Washington Scam and Fraud Laws: Reporting and Your Right to Sue (2026)

Washington's Consumer Protection Act (CPA) does not limit its private lawsuit to a defined "consumer." It belongs to "any person who is injured in his or her business or property" by an unfair or deceptive act in trade or commerce. A person who proves all five elements the Washington Supreme Court requires, including an impact on the public interest, recovers actual damages plus the costs of the suit and a reasonable attorney's fee, and the court may, in its discretion, increase damages up to three times, with the increased award capped at $25,000. The deadline is four years.

Washington's protections for older adults are split in two. Theft from a vulnerable adult is a felony that can be charged against any thief, but the special civil lawsuit for vulnerable adults (RCW 74.34.200) only reaches facilities, home care agencies and individual care providers, not a stranger who scammed someone. A bank that suspects exploitation may, but does not have to, hold a disbursement for a few business days. And Washington has no law specific to crypto ATMs in force: the 2025-2026 kiosk bills did not pass.

Information last verified on October 2, 2026. This article has not been reviewed by a licensed lawyer.

Jurisdiction scope: This guide covers Washington state law: the Consumer Protection Act (chapter 19.86 RCW), Washington complaint offices, Washington protections for vulnerable adults (chapter 74.34 RCW and the theft statutes), Washington's anti-phishing, immigration-assistance, telemarketing and securities laws, and Washington deadlines for suing. Federal refund and reporting rights are summarized briefly and covered in depth on our national guides. Out of scope: criminal defense, and the law of other states (if the scammer or business is elsewhere, that state's law may also matter).

First steps if you were scammed in Washington

Contact the bank, card issuer, payment app, wire company or crypto exchange that moved your money right away. That company is usually the only one that can stop or reverse a payment, and your federal rights depend on how you paid. Our guide on how to get money back after a scam walks through each payment method, and the Zelle and payment app guide covers app transfers. If the bank says no, see what to do when a bank refuses a scam refund.

Then report the scam. Most scams go to the FTC at ReportFraud.ftc.gov and online crime to the FBI's IC3; our where to report a scam guide lists every federal channel. The Washington offices below are in addition to those, not instead of them. If the scammer has your Social Security number, bank login or other personal data, start with what to do if a scammer has your information.

Where to report a scam in Washington

What the Attorney General can and cannot do. The office says: "We offer an informal complaint resolution service to Washington state residents, and to consumers with complaints about businesses located in Washington state. Through this process, we contact businesses to determine their response to consumer complaints. If a business refuses to respond or to make an adjustment, we cannot compel them to do so." It also says it "is authorized to bring legal action only in the name of the State of Washington, and is prohibited from serving as an attorney for individual consumers." Its call centers are open Monday through Friday, 10 a.m. to 3 p.m.; the TTY relay line is 1.800.833.6388.

In its own lawsuits, the Attorney General can ask a court for orders "to restore to any person in interest any moneys or property" taken by a prohibited practice (RCW 19.86.080(2)). That depends on the state choosing to sue; it is not a claim you can file.

What DFI does. DFI regulates Washington state-chartered banks and credit unions, money transmitters and currency exchangers, "virtual currency and cryptocurrency companies," and investment professionals. Its page says: "We will review your complaint and work with you and the company to try to resolve it." DFI's phone line is open Monday through Friday, 8 a.m. to 5 p.m. Pacific. DFI itself points complaints about a company it does not regulate, such as a national bank, to that company's regulator, sends general scam, fraud and identity theft reports to the FTC, and sends online investment and crypto scams to the FBI's IC3.

Washington's Consumer Protection Act: can you sue?

Washington's CPA declares unlawful "Unfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce" (RCW 19.86.020). The private lawsuit is in RCW 19.86.090:

"Any person who is injured in his or her business or property by a violation of RCW 19.86.020 ... may bring a civil action in superior court to enjoin further violations, to recover the actual damages sustained by him or her, or both, together with the costs of the suit, including a reasonable attorney's fee."

Washington's act does not limit this right to a defined "consumer" who bought goods or services. The condition is different: you must have been injured in your "business or property."

The five elements

The statute's words are only the start. In Hangman Ridge Training Stables v. Safeco Title Insurance Co., 105 Wn.2d 778 (1986), the Washington Supreme Court held: "to prevail in a private CPA action and therefore be entitled to attorney fees, a plaintiff must establish five distinct elements: (1) unfair or deceptive act or practice; (2) occurring in trade or commerce; (3) public interest impact; (4) injury to plaintiff in his or her business or property; (5) causation."

