Identity theft victims have legal rights beyond simply cleaning up fraudulent accounts. Federal and state laws provide remedies when companies fail to protect your data, credit bureaus don't correct errors, or businesses harm you through negligent practices. Understanding these legal protections helps victims pursue appropriate compensation.
Fair Credit Reporting Act (FCRA)
The FCRA gives identity theft victims specific rights regarding credit reports. Credit bureaus must investigate disputed information within 30 days and remove items they cannot verify. They must provide free credit reports to identity theft victims.
When bureaus fail to correct fraudulent information after proper disputes, victims can sue for actual damages, statutory damages up to $1,000 for willful violations, punitive damages for willful violations, and attorney's fees.
Fair Debt Collection Practices Act (FDCPA)
Debt collectors pursuing fraudulent debts may violate the FDCPA. If you notify a collector that a debt resulted from identity theft and provide documentation, they must stop collection. Continuing to pursue fraudulent debts after proper notice violates the law.
FDCPA violations allow recovery of actual damages, statutory damages up to $1,000, and attorney's fees.
Data Breach Laws
All 50 states have data breach notification laws requiring companies to notify you when your data is compromised. Some states provide private rights of action against companies with inadequate data security.
Class action lawsuits against companies suffering major breaches have resulted in significant settlements. If your identity was stolen following a data breach, you may be part of such litigation.
State Identity Theft Laws
Many states have specific identity theft victim rights beyond federal law. These may include the right to have criminal records expunged when crimes were committed by identity thieves, expedited processes for credit bureau corrections, and civil remedies against identity thieves.
State laws vary significantly—research your state's specific protections.
Claims Against Negligent Companies
Companies that fail to reasonably protect customer data may face negligence claims. If inadequate security caused your identity theft, the company may be liable. These claims require proving the company had a duty to protect your data, breached that duty through inadequate security, the breach caused your identity theft, and you suffered damages.
Class actions are common for large-scale data breaches.
Identity Theft Assumption and Deterrence Act
This federal law makes identity theft a crime and gives victims the right to obtain documentation about fraudulent transactions. Companies must provide copies of applications, transaction records, and other documents related to identity theft upon request.
FTC Enforcement
While you can't sue under all FTC regulations, the FTC brings enforcement actions against companies with deceptive or unfair data practices. FTC actions sometimes result in restitution for victims. Report identity theft to the FTC even if you don't have individual claims.
Statute of Limitations
Legal claims have time limits. FCRA claims must generally be filed within two years of discovering the violation. State law claims have varying deadlines. Don't delay seeking legal advice—waiting can forfeit your rights.
Actual vs. Statutory Damages
Some laws provide statutory damages—set amounts you can recover without proving actual financial loss. This is important because identity theft often causes harm that's difficult to quantify—time spent on recovery, stress, credit damage.
Actual damages include documented financial losses, time spent on recovery (at a reasonable hourly rate), and emotional distress in some cases.
Class Actions vs. Individual Claims
For large-scale breaches, class actions may be efficient. For individual situations where companies specifically wronged you, individual claims may provide greater recovery. Consult an attorney about which approach fits your situation.
Getting Legal Help
Consumer protection attorneys handle identity theft cases, often on contingency. They can evaluate which legal claims apply, pursue companies that violated your rights, and maximize your recovery. Fee-shifting provisions in many consumer laws mean defendants pay your attorney's fees if you win.