California’s Identity Theft Act: A tool to protect consumers after the Equifax Breach of 2017

    California’s Identity Theft Breachs of 2020

    Every two seconds, a consumer falls victim to identity theft. In fact, the White House recently acknowledged that identity theft is the fastest growing crime in America, resulting in the loss of $16 billion from 12.7 million U.S. consumers in 2014 alone. The trend continues, given the September 2017 Equifax hack that exposed an estimated 143 million American consumers to further identity theft. The question becomes, what can we do as attorneys to protect our clients from debt collectors that insist upon collecting fraudulent accounts from victims of identity theft.

    As merely one example to set the stage, “FC” hired live-in caregivers after FC’s mother was diagnosed with a mental disability. Thereafter, one of the caregivers met a man online who then moved into FC’s mother’s home. While living there, the man stole the mentally disabled woman’s identity and utilized said identity to purchase multiple vehicles, open numerous credit cards and obtain student loans despite not even being a student. When FC discovered these issues, FC expended hours upon hours attempting to close the accounts. Despite FC’s pleas and compliance with all demands from the creditors, the creditors repeatedly said the mentally disabled woman was liable for the debts. After years of no success, FC was forced to retain the services of the law firm at which I work to force creditors to stop collecting the fraudulent debts from FC and to remove the debts from FC’s credit report. Through contentious litigation, FC finally won in court and successfully closed each of the fraudulent accounts.

    FC’s victory was made possible, in part, by California’s Identity Theft Act, Cal. Civ. Code Section 1798.92 et seq. (“CITA”). This powerful statute forces creditors and debt collectors to investigate claims of fraudulent accounts upon receipt of written notice of the claims. Pursuant to CITA, “a person may bring an action against a claimant to establish that the person is a victim of identity theft in connection with claimant’s claims against a person.” Prior to bringing an action, however, the aggrieved consumer must send a copy of a police report to the entity that is attempting to collect the fraudulent debt. If, and only if, collection activity continues after the 30-day period following the entity’s receipt of the police report, the consumer is then entitled to bring a lawsuit.


    If you are going to represent a victim of identity theft, your initial intake of the consumer will be crucial in developing a strong case that will be ready for trial or even one that can survive motion practice. Once you have all of the information listed below, at a minimum, you should assist your client in organizing the relevant documents and preparing an explicit dispute for all entities that have attempted to collect the fraudulent debts, including the credit bureaus. The more information and supporting documents, the better. Vague and/or flippant disputes provide entities with sturdy defenses during the course of litigation.

    An important caveat to keep in mind during the intake process is that many consumers have learned that claims of identity theft will allow them to avoid legitimate debts. Discovery of such tactics rightfully make businesses skeptical of any identify theft claims, to the detriment of the actual victims. A thorough intake process in conjunction with an objective analysis will help avoid the filing of lawsuits on behalf of fraudsters.

    Prior to seeking the documents listed below, you have a detailed and thorough conversation with the consumer about the situation. What debt(s) are at issue? How did the consumer find out about the identity theft? Was it an account that the consumer initially opened but was later compromised? Has the consumer disputed the account(s)? The answers to these questions will help you shape your investigation as well as evaluate the consumer’s credibility. If the consumer’s claim is believable, you should move forward with the document-gathering stage.


    As stated above, providing written notice to a claimant (i.e., creditor and/or debt collector) at least 30 days prior to filing the action is required under CITA. Ideally, the consumer has already obtained the police report and has begun the dispute process before seeing you. If not, it is important to tell your client that the police report is the first document he or she will need to obtain for you. The inconvenience of obtaining this document will be very telling for you. Individuals who are simply hoping to get out of the debt easily will just fade away. On the other hand, individuals who have legitimate identity theft claims will do anything that you ask them to do in order to successfully resolve the situation. This willingness is also a good sign that the individual will participate in written discovery, depositions, mediation, trial, and other parts of the dispute resolution process.

    FTC Identity Theft Affidavit
    While not required by CITA, many businesses do require a copy of an FTC Identity Theft Affidavit to substantiate identity theft claims. A copy of the form of affidavit is available at The information called for by the affidavit will be similar the information appearing in the police report, but taking the affirmative step of completing the form of affidavit will further substantiate the consumer’s identity theft claims.

    Driver’s License and Social Security Cards
    A driver’s license and social security card provide great assistance in resolving identity theft disputes expeditiously.

