When someone is attacked, robbed, or assaulted on another person’s property, premises liability for third-party criminal acts allows the victim to pursue the property owner for the resulting injuries, even though the owner did not commit the crime. The theory, often called negligent security, applies when an owner knew or should have known about a risk of criminal violence and failed to take reasonable steps to prevent it. To recover, you generally have to prove three things: the crime was foreseeable, the security on the property was unreasonably lacking, and better precautions would likely have prevented or reduced your injuries.
Whether the Owner Owed You a Duty
The owner’s obligations start with why you were on the property. Traditional common law sorts visitors into three categories.
Invitees get the most protection. If you entered for a purpose tied to the owner’s business, such as shopping, staying at a hotel, or eating at a restaurant, you are an invitee. The owner must actively inspect for hazards and address foreseeable risks, including criminal activity. Most negligent security claims arise in this category.
Licensees are social guests and others with permission to be on the property but who are not there for commercial benefit to the owner. The duty is narrower: the owner must warn you about known, non-obvious dangers but is not required to go looking for hidden ones.
Trespassers enter without permission and receive the least protection. The owner’s only duty to an adult trespasser is to avoid deliberately causing harm. Children are the exception. Under the attractive nuisance doctrine, owners must protect child trespassers from dangerous conditions that could lure them onto the property, such as unfenced pools or abandoned machinery.
About half the states still apply these categories strictly. The rest have moved toward the approach in the Restatement (Third) of Torts, which applies a single reasonable care standard to nearly all visitors regardless of label. In those states, the question is not what category fits you but whether the owner’s conduct was reasonable under the circumstances.
When a Crime Is Legally Foreseeable
No owner is expected to prevent every random act of violence. Liability turns on foreseeability, meaning a reasonable owner in that position should have anticipated the risk. This is the element most cases are won or lost on, and courts use several overlapping tests.
Prior Similar Incidents
The most direct test looks at the property’s own crime history. Courts examine police reports and incident records for earlier crimes similar in time, location, and nature to the one that injured you. The incidents need not be identical. A gas station with three armed robberies in the past two years has clear notice that another robbery is possible.
Standing alone, this test has an obvious weakness. It can create a “first crime free” problem, where the first violent act is never foreseeable because nothing like it happened before. That is why many jurisdictions have broadened the analysis.
Totality of the Circumstances
A growing number of courts consider the full picture: the nature of the business, the neighborhood’s crime rate, the hours of operation, and the owner’s own knowledge of risk. A bar serving alcohol until 2 a.m. in a high-crime area faces a higher expectation of security than a suburban daycare, even if no one has yet been attacked at the bar. Under this test, a high-crime neighborhood alone does not create a duty to guard against every conceivable crime, but it is relevant, especially combined with warning signs like known drug activity or repeated tenant complaints.
Imminent Harm the Owner Already Knows About
The strongest foreseeability case arises when the owner or employees learn of a specific, imminent threat and do nothing. Security staff who see someone brandishing a weapon in a parking garage, or a hotel manager who learns a guest is threatening another guest, cannot ignore the warning. At that point the question is not whether crime was generally foreseeable but whether the owner stood by while a known danger materialized.
What Counts as Inadequate Security
Once foreseeability is established, the next question is whether the owner’s security measures were reasonable. There is no universal checklist. Reasonableness depends on the property type, location, and risk level. But certain failures appear repeatedly.
Poor lighting is the single most common piece of evidence in these claims. Dark parking structures, unlit stairwells, and shadowy walkways create the conditions criminals exploit. Burnt-out bulbs left unreplaced, or no lighting at all in places people walk alone at night, are the kind of cheap, obvious fixes juries do not forgive.
Broken physical barriers come up almost as often. Nonfunctioning locks on exterior apartment doors, perimeter gates left broken for weeks, propped-open fire exits. Courts look at maintenance logs and tenant complaints to see how long the owner knew. A lock broken yesterday is not the same as one tenants reported three months ago.