All five are required. Three of them matter most for a scam victim:

• Trade or commerce. The act defines it to include "the sale of assets or services, and any commerce directly or indirectly affecting the people of the state of Washington" (RCW 19.86.010(2)). That is broad, and the act tells courts it "shall be liberally construed that its beneficial purposes may be served" (RCW 19.86.920). Whether a particular individual's scam counts as trade or commerce depends on the facts; a Washington lawyer can tell you how courts have treated situations like yours.
• Public interest. RCW 19.86.093 lets a plaintiff show the act is injurious to the public interest because it violates a statute that incorporates the CPA, violates a statute with a specific declaration of public interest impact, or "(a) Injured other persons; (b) had the capacity to injure other persons; or (c) has the capacity to injure other persons."
• Injury to business or property. The court in Panag v. Farmers Insurance Co. of Washington, 166 Wn.2d 27 (2009), said that "Investigation expenses and other costs resulting from a deceptive business practice sufficiently establish injury."

Identity theft is tied directly to the CPA. RCW 9.35.800 makes a violation of Washington's identity theft statutes "an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the Consumer Protection Act," and says nothing in those statutes "limits a victim's ability to receive treble damages under RCW 19.86.090." Our Washington identity theft guide covers those laws.

What you can recover

A plaintiff who proves the five elements recovers actual damages, the costs of the suit and a reasonable attorney's fee. The extra damages are up to the judge and capped:

"In addition, the court may, in its discretion, increase the award of damages up to an amount not to exceed three times the actual damages sustained: PROVIDED, That such increased damage award for violation of RCW 19.86.020 may not exceed twenty-five thousand dollars"

So trebling is never automatic, and the increased damage award cannot go above $25,000 however large the loss. The court can also order the defendant to stop (an injunction). The section sets no minimum statutory damages.

You can also bring the claim in district court, for actual damages up to the district court's limit set in RCW 3.66.020, with costs and reasonable attorney's fees. The district court has the same discretion to increase damages up to three times, and the same $25,000 cap on the increased award.

The deadline

RCW 19.86.120 says a CPA damages claim "shall be forever barred unless commenced within four years after the cause of action accrues." If the Attorney General sues over the same matter, the running of that period is suspended while the state's case is pending.

The text of RCW 19.86.090 contains no requirement to send a demand letter before suing. Whether any other rule applies to your case is a question for a Washington lawyer.

Who the act does not reach

RCW 19.86.170 says the chapter does not apply to "actions or transactions otherwise permitted, prohibited or regulated under laws administered by the insurance commissioner of this state, the Washington utilities and transportation commission, the federal power commission or actions or transactions permitted by any other regulatory body or officer acting under statutory authority of this state or the United States." A proviso in the same section keeps conduct regulated by the insurance commissioner subject to the CPA's ban on unfair or deceptive acts (RCW 19.86.020), except that nothing required or permitted by the insurance code (Title 48 RCW) is a violation. It does not name banks or credit unions. The Washington Supreme Court has held that RCW 19.86.170 "does not exempt actions or transactions merely because they are regulated generally" and that the exemption "applies only if the particular practice found to be unfair or deceptive is specifically permitted, prohibited or regulated" (Vogt v. Seattle-First National Bank, 117 Wn.2d 541 (1991)). Whether a bank's handling of a scam payment is exempt depends on the rules that govern that specific practice; ask a lawyer. A scammer's fraud is not conduct a regulator permits.

The honest limit

A CPA case needs a defendant you can identify, serve and collect from. That often works against a Washington business, a contractor or a seller with a real address. It usually does not work against an anonymous scammer who called from a spoofed number or vanished with crypto, and a judgment does not help if nobody can be found to pay it. Our guide on when a lawyer helps after a scam covers how to tell the difference.

Protections for older and vulnerable adults in Washington

Washington's protections turn on who counts as a "vulnerable adult," and the definition is not just about age. Under RCW 74.34.020, it includes a person "Sixty years of age or older who has the functional, mental, or physical inability to care for himself or herself," and also people subject to a guardianship, people with a developmental disability, people admitted to a facility, and people receiving home health, hospice, home care or individual-provider services. Being 60 or older is not enough on its own.

"Financial exploitation" in the same section means "the illegal or improper use, control over, or withholding of the property, income, resources, or trust funds of the vulnerable adult by any person or entity for any person's or entity's profit or advantage other than for the vulnerable adult's profit or advantage."

Theft from a vulnerable adult is a felony

RCW 9A.56.400 makes it theft from a vulnerable adult in the first degree, a class B felony, to commit theft of property or services exceeding $5,000 in value of a vulnerable adult; theft of more than $750 up to $5,000 is second degree, a class C felony. The defendant "must have known or should have known that the victim was a vulnerable adult." This statute does not require that the thief held a position of trust, so it can reach a stranger. The theft chapter uses its own definition of vulnerable adult (RCW 9A.56.010), covering a person 18 or older who is functionally, mentally or physically unable to care for themselves, or who has a cognitive impairment other than voluntary intoxication.