    First, a driver’s license has the consumer’s photograph; height; weight; eye color; hair color; address; and, signature sample. Notifying the claimant of these physical attributes will either resolve the dispute quickly or provide great evidence of the validity of the identity theft claims. For example, video or photographic evidence of an individual of a different gender or race should be enough to convince the business claimant that the consumer is the victim of identity theft. If not, ignoring such unequivocal and readily available evidence will make it difficult for the claimant to prove that it conducted a reasonable investigation into the identity theft claim.

    Second, the social security card can also help convince the claimant that the consumer is the victim of identity theft. It is not uncommon for slightly incorrect social security numbers to be utilized to open accounts fraudulently. A social security number in a claimant’s files that is different than the social security number on the social security card is strong evidence that the identity claims are legitimate.

    Signature Samples

    It is good practice to have the consumer include signature samples as part of the dispute. In addition to reviewing the consumer’s driver’s license, you should have the consumer sign a piece of paper three to five times. Providing the additional examples of a genuine signature will enable the business claimant to compare signatures and investigate whether the signature on the allegedly fraudulent application is a forgery.

    Once the consumer has provided the documents described above, at a minimum, you should assist the consumer in preparing a dispute that has each of these documents organized in a logical manner. As stated above, the more information, the better. It is best to give the claimant everything you have and to do everything you can to prove at this early stage that the account is fraudulent. If the claimant agrees, you will save the consumer months and/or years of contentious litigation. If the claimant disagrees, you have significant evidence that shows the consumer’s good faith attempts to resolve the dispute without litigation. Such good faith evidence will make it easier for the jury to award six or seven figures in damages at trial.

    You should keep in mind that much of this information is highly sensitive and confidential. You should not merely transmit such information via U.S. mail. Such method of mailing may expose your client to further identity theft. It is better to submit the dispute packs via certified mail, facsimile, and/or e-mail.


    With the potential for high damages as well as other fraudulent claims of identity theft, some sort of Motion to Dismiss or Demurrer should be expected from the creditor. Therefore, you may need to spend many hours in carefully drafting the Complaint. Not only do you need to make sure that the Complaint states a prima facie claim, it is also important that you thoroughly explain each dispute. How was the dispute sent (i.e., facsimile, certified mail, e-mail)? What documents did the dispute include? What was the response to the dispute by the claimant(s) and/or credit bureaus? The answers to these questions will help substantiate claims for pecuniary loss, emotional distress, and, if applicable, punitive damages.


    Discovery in identity theft matters is highly involved and may require significant information from non-parties. It is important to request 10 to 12 months to conduct discovery to make sure that nothing is missed. While the information required to support the consumer’s claims will vary, the following documents, at a minimum, are often needed in each case.


    Obviously, the fraudulent application and/or contract will provide a plethora of information.

    How was it signed? E-signature or handwritten signature? If handwritten, you should compare the signature on the application or contract to your client’s signature. At this stage, you should have at least seven examples to look at: one from the driver’s license, five signature samples provided with the dispute, and one on your retainer agreement. If the fraudulent application or contract was e-signed, discovery of third parties will be required. What e-signature company was utilized? Where was the document signed? If online, you will need to subpoena various documents such as documents that establish an I.P. (internet protocol) address. If in person, whether e-signature or handwritten, you will need to obtain footage and/or photographs from security cameras.


    The collection letters will answer many questions, too. Most importantly, where were the collection letters sent? If not to your client, then to what address? Investigation of the actual owner of the address can provide significant evidence required to convince the jury that your client is a victim of identity theft.


    Why such evidence is necessary should be obvious and has been discussed in this article. Obtaining the evidence, however, may prove to be difficult. While a telephonic meet-and-confer should convince defense counsel why you are entitled to such evidence, you should make sure that you are readily familiar with Chamber Rules regarding discovery disputes so no inadvertent waivers occur.


    A percipient witness is one who testifies about things the witness actually saw, heard or otherwise experienced. Such witnesses on the consumer’s side may include family members, co-workers, and/or friends who saw the effect the dispute process had upon your client.