Security personnel are evaluated against the property’s risk profile. A large mall or entertainment venue may need trained, uniformed guards. A small apartment complex might reasonably rely on a night watchman or regular patrols. What matters is whether staffing matched foreseeable risk.
Surveillance systems can cut either way. Cameras that record and are actively monitored support the owner. Cameras that are broken, aimed at the wrong areas, or not actually recording can hurt the owner, because they suggest a recognized security need met with a prop instead of a real measure. Courts have treated dummy cameras and nonfunctional systems as evidence of inadequate security.
An owner cannot escape liability by claiming ignorance of a security problem. Under the doctrine of constructive notice, an owner is treated as knowing what reasonable diligence would have revealed. A broken gate reported by multiple tenants, or a dead camera that any routine inspection would have caught, counts against the owner even without proof they personally knew.
Connecting the Security Failure to the Harm
Bad security is not enough on its own. You also have to prove the inadequate security actually caused or contributed to the crime that injured you. This gets difficult because the immediate cause of the harm was the criminal.
The starting point is the but-for test: would the crime have happened if the owner had provided reasonable security? If you were attacked in a pitch-black parking garage, the question is whether adequate lighting would have deterred the attacker or given you a chance to see and escape. If a building’s front door lock had worked, would the intruder have gotten in? This is not about certainty. It is about whether better security would have meaningfully reduced the likelihood of the attack.
Even when inadequate security contributed to the crime, the owner is liable only for harms that flow naturally from the failure. A hotel’s broken lobby lock may support liability for an assault in the hallway but probably not for an unrelated crime on a different floor through a window the intruder never used. The specific failure has to connect to the specific opportunity the criminal exploited.
Property owners frequently argue that the criminal’s intentional act was a superseding cause that breaks the chain between their negligence and the injury. The logic is that the criminal’s independent decision to commit violence is the real cause. This defense fails more often than it succeeds. If the whole point of the security measures was to prevent this type of crime, the crime cannot be treated as an unforeseeable interruption. A foreseeable criminal act is, by definition, not extraordinary enough to be a superseding cause. The defense works better when the crime was genuinely bizarre or unrelated to the risk the security was meant to address.
How Fault Gets Divided
Even when every element is proven, what you actually collect depends on how fault is allocated. The rules vary sharply by state, and this is where owners fight hardest to reduce what they owe.
The most consequential question is whether the jury can put a percentage of fault on the criminal. In states that have abolished joint and several liability, defendants can ask the jury to place the attacker’s name on the verdict form and divide fault between the negligent owner and the intentional attacker. Juries tend to assign heavy blame to the person who pulled the trigger or threw the punch, which can reduce the owner’s share to a fraction of the total damages.
Courts are deeply split on whether this is fair. Some allow it, reasoning that negligent and intentional conduct can be compared on the same scale. Others prohibit it, holding that a negligent owner should not reduce liability by pointing at the very harm they had a duty to prevent. A handful of states fall in between. Where your case is filed can be the difference between full compensation and a token recovery.
Your own conduct matters too. Under comparative fault, a jury can reduce your recovery by the percentage of blame assigned to you. If you ignored obvious warning signs, walked alone through a notoriously dangerous area at 3 a.m. when a safer route was available, or returned to a place where you had already been threatened, the owner will argue you share responsibility.
The stakes depend on which version of comparative fault your state uses. In pure comparative fault states, your damages are reduced by your percentage of fault no matter how high. Even at 90 percent fault, you recover 10 percent. In modified comparative fault states, which make up over 30 jurisdictions, you recover nothing if your fault exceeds a threshold, typically 50 or 51 percent.
Defenses Owners Commonly Raise
Beyond fault allocation, owners have several affirmative defenses.
Assumption of risk applies when a victim voluntarily encountered a known danger. Express assumption usually involves a signed waiver, common in some recreational settings. Implied assumption is harder: the owner must show you actually knew about and appreciated the specific danger, not just that danger was theoretically possible. In most states, this defense has been folded into comparative fault rather than treated as a complete bar.
