How much you can sue for in an identity theft case usually runs from a few hundred dollars to well into six figures, depending on which laws the defendant broke and how thoroughly you can document the harm. Federal consumer statutes set the framework: the Fair Credit Reporting Act allows $100 to $1,000 per willful violation on top of your actual losses, and punitive damages, emotional distress awards, and attorney’s fees can push a recovery much higher. There is no single number. What matters is which legal theories fit your facts and how well your paperwork supports them.
The Dollar Categories in an Identity Theft Recovery
A successful claim almost always combines several types of damages rather than relying on one.
Actual damages cover documented financial losses. That includes fraudulent charges, credit monitoring subscriptions, certified mail and notary fees, and lost wages from time spent cleaning up the mess. If the theft dropped your credit score and you paid a higher interest rate on a loan as a result, the difference counts too.
Statutory damages are fixed dollar amounts a court can award even when you cannot pin down an exact loss. Under the FCRA, the range is $100 to $1,000 per willful violation. The FDCPA and Electronic Fund Transfer Act each allow up to $1,000 per case. When a defendant committed multiple FCRA violations, those per-violation amounts can stack.
Punitive damages punish reckless or deliberately harmful conduct. The FCRA sets no fixed cap on punitive awards, which is why the worst-behaving defendants can face large judgments.
Emotional distress damages compensate the anxiety, sleeplessness, and ongoing fear that identity theft causes. Courts recognize the injury, but you have to prove it. Therapy records, prescriptions for anxiety or sleep medication, and a personal journal describing the day-to-day effect all help.
Attorney’s fees shift to the losing defendant under most federal consumer statutes. That is what makes these cases viable: lawyers will take them on contingency even when the individual’s out-of-pocket losses are modest, because the fee award funds the work.
The Federal Laws That Set the Numbers
Three statutes drive most identity theft lawsuits. Which one applies depends on who mishandled your information.
Fair Credit Reporting Act
The FCRA is the most heavily used tool. It governs credit bureaus and the companies that furnish information to them. If a bureau fails to investigate your dispute, keeps reporting accounts that are not yours, or a furnisher reports information it knows is wrong, you can sue.
Recovery depends on whether the violation was willful or negligent. For willful violations, a court can award statutory damages between $100 and $1,000 per violation, actual damages, punitive damages in any amount the court considers appropriate, and attorney’s fees.1Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance For negligent violations, you are limited to actual damages and attorney’s fees, with no statutory or punitive damages.2Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
The strongest FCRA claims come from provable inaction. You sent documentation showing an account was not yours, and the bureau either ignored the dispute or rubber-stamped the original information anyway. That pattern reads as willful, and willful is where the higher dollars live.
Fair Debt Collection Practices Act
When someone opens accounts in your name and those fake debts move to collections, the FDCPA comes into play. Collectors who pursue debts resulting from identity theft, especially after you have notified them, can be held liable.3Consumer Financial Protection Bureau. CFPB Takes Action Against Debt Collector for Failing to Investigate Reports of Identity Theft and Misrepresenting Consumers’ Debts
Under the FDCPA, you can recover actual damages, additional damages of up to $1,000 per lawsuit, and attorney’s fees.4Office of the Law Revision Counsel. 15 USC 1692k – Civil Liability The $1,000 cap is per lawsuit rather than per violation, so an FDCPA count usually works as an add-on to a stronger FCRA case.
Electronic Fund Transfer Act
If your debit card or bank account was compromised, the EFTA both caps what you owe on the fraud and gives you a cause of action against a bank that mishandles your report. Your liability depends on speed. Notify the bank within two business days of discovering the unauthorized transfer and your maximum exposure is $50. Wait longer than two days but report within 60 days of the statement being sent, and the cap rises to $500. Miss the 60-day window and you could be on the hook for the full amount lost after the deadline.5Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
When a bank violates the EFTA by refusing to investigate or reimburse after a timely report, you can sue for actual damages, statutory damages between $100 and $1,000, and attorney’s fees.6Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability Report unauthorized transactions the day you spot them. Waiting weakens both the liability cap and any later lawsuit.