Washington's identity theft statute also treats targeting older victims as more serious. Identity theft is first degree, a class B felony, when the value exceeds $1,500 "or when the accused knowingly targets a senior or vulnerable individual" (RCW 9.35.020(2)).

The civil lawsuit is narrow

RCW 74.34.200 gives a vulnerable adult a cause of action "for damages on account of his or her injuries, pain and suffering, and loss of property," and a prevailing plaintiff "shall be awarded his or her actual damages, together with the costs of the suit, including a reasonable attorneys' fee." But it applies only to a person residing in a facility, or residing at home and receiving care from a home health, hospice or home care agency or an individual provider, and the defendant must be a facility or a licensed home health, hospice or home care agency (including its employees, agents, officers or directors), or an individual provider. It does not reach a stranger who scammed an older person.

A broader tool exists for stopping ongoing exploitation. Under RCW 74.34.110, "A vulnerable adult, or interested person on behalf of the vulnerable adult, may seek relief from abandonment, abuse, financial exploitation, or neglect," through the protection-order procedures in chapter 7.105 RCW.

Banks may hold a payment, but do not have to

Under RCW 74.34.215, if a financial institution "reasonably believes that financial exploitation of a vulnerable adult may have occurred, may have been attempted, or is being attempted, the financial institution may, but is not required to, refuse a transaction requiring disbursal of funds." The hold can cover the vulnerable adult's account, an account on which the vulnerable adult is a beneficiary, or an account of a person suspected of the exploitation.

An institution that refuses a transaction must make a reasonable effort to notify all parties authorized to transact business on the account, and must report the incident to Adult Protective Services and local law enforcement. The refusal expires at the soonest of: ten business days if the transaction involved selling a security, five business days if it did not, or when the institution is satisfied the disbursement will not result in exploitation. A court may extend it. If you are worried about a parent's account, telling the bank directly that you suspect a scam can give it reason to act, though the decision to hold a payment stays with the bank (RCW 74.34.215(3)).

Who must report

Washington's list of mandated reporters (RCW 74.34.020) covers groups such as law enforcement officers, social workers, health care providers and employees of care facilities and home care agencies. It does not list banks or brokers. Under RCW 74.34.220, financial institutions must train their employees on exploitation, and an employee who reports in good faith is protected from liability as a permissive reporter. Anyone can report: Adult Protective Services takes reports at 1-877-734-6277 or online, at any time.

For fraud against anyone 60 or older, the federal DOJ National Elder Fraud Hotline (833-372-8311) can also help you report. Our elder fraud guide covers the federal side.

Washington scam laws on the books

Anti-phishing law, with a private right to sue

RCW 19.190.080 makes it a violation "to solicit, request, or take any action to induce a person to provide personally identifying information by means of a web page, electronic mail message, or otherwise using the internet by representing oneself, either directly or by implication, to be another person, without the authority or approval of such other person." Under RCW 19.190.090(1), a person who is injured under the chapter can sue a person who directly violates that section for "up to five hundred dollars per violation, or actual damages, whichever is greater." Richer remedies in the same section are reserved for internet service providers, web page owners and trademark owners. For how phishing works and what to do if you clicked, see our phishing, smishing and vishing guide.

Immigration services fraud (notarios)

Under RCW 19.154.060(1), people "other than those licensed to practice law in this state or otherwise permitted to practice law or represent others under federal law in an immigration matter, are prohibited from engaging in the practice of law in an immigration matter for compensation." A violation is a gross misdemeanor (RCW 19.154.100). Our notario fraud guide explains how these schemes work.

Telemarketing rules

A Washington telephone solicitor must identify themselves and the company "within the first 30 seconds" of the call (RCW 19.158.110(1)), and after you ask not to be called again, must not call you for "at least one year" (RCW 19.158.110(3)).

Crypto ATMs and virtual currency companies

No Washington law specific to crypto ATMs (virtual currency kiosks) is in force as of October 2026. Two 2025-2026 bills on virtual currency kiosks did not pass: according to the Legislature's records, ESB 5280 was returned to the Senate Rules Committee by resolution on March 12, 2026, and a House bill on the same subject, HB 1268, was last "reintroduced and retained in present status" on January 12, 2026. There is no Washington kiosk refund right.

What does apply: DFI licenses virtual currency companies under Washington's Uniform Money Services Act, and RCW 19.230.370 requires a virtual currency licensee to disclose, among other things, "A schedule of all fees and charges" and "A notice that the transfer of virtual currency or digital units is irrevocable and any exception to the irrevocability of transfer," separately from other information and in a clear and conspicuous manner. For an unlicensed operator, the DFI director may "compel the person to pay restitution to damaged parties" (RCW 19.230.250(3)). Complaints go to DFI (table above). Our crypto and investment scams guide covers recovery routes.

