement and Restitution Act of 2008, and Fair Debt Collection Practices Act provide federal frameworks for civil claims. These laws establish liability standards and available damages.
Q: How long does an identity theft lawsuit take?
Timelines vary significantly. Class action settlements often take months from preliminary approval to final hearings, with claim submission deadlines typically several months after approval. Individual lawsuits may resolve faster through settlement or take years if going to trial.
Related Resources
For more guidance on legal issues, explore:
- Consumer Protection Attorney Who Handles Identity Theft Cases
- Should I Hire a Lawyer for Identity Theft
- Identity Theft Lawyer Cost
Disclaimer: This information is for educational purposes only and does not constitute legal advice. Identity theft laws, available remedies, and case outcomes vary by state and jurisdiction. Consult official government resources, court records, or an attorney for specific guidance regarding identity theft civil claims and your legal options.
About the Author
Sarah Klein, JD, is a former consumer rights attorney who spent years helping clients with issues like unfair billing, product disputes, and debt collection practices. At All About Lawyer, she simplifies consumer protection laws so readers can defend their rights and resolve problems with confidence.
Read more about Sarah