Identity theft case law