Investment fraud

Washington's Securities Act makes it unlawful, "in connection with the offer, sale or purchase of any security," to "employ any device, scheme, or artifice to defraud" (RCW 21.20.010(1)). A buyer may recover from the person who offered or sold the security in violation "the consideration paid for the security, together with interest at eight percent per annum from the date of payment," plus costs and reasonable attorneys' fees, less any income received on the security, upon tender of the security, or damages if the buyer no longer owns it (RCW 21.20.430(1)). Whether a particular crypto "investment" is a security depends on its facts. DFI's Securities Division handles complaints about investment professionals.

Suing a scammer or a business in Washington

Small claims. Washington small claims courts hear "cases for the recovery of money only if the amount claimed does not exceed: (a) Ten thousand dollars in cases brought by a natural person; or (b) Five thousand dollars in all other cases" (RCW 12.40.010(1)). That is the usual place for a modest claim against a business or an individual you can identify and serve.

Deadlines. A CPA claim has four years (RCW 19.86.120). A common-law fraud claim has three years under RCW 4.16.080(4), and the claim is "not to be deemed to have accrued until the discovery by the aggrieved party of the facts constituting the fraud." Because the CPA period is longer, check both if your dates are close. Our Washington statute of limitations guide covers other civil deadlines.

Who you can actually reach. Lawsuits work against people and businesses with a name, an address and assets. A scammer who hid behind a fake identity, a spoofed caller ID or an overseas account is usually not reachable through a Washington court. In those cases the payment company, a fast report to law enforcement, and protecting your identity are where your effort pays off. If a scammer is now trying to collect a "debt" from you, our Washington debt collection guide explains your rights.

Related guides

• Scams and fraud: your rights and where to start
• How to get money back after a scam
• Where to report a scam
• Zelle and payment app scams
• Elder fraud
• Crypto and investment scams
• Washington identity theft laws
• Washington debt collection laws
• Washington statute of limitations

Last updated: October 2, 2026.

This article is general legal information, not legal advice. For your specific situation, contact your payment company, the Washington office named above, or a lawyer licensed in Washington.

Frequently Asked Questions

Can I sue a scammer in Washington?

Possibly, if you can identify and serve them and you can prove the five CPA elements, including injury to your business or property and a public interest impact. RCW 19.86.090 lets any person injured in business or property sue, but an anonymous or overseas scammer is usually not reachable through a Washington court.

Do I have to be a consumer to sue under the Washington CPA?

No. RCW 19.86.090 gives the right to any person injured in his or her business or property by an unfair or deceptive act in trade or commerce. You still must prove all five elements the Washington Supreme Court set out in Hangman Ridge (1986).

Does the Washington Consumer Protection Act award triple damages?

Only if the judge chooses to. Under RCW 19.86.090 the court may, in its discretion, increase damages up to three times actual damages, but the increased damage award may not exceed $25,000.

Does the Washington CPA pay my attorney's fees?

If you win. RCW 19.86.090 awards actual damages together with the costs of the suit, including a reasonable attorney's fee, and the Washington Supreme Court ties fees to proving all five CPA elements.

How long do I have to sue under the Washington CPA?

Four years after the claim accrues, under RCW 19.86.120. The period is suspended while an Attorney General lawsuit on the same matter is pending. A common-law fraud claim has three years from discovery under RCW 4.16.080(4).

Will the Washington Attorney General get my money back?

Do not count on it. The office offers informal complaint resolution and contacts the business, but says it cannot compel a business to respond or make an adjustment and cannot act as an individual consumer's lawyer.

Who do I call if an elderly person in Washington is being scammed?

Report it to Adult Protective Services at 1-877-734-6277, available any time, day or night, or online. The DOJ Elder Fraud Hotline (833-372-8311) also helps with fraud against anyone 60 or older.

Can a Washington bank freeze a transaction if it suspects elder fraud?

It may, but it is not required to. Under RCW 74.34.215, a bank that reasonably believes a vulnerable adult is being exploited may refuse a disbursement for up to five business days (ten for a securities sale), unless a court extends it, and must report to Adult Protective Services and local law enforcement.

Can a vulnerable adult in Washington sue the scammer under the elder abuse law?

Not under RCW 74.34.200. That civil action reaches only facilities, home care agencies and individual providers caring for the vulnerable adult. Theft from a vulnerable adult is a felony under RCW 9A.56.400 that prosecutors can charge against anyone.

Does Washington regulate crypto ATMs?

No kiosk-specific law is in force as of October 2026. The 2025-2026 bills, ESB 5280 and HB 1268, did not pass. DFI licenses virtual currency companies and takes complaints about them.

What is the small claims limit in Washington?

$10,000 for claims brought by a natural person and $5,000 for all other claimants, under RCW 12.40.010(1).