The open and obvious doctrine says an owner is not liable for conditions that would be apparent on casual inspection. The defense is powerful in slip-and-fall cases but awkward in criminal violence claims. A dark parking lot is obviously dark, but whether the risk of being attacked there is obvious is a harder sell. Courts have generally been skeptical of this defense in third-party crime cases.
Damages You Can Recover
Successful claims produce three categories of damages.
Economic damages cover losses with a dollar figure attached: medical bills past and future, lost wages, diminished earning capacity, rehabilitation costs, and out-of-pocket expenses. These require documentation, including hospital records, pay stubs, and expert projections of future care.
Non-economic damages compensate for harm without a receipt: physical pain, emotional distress, loss of enjoyment of life, and psychological trauma like PTSD. Violent crime victims often suffer severe non-economic harm, and these damages can exceed economic losses by a wide margin. Some states cap non-economic damages in certain case types, though most do not apply caps to standard premises liability claims.
Punitive damages are available only when the owner’s conduct exceeds ordinary negligence. Most states require clear and convincing evidence of willful and wanton disregard for safety, malice, or conscious indifference. A landlord who ignored dozens of complaints about a broken security gate after multiple assaults in the building might face punitive damages. A landlord who simply failed to upgrade an outdated camera system probably would not.
What to Do Right After the Attack
If you have been the victim of a crime on someone else’s property, the most time-sensitive issue is evidence, especially surveillance footage. Retention periods vary wildly. Some businesses overwrite recordings daily. Others keep footage for a few weeks. Once it is gone, it is gone, and that footage may be your strongest evidence of both the conditions and the attack itself.
- Send a preservation letter immediately. A written demand to the owner or management company requiring them to preserve all surveillance footage, incident reports, maintenance logs, and security staffing records prevents a later claim that evidence was routinely destroyed. An attorney can send this, or you can do it yourself, but do it within days of the incident.
- File a police report. The report is evidence, and many businesses have internal policies that trigger video preservation once an incident report exists.
- Document the scene yourself. Photograph lighting conditions, broken locks or gates, and your injuries. Note the date, time, and names of any witnesses or employees present.
- Get medical treatment and keep records. Gaps in treatment become ammunition for the defense to argue your injuries were not as serious as claimed.
Owners who destroy or fail to preserve evidence after being put on notice face spoliation sanctions. Courts can instruct juries to assume the missing evidence would have been unfavorable to the owner, a powerful inference that effectively punishes destruction.
Filing Deadlines
Premises liability claims are subject to statutes of limitations ranging from one to six years depending on the state, with two years being the most common deadline for personal injury claims. Miss the deadline and your claim is barred no matter how strong it is.
Several things can affect the clock:
- The discovery rule can pause the limitations period when injuries are not immediately apparent. The clock starts when you knew or reasonably should have known about the injury and its connection to the owner’s negligence. This matters most for psychological injuries that surface months later.
- Minors and incapacitated individuals often get additional time, with most states tolling the statute of limitations until a minor reaches the age of majority.
- Statutes of repose in some states impose an absolute outer deadline that cannot be extended by the discovery rule or tolling.
When the Property Is Government-Owned
If the attack happened on government-owned property such as a public housing complex, a government building, or a municipal parking garage, the rules change and the deadlines shrink. Claims against state and local government entities typically require an administrative notice of claim within 90 to 180 days of the incident, far shorter than the standard statute of limitations. Missing this notice deadline usually kills the claim entirely.
For federal property, the Federal Tort Claims Act requires a written administrative claim with the responsible agency within two years of the incident. If the agency denies the claim, you have six months from the date of the denial letter to file suit in federal court.1Office of the Law Revision Counsel. 28 USC 2401 – Time for Commencing Action Against United States The claim must be presented on a Standard Form 95 or equivalent written notice that includes a specific dollar amount for damages.2eCFR. 29 CFR Part 15 – Administrative Claims Under the Federal Tort Claims Act