Someone stole your identity and now you’re dealing with fraudulent accounts, damaged credit, and hours spent trying to fix the mess. Identity theft is a crime, but it’s also a civil wrong that can give you grounds to sue—either the thief who stole your information or the companies that failed to protect it.
Quick Answer
You may be able to sue for identity theft if you can identify the thief and prove damages. More commonly, victims sue companies that failed to protect their data (through data breach lawsuits) or companies that allowed fraudulent accounts to be opened in their name. You can also sue under the Fair Credit Reporting Act if credit bureaus or creditors violate the law in handling your case.
Who Can You Sue?
The Identity Thief
You can sue the person who stole your identity for:
- Your financial losses
- Emotional distress
- Time spent fixing the damage
- Attorney fees
The challenge: Thieves are often unknown, judgment-proof (no assets), or impossible to locate. Criminal prosecution may be more effective if the thief is caught.
Companies That Exposed Your Data
If a data breach at a company led to your identity theft, you may sue for:
- Negligence in protecting your data
- Breach of contract (if they promised data protection)
- Violation of state data breach laws
Data breach class actions are common after major breaches affecting many consumers.
Companies That Opened Fraudulent Accounts
Banks, credit card companies, and other creditors that opened accounts for the thief may be liable if they:
- Failed to verify identity properly
- Ignored red flags suggesting fraud
- Continued collections after you reported fraud
Credit Reporting Agencies
Under the Fair Credit Reporting Act (FCRA), you can sue Equifax, Experian, TransUnion, or other credit bureaus if they:
- Failed to properly investigate your dispute
- Continued reporting fraudulent accounts after you disputed them
- Refused to place fraud alerts or credit freezes
- Failed to follow proper reinvestigation procedures
Federal Laws That Protect You
Fair Credit Reporting Act (FCRA)
The FCRA gives you rights regarding your credit report:
- Right to dispute inaccurate information
- Credit bureaus must investigate disputes within 30 days
- Right to place fraud alerts and credit freezes
- Right to sue for willful or negligent FCRA violations
Damages available:
- Actual damages (financial losses)
- Statutory damages of $100-$1,000 per violation (for willful violations)
- Punitive damages
- Attorney fees
Fair Debt Collection Practices Act (FDCPA)
If debt collectors pursue you for fraudulent debts, they may violate the FDCPA if they:
- Continue collection after you dispute the debt in writing
- Fail to verify the debt when requested
- Use harassing or deceptive tactics
Damages: Up to $1,000 per violation plus actual damages and attorney fees.
Electronic Fund Transfer Act
Limits your liability for unauthorized electronic transactions:
- $50 if reported within 2 days
- $500 if reported within 60 days
- Potentially unlimited if not reported within 60 days
Fair Credit Billing Act
Limits liability for unauthorized credit card charges to $50 (most card issuers waive even this).
State Laws
Many states have additional identity theft protections:
- Identity theft victim rights laws – Procedures for clearing your name
- Data breach notification laws – Companies must notify you of breaches
- Consumer protection laws – May provide additional remedies
- State FCRA equivalents – Some states have stronger protections
California, for example, has particularly strong identity theft protections.
What Damages Can You Recover?
| Damage Type | Examples |
|---|---|
| Out-of-pocket losses | Money stolen, fees paid, costs to fix credit |
| Lost wages | Time off work to deal with the theft |
| Credit damage | Higher interest rates, denied credit, loan rejections |
| Emotional distress | Anxiety, stress, lost sleep |
| Time spent | Hours spent on phone calls, disputes, paperwork |
| Statutory damages | Set amounts under FCRA, FDCPA |
| Punitive damages | To punish willful violations |
| Attorney fees | Under federal consumer protection laws |
Steps to Take After Identity Theft
1. Document Everything
- Keep a log of all phone calls, dates, and who you spoke with
- Save copies of all letters and emails
- Keep receipts for any expenses
- Track time spent dealing with the theft
2. Report to the FTC
File a report at IdentityTheft.gov. This creates an official Identity Theft Report you’ll need for disputes and may need for legal claims.
3. File a Police Report
A police report helps prove you’re a victim and is required for some remedies.
4. Place Fraud Alerts and Credit Freezes
Contact the three credit bureaus:
- Fraud alert: Makes it harder to open new accounts (lasts one year)
- Credit freeze: Prevents new accounts from being opened (strongest protection)
5. Dispute Fraudulent Accounts
Send written disputes to:
- Each credit bureau reporting the fraudulent accounts
- The creditors who opened fraudulent accounts
Send disputes via certified mail with return receipt.
6. Request Account Records
Under federal law, you can request copies of:
- Applications for fraudulent accounts
- Transaction records
- Other business records related to the theft
These can help identify the thief and prove your case.
7. Follow Up on Disputes
Credit bureaus must investigate within 30 days. If they don’t remove fraudulent information, you may have grounds for an FCRA lawsuit.
Suing in Small Claims Court
For smaller amounts (limits vary by state):
- No lawyer required
- Lower filing fees
- Can sue the thief if you know who it is
- Can sue companies that violated your rights
Bring documentation: police reports, FTC reports, dispute letters, credit reports showing fraudulent accounts, and evidence of your damages.
Class Action Lawsuits
After major data breaches, class action lawsuits allow affected consumers to sue collectively. Benefits:
- Shared legal costs
- No individual effort required
- Larger companies are held accountable
Drawbacks:
- Individual recovery may be small
- Less control over the case
- May take years to resolve
Check if a class action exists related to your breach before filing individually.
Frequently Asked Questions
Can I sue if I don’t know who stole my identity?
You can’t sue an unknown thief, but you can sue companies that failed to protect your data, opened fraudulent accounts, or mishandled your disputes. Many successful identity theft lawsuits are against these third parties, not the thief.
How long do I have to file a lawsuit?
Statutes of limitations vary:
- FCRA claims: 2 years from when you discover the violation (or 5 years from violation, whichever is earlier)
- FDCPA claims: 1 year
- State law claims: Vary by state (typically 2-4 years)
Don’t delay—consult an attorney promptly.
What if the credit bureau fixed the error—can I still sue?
Possibly. If they violated the law in how they handled your dispute (took too long, didn’t investigate properly, re-reported the error), you may have a claim even if the error is now fixed.
Is it worth suing over identity theft?
Consider:
- The amount of your damages
- Whether the defendant can pay a judgment
- Whether federal laws allow attorney fee recovery (making small cases viable)
- Whether a class action already exists
Many identity theft attorneys work on contingency.
When to Contact a Lawyer
Consider consulting a consumer protection attorney if:
- Credit bureaus or creditors won’t remove fraudulent accounts
- You’ve suffered significant financial harm
- Debt collectors are pursuing fraudulent debts
- A company’s data breach led to your identity theft
- You want to explore joining a class action
- Your FCRA or FDCPA rights were violated
Many consumer protection attorneys take identity theft cases on contingency and can recover attorney fees under federal law if you win.
Last updated: January 2025
This article provides general information about suing for identity theft in the United States. Laws vary by state and individual circumstances. Consult with a qualified attorney for advice specific to your situation.
