Yes, you can sue for identity theft, and you have more than one target to choose from. The thief is the obvious one, but the more productive lawsuits usually go after credit bureaus or creditors that mishandled the aftermath. Federal law, especially the Fair Credit Reporting Act, gives victims a private right of action against companies that ignore disputes or keep reporting fraudulent accounts, and those defendants have money to pay a judgment. A direct suit against the thief is legally possible but often ends with an uncollectible verdict.
Who You Can Sue
Three categories of defendants come up in identity theft cases, and the right choice depends on what happened and who has assets.
The identity thief is the first option. If you know who stole your information and they have reachable income or property, you can sue them directly. This works best when the thief is someone you know personally, such as a family member, roommate, or former partner, who can actually be served and has something to collect against. Roughly half of identity theft cases involve someone the victim knows.
Credit reporting agencies are the second. Equifax, Experian, and TransUnion have specific legal obligations to investigate disputes, block fraudulent information, and place fraud alerts and freezes. When a bureau ignores a dispute or keeps reporting accounts opened by a thief, the FCRA creates liability.
Creditors and debt collectors are the third. A bank that opened an account using stolen information, or a collector pursuing you for the thief’s charges, can be liable if it fails to investigate after you report the fraud. Furnishers of information to the bureaus carry their own FCRA duties.
Most successful identity theft lawsuits target the second and third categories rather than the thief, for reasons that come down to legal clarity and ability to pay.
Suing the Thief Directly
When you can identify the thief and they have assets, several legal theories support a civil claim.
Fraud is the most direct. You show that the thief deliberately used your personal information to deceive creditors, employers, or government agencies, and that the deception caused you measurable financial harm. The classic scenario fits here: someone opens credit cards in your name, runs up charges, and leaves you with the fallout.
Invasion of privacy covers situations where the thief accessed information you reasonably expected to keep private, such as financial accounts, mail, or your Social Security number. Defamation can apply when the thief’s actions created false records suggesting you owe debts you never incurred, damaging your credit and reputation.
Most states also have a dedicated identity theft statute that creates a civil cause of action separate from the criminal offense. These laws vary. Some authorize treble damages or minimum statutory awards that reduce the burden of proving an exact dollar loss. State consumer protection laws with broad unfair-practices provisions sometimes offer another route, particularly when the theft involved a business relationship.
Suing Credit Bureaus and Creditors Under the FCRA
The Fair Credit Reporting Act is the workhorse statute for identity theft victims. It imposes concrete duties on credit reporting agencies and the companies that furnish information to them, and it lets you sue when those duties are violated.
The Duties the Statute Creates
When you submit an identity theft report, a credit reporting agency must block the fraudulent information from your file within four business days.1Office of the Law Revision Counsel. 15 U.S. Code 1681c-2 – Block of Information Resulting From Identity Theft You can place a one-year initial fraud alert by contacting any one of the three major bureaus, which must then notify the other two, and the alert extends to seven years when you file an identity theft report. You also have the right to a free security freeze. The bureau must place it within one business day of a phone or online request and lift it within one hour when you ask.2Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
Common violations that produce lawsuits: continuing to report accounts you’ve disputed as fraudulent, refusing to conduct a reasonable investigation after receiving your dispute, and failing to block information after you submitted an identity theft report. Furnishers that ignore notice of a dispute and keep reporting bad information face the same kind of exposure.
What a Successful FCRA Claim Pays
For willful violations, you can recover actual damages or statutory damages between $100 and $1,000 per violation, plus punitive damages and attorney fees.3Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance For negligent violations, you can still recover actual damages and attorney fees, though statutory and punitive damages are not available.
The attorney fee provision changes the math. It means a lawyer can take an FCRA case on contingency or with the expectation of recovering fees from the defendant, which makes these claims viable even when your out-of-pocket losses are modest. FCRA claims can be filed in federal court regardless of the amount in controversy.4Office of the Law Revision Counsel. 15 U.S. Code 1681p – Jurisdiction of Courts; Limitation of Actions
What You Can Recover
Damages fall into overlapping categories, and what’s available depends on who you sue and under what theory.
Economic damages are your documented out-of-pocket losses: unauthorized charges, credit monitoring fees, the cost of replacing documents like a driver’s license or passport, legal fees spent clearing fraudulent records, and lost wages for time taken off work to deal with the mess. Keep detailed records; these claims are only as strong as the documentation behind them.
