Washington Identity Theft Laws: Penalties and Victim Rights

Washington's identity theft statute, RCW 9.35.020, does something unusual for a criminal law: it builds a private civil damages remedy directly into the statute itself, letting a victim recover $1,000 or their actual damages, whichever is greater, plus credit-repair costs and attorney's fees, without needing a separate civil-remedy law. This page covers the statute's two-tier penalty structure, that built-in civil remedy, Washington's victim-record-access rights, its fingerprint-based identity verification program, and the state's own minor freeze law.

This article addresses Washington state law, primarily RCW 9.35.020 and related sections of chapters 9.35, 19.182, and 19.255, plus the federal layer that applies in every state.

RCW 9.35.020: Washington's Identity Theft Statute

Under RCW 9.35.020, no person may knowingly obtain, possess, use, or transfer a means of identification or financial information belonging to another person, living or dead, with the intent to commit, aid, or abet any crime. The statute splits into two degrees based on the harm and the victim.

First-degree identity theft applies when a violation of the base prohibition also involves obtaining credit, money, goods, services, or anything of value in excess of $1,500, or when it knowingly targets a senior or vulnerable individual, and it is a Class B felony. Second-degree identity theft is defined residually, as a violation of the base prohibition "under circumstances not amounting to identity theft in the first degree," and carries no separate dollar floor of its own; it is a Class C felony. A series of transactions against one victim that individually would each qualify as second-degree, if part of a common scheme or plan, can be aggregated into a single count, with the combined total determining the degree. Someone who commits identity theft alongside another crime can be punished for both, prosecuted separately. Upon conviction, the sentencing court may also order correction of public records that contain false information resulting from the offense.

The Built-In Civil Damages Remedy

One of the more victim-favorable features of Washington's law is that RCW 9.35.020 itself creates a private civil cause of action, rather than leaving victims to rely on general tort law. A person who violates the statute "is liable for civil damages of one thousand dollars or actual damages, whichever is greater, including costs to repair the victim's credit record and reasonable attorneys' fees as determined by the court." This means a Washington identity theft victim does not need to prove actual damages exceeding $1,000 to recover something meaningful, since the statute guarantees at least that floor.

Washington's statute contains no restitution mandate of its own as part of criminal sentencing; the $1,000-or-actual-damages remedy described above is this civil cause of action, not a restitution order imposed at sentencing. Whether restitution is separately required through Washington's general sentencing statutes for felony offenses was not independently confirmed for this article.

Access to Business Records and the Consumer Protection Act

RCW 9.35.040 gives a victim a further right: any business, creditor, or merchant that dealt with the impostor must, on the victim's written request, provide copies of relevant application and transaction records, after the victim furnishes photo identification, a copy of the police report, and optionally the fingerprint-based identification statement described below. The business may charge a reasonable fee to compile the records. Critically, a violation of this right is declared an unfair or deceptive act under Washington's Consumer Protection Act, and a business's willful failure to comply entitles the victim to actual damages, plus a $1,000 penalty, plus reasonable attorney's fees, giving this record-access right real enforcement teeth.

Washington's Fingerprint Identification Program

Washington does not offer a card-based "identity theft passport" the way some states do. Instead, RCW 43.43.760(2) lets a person claiming to be an identity theft victim have their fingerprints taken by any law enforcement agency and filed with the Washington State Patrol, specifically to secure easier and more certain identification in future identity theft cases. The State Patrol then provides a printed statement confirming the holder has claimed victim status, citing the RCW 9.35.040 business-record-access right described above. That statement functions as one of the proof documents a victim can present to a business when requesting copies of fraudulent transaction records.

Police Reports

Under RCW 9.35.050, a law enforcement agency must create a police incident report when a victim reports identity theft and must provide the complainant a copy. The statute is explicit, however, that it does not require the agency to actually investigate the reported theft, only to document it. No deadline is specified for creating the report.

Washington's Minor and Protected Consumer Freeze Law

Washington has maintained its own protected consumer security freeze law since it took effect in January 2017, more than a year ahead of the 2018 federal minor-freeze right. A "protected consumer" is anyone under 16 years old at the time of the request, or an incapacitated person with an appointed guardian or limited guardian. A representative acting for the protected consumer must submit identification and sufficient proof of authority to act on their behalf. The credit reporting agency must place the freeze within 30 days of a compliant request and may not charge a fee for any service performed under the statute. Removal likewise must occur within 30 days of an affirmative request; the statute does not describe an automatic removal trigger once the protected consumer reaches adulthood, so an affirmative request remains necessary.

Breach Notification

Washington's breach notification statute, RCW 19.255.010, requires notice to affected residents in the most expedient time possible, without unreasonable delay, and no more than 30 calendar days after a breach is discovered. The notice must include the reporting business's contact information, the categories of information exposed, the time frame of exposure if known, and the toll-free phone numbers and addresses of the major credit reporting agencies if personal information was exposed. The statute does not mandate free credit monitoring. If a breach affects 500 or more Washington residents, the Attorney General must also be notified within the same 30-day window.

Reporting Identity Theft in Washington

The Washington Attorney General's identity theft page advises contacting the three credit bureaus to place a fraud alert and pulling a new credit report monthly to check for fraudulent charges, and notes the federal $50 maximum consumer liability rule when unauthorized charges are reported promptly. The office is explicit that it is authorized to bring legal action only in the name of the State of Washington and cannot serve as an attorney for individual consumers; residents file complaints through the office's general online complaint form, by mail, or by calling 1-800-551-4636 in-state.

The Federal Layer

Every Washington identity theft victim can also draw on federal protections that apply regardless of state. The Fair Credit Reporting Act's section 605b lets a victim submit a police report or FTC Identity Theft Report to block fraudulent information from appearing on their credit file. IdentityTheft.gov, run by the Federal Trade Commission, remains the fastest way to generate the initial recovery plan most other steps build on.

Information last verified on 2026-08-13. This article has not yet been reviewed by a licensed lawyer.

Related Resources

• Identity Theft Laws: Federal Rules and State Penalties
• How to Report Identity Theft
• Credit Freeze vs. Fraud Alert

---

Last updated: 2026-08-13.