    You will need to learn from the defense the identity of any individuals who handled the account on behalf of the business claimant. From these individuals, you will learn what policies and procedures, if any, are in place to avoid collection upon fraudulent accounts and how the account itself was initially opened. You should keep in mind, however, that the debt collection industry has a regular turnover of employees. If a former employee handled the account, you should attempt to obtain the former employee’s last known address in order to issue subpoenas. Testimony from such former employees can significantly benefit your case.


    In most identity theft cases, the consumer will need to subpoena at least two expert witnesses.
    One expert will be needed to quantify the actual monetary loss your client incurred (i.e., pecuniary loss). Such losses typically are incurred by victims of identity theft in the form of interest rates that are higher than what they would have been if not for the fraudulent account, lost business opportunities, loss of ability to benefit from creditworthiness, and the like.

    Another expert will be needed to quantify emotional distress. Ideally, your client will have visited a doctor regarding the stress your client experienced prior to retaining your services. The consumer’s doctor—potentially a percipient witness—can discuss the effect the collection of the fraudulent account had upon your client. The doctor can also assist in explaining the continued emotional distress. Some doctors, however, do not wish to be involved in litigation of any kind. If that is the case with your client’s doctor, you will need to find a doctor who can meet with your client and conduct an independent medical evaluation.

    Other experts may be required depending on the facts of the case. If credit reporting is an issue, a Fair Credit Reporting Act expert will be a great benefit to the jury. Another possible expert would be a forensic computer consultant. Whether intentional or not, important evidence can be purged from the business claimant’s system. While the business may think that it is impossible to recover, such experts may have methods to restore this essential evidence.

    While many of the foregoing concepts will be easily understood by the attorneys and the judge, the average juror will have great difficulty understanding the damages and then affixing a dollar amount to said damages.


    While obtaining a summary judgment outright may be difficult, summary adjudication, at a minimum, is important. As is evident from this article, proving identity theft claims at trial involves a significant amount of evidence coming in through a large number of witnesses over a number of days. The more you can narrow the issues for the jury, the less likely they will be to lose track of the information that matters.


    Similarly, trial preparation will take months of planning. Establishing your client’s story in the most effective way can be done through any number of methods. To assist you in determining what would present your client’s situation in the best light, consider utilizing a focus group and/or a mock trial. The individuals who sit for any of such preparation tools should be average consumers unrelated to you, your law firm or your client in any way. This will ensure honest feedback that can greatly benefit your case.

    Another consideration is witness order. Ideally, you will call your witnesses in a chronological or other order that naturally develops your story. In practice, though, witness availability rarely lines up with exactly how you need it. To best ensure a logical flow of witnesses, you should discuss trial dates as early as possible with your anticipated witnesses.


    If successful, a victim of identity theft is able to recover actual damages, attorneys’ fees, costs and equitable relief. On top of these damages, the victim may also recover up to $30,000.00 in the form of a civil penalty from the business claimant. Any attorney who brings such an action should also be mindful of the Fair Debt Collection Practices Act, 15 U.S.C. § 1692 et seq.; the Rosenthal Fair Debt Collection Practices Act, Cal. Civ. Code § 1788 et seq.; the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq.; and the California Consumer Credit Reporting Agencies Act, Cal. Civ. Code § 1785.1 et seq. Such statutes, in conjunction with CITA, should address all of the negative repercussions of the thief’s actions by ending collection communications and wiping the victim’s credit report of any trace of the fraudulent account(s).

    The Equifax Data Breach is a further reminder that our technological society is going to continue to put our personal information and finances at risk. While many banks and lenders are quick to provide money to individuals with minimal effort, these same entities place enormous hurdles on consumers seeking to be relieved of these fraudulent accounts. Often, litigation is the only way for consumers to remedy their financial reputation.

    1. Cal. Civ. Code § 1798.93(a); and Peters v. Discover Bank, 2016 U.S. App. LEXIS 7254, at *1-2 (9th Cir. 2016)

    2. Satey v. JPMorgan Chase & Co., 521 F.3d 1087, 1092 (9th Cir. 2008) citing to Cal. Civ. Code § 1798.93(a)(6)(A).

    3. Cal. Civ. Code § 1798.93(a)(6)(A).

    4. See Cutler ex rel. Jay v. Sallie Mae, Inc., 2015 U.S. Dist. LEXIS 58157, at *20 (C.D. Cal. 2015) citing to Toroussian v. Asset Acceptance, LLC, 2013 U.S. Dist. LEXIS 145007, at *3 (C.D. Cal. 2013).