Non-economic damages cover the harm that doesn’t show up on a statement. Anxiety, sleep loss, strained relationships, and the frustration of cleaning up someone else’s mess all qualify, as does damage to your credit score and reputation. Courts recognize these as legitimate, but they’re harder to prove. Medical records, testimony from family about behavioral changes, and a contemporaneous journal help.
Statutory damages are set by law regardless of your actual loss. The FCRA’s $100-to-$1,000 range for willful violations is the main example, and many state identity theft statutes authorize similar minimums or multiplied awards.3Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance
Punitive damages are available when the defendant’s conduct was especially reckless or malicious, such as a bureau that ignored repeated disputes. They sit on top of statutory or actual damages when a court finds willful noncompliance.3Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance
Attorney fees and costs are recoverable by prevailing plaintiffs under the FCRA and many parallel state statutes.3Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance That fee-shifting is often what makes a smaller case worth bringing at all.
Before You File
A lawsuit built on thin documentation usually fails. The steps you take in the weeks after discovering the theft form the evidence base for any later claim.
Start at IdentityTheft.gov, the federal government’s centralized reporting platform.5Federal Trade Commission. Report Identity Theft Filing there generates an FTC Identity Theft Report, a document that unlocks specific rights including the seven-year extended fraud alert and the right to require bureaus to block fraudulent accounts.2Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts File a police report too. Some creditors and bureaus still require one before they’ll act, and it strengthens your credibility in litigation. If someone used your identity to file a fraudulent tax return, submit IRS Form 14039 so the IRS flags your account.6Internal Revenue Service. Identity Theft Affidavit
Place a security freeze with all three bureaus immediately. It’s free and stops new fraudulent accounts from being opened while you clean up the existing damage.2Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts Pull your free credit reports from all three and flag every account or inquiry you don’t recognize.
Then build the paper trail. Save bank and credit card statements showing unauthorized transactions, copies of every letter and email you send to creditors or bureaus, and records of phone calls with the date, time, representative’s name, and what was discussed. This serves two purposes: it proves your losses, and it shows reasonable mitigation. Expect a defendant to argue you should have moved faster.
For a claim against the thief personally, you need to know who they are. For FCRA claims against a bureau or creditor, you don’t; the bureau’s duty to investigate and correct exists regardless of who committed the underlying theft.
Filing Deadlines
Every claim has a deadline, and missing it eliminates your right to sue no matter how strong the facts are.
For FCRA claims, the deadline is two years from discovering the violation or five years from the date the violation occurred, whichever comes first.4Office of the Law Revision Counsel. 15 U.S. Code 1681p – Jurisdiction of Courts; Limitation of Actions The discovery provision matters because identity theft often goes undetected for months. The clock starts when you learn about the violation, not when it happened.
For state-law claims like fraud, negligence, or statutory identity theft, limitations periods vary. Most fall between two and six years, and many states apply a discovery rule. Don’t assume you have time; which statute of limitations controls your specific claim takes legal analysis.
Collecting What You Win
Winning a lawsuit and getting paid are two different things. A judgment against a credit bureau or major creditor is straightforward to collect, because these are solvent companies with assets and reputations to protect. A judgment against an individual thief is another matter. If the defendant has no job, no bank account, and no property, a court judgment is just paper. You can’t garnish wages that don’t exist.
Enforcement tools exist, including writs of execution, wage garnishment, bank levies, and post-judgment discovery to locate hidden assets. Certain income, such as Social Security, is exempt. Judgments typically remain enforceable for ten to twenty years depending on the state and can usually be renewed, so if the defendant’s finances improve later, you can collect then. But many individual thieves are incarcerated, overseas, or insolvent. This collection reality is why experienced attorneys often steer victims toward FCRA claims against bureaus and creditors rather than direct suits against the thief.
Restitution Through a Criminal Case
If the thief is caught and prosecuted, you may recover money without filing a separate civil suit. Federal law requires courts to order restitution when a defendant is convicted of a property offense committed through fraud or deceit and an identifiable victim suffered financial loss.7Office of the Law Revision Counsel. 18 U.S. Code 3663A – Mandatory Restitution to Victims of Certain Crimes The sentencing judge orders repayment as part of the criminal sentence. Many states have similar mandatory restitution provisions.
The advantages are real: no filing fees, no need to hire a lawyer, and the government’s prosecution does the work. The limits matter too. You don’t control the process, prosecutors decide whether and how to charge the case, and restitution covers only direct financial losses, not emotional distress or punitive damages. If you’re a victim in a criminal identity theft case, make sure the prosecutor knows the full extent of your losses before sentencing.