Can You Sue Someone for Identity Theft: Laws, Damages, Deadlines

Yes, you can sue someone for identity theft. Federal law gives you a private right to sue credit bureaus and the banks, lenders, and debt collectors that furnish information to them when they mishandle your data or ignore your disputes, and state law lets you go after the thief directly or after any business whose negligence enabled the theft. The harder question is whether a lawsuit is worth filing, because winning a judgment and collecting money are two very different problems.

Who’s Actually Worth Suing

The identity thief is the obvious defendant and often the worst one. Many thieves are never identified. Those who are caught frequently have no assets, and a judgment against someone who is broke or incarcerated is a piece of paper you may never cash.

Institutions make better targets because they have money and clear legal duties they can be shown to have broken. Think about whether any of these contributed to your losses:

A credit reporting agency — Equifax, Experian, or TransUnion — that kept reporting fraudulent accounts after you disputed them or failed to investigate your dispute properly.
A bank or credit card issuer that opened an account in your name without adequate identity verification, or ignored red flags on an existing account.
An employer, healthcare provider, or other organization that stored your Social Security number or financial data carelessly and suffered a breach.
A data broker that sold your information to scammers. The Consumer Financial Protection Bureau has proposed rules that would classify many data brokers as consumer reporting agencies, subjecting them to FCRA accuracy and permissible-purpose requirements.¹

The strongest civil cases target institutional defendants with clear obligations they failed to meet. A credit bureau that sat on a properly filed dispute for months is a cleaner case than chasing an anonymous thief.

The Laws That Let You Sue

The Fair Credit Reporting Act

The Fair Credit Reporting Act (FCRA) is the strongest federal tool for identity theft victims. It requires credit reporting agencies to follow reasonable procedures to protect the accuracy and privacy of your consumer information, and it creates a private right of action when they fail.² You can sue both credit reporting agencies and the companies that furnish information to them — banks, credit card issuers, debt collectors — when their violations cause you harm.

What you recover depends on whether the violation was willful or negligent. For willful violations, you can recover either your actual financial losses or statutory damages between $100 and $1,000 per consumer, whichever is greater, plus punitive damages and attorney’s fees.³ The statutory damages matter because they guarantee a minimum recovery even when out-of-pocket losses are hard to prove. For negligent violations, you’re limited to actual damages plus attorney’s fees — no statutory minimum, no punitive damages.⁴

The FCRA also reaches people who pull your credit report without authorization. Someone who obtains your consumer report under false pretenses is liable for actual damages or $1,000, whichever is greater.³ In practice, most FCRA lawsuits target the institutions that failed to catch or correct the fraud rather than the thief.

One thing the FCRA is not: a route to sue the federal government or use the criminal identity theft statute. The Identity Theft and Assumption Deterrence Act (18 U.S.C. § 1028) makes identity theft a federal crime but does not create a private right of action. Federal courts routinely dismiss victims’ attempts to sue under it.

State Statutes and Common-Law Claims

Most states have their own identity theft statutes, and many include civil remedies allowing victims to sue for damages, restitution, or both. Protections vary — some states provide statutory minimum damages similar to the FCRA, while others focus on court-ordered restitution. State laws sometimes reach conduct or defendants federal law doesn’t cover.

Traditional tort claims give you additional grounds:

Fraud, when the thief used deception to open accounts or drain existing ones for personal gain.
Negligence, when a company or institution failed to take reasonable steps to protect your data and that failure led to the theft.
Invasion of privacy, when someone used your personal information without authorization in a way a reasonable person would find highly offensive.
Intentional infliction of emotional distress, when the conduct was extreme enough to cause severe emotional harm. Courts set a high bar for this claim.

Tort claims are especially useful when the defendant is a business rather than the individual thief. A company that suffered a preventable data breach, a bank that opened a fraudulent account without proper verification, or a data broker that sold your information to scammers can all face negligence liability. The core question is whether the organization owed you a duty to protect your information and fell short.

What You Can Recover

Actual damages cover real financial losses: unauthorized charges, credit monitoring fees, lost wages from time spent fixing the mess, notary and certified mail costs for disputes, and any other out-of-pocket expense directly caused by the theft. There’s no cap if you can prove them. Document every dollar.

Statutory damages are available under the FCRA and some state statutes. For willful FCRA violations, the floor is $100 and the ceiling is $1,000 per consumer, even when provable financial loss is less.³ They exist because identity theft creates real harm that’s hard to quantify.

Emotional distress damages compensate for anxiety, sleeplessness, fear, and the psychological toll of having your identity stolen. Courts generally require some evidence beyond your own testimony that you were stressed. Records of therapy, prescription medications, or witness accounts of how the theft disrupted your daily life strengthen the claim.

Punitive damages punish especially egregious conduct and are available in willful-violation FCRA cases and in many state tort claims. They’re discretionary — a judge or jury decides whether the defendant’s behavior was bad enough to warrant punishment on top of compensation.

Attorney’s fees and costs are recoverable under the FCRA for successful claims.³ That fee-shifting is why lawyers will take identity theft cases on contingency. Some state statutes allow it too.

Injunctive relief is a court order requiring the defendant to do or stop doing something — for example, ordering a credit bureau to remove fraudulent accounts from your report or directing a creditor to stop collecting on a debt you never incurred.