Who You Sue Affects What You Collect
Suing the person who stole your identity is theoretically possible and almost never worthwhile. Thieves are hard to find, and the ones you find rarely have assets to pay a judgment. Experienced attorneys point clients toward institutional defendants instead.
The productive targets are companies that failed a legal duty owed to you. Credit bureaus are the most common defendants, usually for botching a dispute investigation. Banks and credit card issuers face liability when they open accounts without proper verification or mishandle fraud claims. Debt collectors get sued for pursuing debts already identified as fraudulent. A company that suffered a data breach may be liable if its security was inadequate.
Institutions carry insurance and assets, so collection is not the problem it is with an individual thief. They also have statutory obligations, and a violation of a specific statute gives your lawsuit a stronger hook than a general “bad security” complaint.
What You Need to Document
Paperwork drives the number on the check. Start your file the day you discover the theft.
File an identity theft report at IdentityTheft.gov. The site generates a recovery plan and an Identity Theft Affidavit you will reuse throughout the case.7Federal Trade Commission. Report Identity Theft File a police report too. The FTC affidavit combined with a police report becomes an Identity Theft Report, which unlocks stronger rights against credit bureaus and creditors.8Federal Trade Commission. Identity Theft: What to Do Right Away
Beyond those two reports, gather and keep:
- Bank and credit card statements showing every fraudulent transaction
- Every dispute letter, email, and online submission you sent, with dates and proof of delivery
- A phone log with the date, time, representative name, and summary of each call
- Receipts for credit monitoring services, certified mail, and notary fees
- Employment records for any lost wages
- Medical or therapy records if you sought treatment for anxiety or depression tied to the theft
Dispute correspondence carries special weight. The strongest FCRA claim is a paper trail showing you notified a bureau or furnisher and they failed to act. Online-only disputes are harder to prove later, so send a paper copy by certified mail with return receipt as a backup.
Deadlines That Can Erase Your Case
Federal identity theft claims have hard time limits. The FCRA requires you to file by the earlier of two years after you discovered the violation or five years after it occurred.9Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions The discovery clock starts when you knew or should have known about the problem. The five-year outer limit is absolute regardless of when you found out.
FDCPA claims generally have a one-year deadline from the date of the violation. State identity theft laws set their own deadlines, which vary. If you think a company violated your rights, do not sit on the claim.
What Can Shrink Your Recovery
Even a strong case runs into practical limits.
Mandatory Arbitration
Many financial contracts include arbitration clauses that block you from going to court. Credit card issuers covering more than 90% of U.S. credit card debt impose arbitration, and an estimated 81 of the 100 largest U.S. companies use forced arbitration in consumer contracts. The CFPB tried to limit these clauses in 2017, but Congress disapproved the rule before it took effect.10Consumer Financial Protection Bureau. Arbitration Agreements
Arbitration does not eliminate the damages you can pursue, but it removes the jury trial and usually bars class actions. Check your account agreements before assuming court is your path. In some situations an arbitration clause can be challenged as unenforceable.
Actually Collecting
Winning and collecting are separate problems. A judgment against an individual thief is worth only what the thief has. Judgments against banks, credit bureaus, and large corporations get paid, which is another reason attorneys focus on institutional defendants and statutory violations.
Taxes on the Settlement
Most identity theft settlements are at least partly taxable, which surprises many victims. Damages for personal physical injuries are excluded from income, but emotional distress alone is not a physical injury.11Office of the Law Revision Counsel. 26 USC 104 – Compensation for Injuries or Sickness Since identity theft rarely involves physical harm, most of the settlement is taxable.
Punitive damages are always taxable. Reimbursement for actual out-of-pocket losses generally is not, because it restores you to where you were rather than creating income. Statutory damages and emotional distress awards are taxable. One narrow exception: the portion of a settlement that pays for medical care attributable to emotional distress, such as therapy or anxiety medication, can be excluded. Keep the receipts and talk to a tax professional before accepting a settlement, so you understand what the after-tax number actually is.