One caveat on damages: courts expect you to take reasonable steps to limit the harm once you know about the theft. If you ignore fraudulent charges for months without contacting your bank or the credit bureaus, a defendant can argue some of your losses were avoidable. You don’t have to be perfect. You do have to show you acted reasonably.

When You Don’t Need to Sue at All

Before calculating what to sue for, check whether federal law already caps your out-of-pocket loss on the transaction.

For unauthorized credit card charges, your maximum liability is $50 no matter how much the thief spent. Most major issuers offer zero-liability policies, so you often owe nothing.

For unauthorized debit card charges and other electronic fund transfers, the rules are stricter and timing controls everything. Report the theft within two business days of learning about it, and your liability caps at $50. Wait longer than two days but report within 60 days of receiving your account statement, and the cap rises to $500. Miss the 60-day window, and you could be on the hook for the full amount.⁵ Act fast on debit card fraud.

These limits don’t apply to every kind of identity theft. They won’t help when someone opens new accounts in your name, they don’t compensate you for time lost or emotional distress, and they only work if you actually dispute the charges. But for unauthorized transactions on existing accounts, you often don’t need a lawsuit.

What to Do Before You File

File a police report with your local department. Include everything you have — fraudulent accounts, unauthorized charges, communications from the thief — and keep a copy. Creditors and credit bureaus routinely ask for it when you dispute fraudulent activity.

File an identity theft report at IdentityTheft.gov, the FTC’s reporting and recovery portal.⁶ It generates an FTC Identity Theft Report, which carries legal weight when you dispute fraudulent accounts with businesses and credit bureaus.⁷

Track every unauthorized transaction, fraudulent account, and out-of-pocket expense in one place. Notary fees, certified mail costs, credit monitoring, lost wages, receipts, confirmation emails, letters — all of it. This is your actual-damages evidence. Gather anything tying a specific person or entity to the theft: fraudulent applications, IP addresses, phishing emails, statements showing where stolen funds went.

Then pull your credit reports from all three bureaus, review them for accounts and inquiries you didn’t authorize, and file formal disputes for every fraudulent item. Place a fraud alert or credit freeze on your files. Both are free.⁸ The bureaus must investigate your disputes, typically within 30 days. If a bureau fails to investigate properly or leaves fraudulent information on your report after you’ve disputed it, that failure itself becomes the basis for an FCRA lawsuit.

Small Claims Court or Regular Court

If your provable losses are small, small claims court is often smarter. Filing fees are lower, procedures are simpler, you usually don’t need a lawyer, and cases resolve in weeks.⁹ The trade-off is a recovery cap. State limits range from about $2,500 to $25,000, with most states between $5,000 and $12,500.

For larger losses, complex legal theories, punitive damages, or injunctive relief, you’ll need regular state or federal court. FCRA claims can be brought in any federal district court regardless of the amount at stake.¹⁰ An attorney experienced in consumer protection cases is effectively a requirement there.

Deadlines That End Your Case

Every lawsuit has a deadline, and missing it kills the claim no matter how strong the evidence.

For FCRA claims, you must file within two years of discovering the violation or five years from the date it occurred, whichever comes first.¹⁰ The discovery rule helps because identity theft often goes undetected for months. The clock starts when you actually learn about the violation.

State-law claims carry their own deadlines. Fraud and negligence statutes of limitations typically run between two and six years, and most states apply some version of a discovery rule. If you’re considering both federal and state claims, the shortest deadline controls your urgency.

Collecting a Judgment

Winning in court doesn’t automatically put money in your account. Sue a credit bureau or major bank and collection is routine — large companies pay judgments to avoid further legal consequences. Sue an individual thief and collection can be genuinely difficult.

The tools available include wage garnishment, bank account levies, and liens on the debtor’s property. Each requires additional court filings. Federal and state law exempt certain income and property from collection: Social Security payments, a portion of wages, and basic personal property are generally off-limits. If the defendant declares bankruptcy and your judgment is listed as a debt, federal law may block collection entirely. Weigh the likelihood of collection before you invest time and legal fees.

Taxes on What You Recover

Most money you recover in an identity theft lawsuit is taxable. The IRS looks at what the payment was meant to replace, and identity theft damages typically compensate for financial loss and emotional distress rather than physical injury.¹¹

Reimbursement of stolen money is generally taxable unless structured carefully, because the IRS treats settlement proceeds as income from whatever source derived.
Emotional distress damages are taxable unless tied to a physical injury or sickness. If part of the award reimburses medical expenses for emotional distress that you didn’t previously deduct, that portion may be excludable.¹¹
Punitive damages are always taxable, with a narrow exception for wrongful death cases in states that only allow punitive damages.
Attorney’s fees may still count as taxable income to you even when your lawyer takes them directly out of the settlement.

How a settlement agreement characterizes the payments can move your tax bill by thousands. Talk to a tax professional before signing anything.

1
Federal Register. Protecting Americans from Harmful Data Broker Practices (Regulation V)
2
Office of the Law Revision Counsel. 15 USC 1681 – Congressional Findings and Statement of Purpose
3
Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
4
Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
5
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
6
Federal Trade Commission. Report Identity Theft
7
Federal Trade Commission. IdentityTheft.gov Helps You Report and Recover from Identity Theft
8
Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report?
9
Justia. Small Claims Court and Consumer Lawsuits
10
Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions
11
Internal Revenue Service. Tax Implications of Settlements and Judgments