Customer Attacked on Business Property: What the Law Says and What It Means for You

Premises Liability and the Duty a Business Owes Its Customers

Premises liability is the area of law that decides when someone who owns or controls property is responsible for harm that happens to people on it. It is the starting point for any claim by a customer hurt at a business.

Within premises liability, the law sorts visitors into categories, and the category shapes the duty owed. A customer is usually treated as an invitee: a person invited onto property for the business's purpose, like shopping, dining or paying for a service. Under general common-law principles, a business owes invitees a duty of reasonable care to keep the premises reasonably safe. That duty is broader than what is owed to someone who wanders onto the property without permission.

Whether a duty existed is the threshold question. If the law does not recognize a duty in the circumstances, the claim does not move forward, however serious the injury. That is why the question of who controlled the property, and why the injured person was there, comes first.

The precise shape of this duty is set by each state's law, not by one national rule. States decide who counts as an invitee, how much protection that status carries, and how the duty applies to crimes committed by strangers. A customer in one state and a customer in another, hurt in nearly identical ways, can face different legal questions because of where it happened.

If you were hurt while visiting a business, your status as a paying or invited customer is likely to be one of the first facts that matters. Whether the business, a landlord or someone else controlled the area where it happened often matters just as much.

Negligent Security: When a Business May Be Responsible for a Criminal Attack

Negligent security is a type of premises liability claim that arises when a property owner or business fails to provide reasonable security and a visitor is harmed by another person's criminal act. The attacker is the one who committed the crime; the claim against the business is about what the business did or failed to do beforehand. A broader overview of how a negligent security claim works is on a separate page of this site.

Like other negligence claims, a negligent security claim generally rests on four elements:

• a duty the business owed to the visitor;
• a breach of that duty, meaning a failure to provide reasonable security;
• causation, meaning the failure helped bring about the harm;
• damages, meaning actual injury or loss.

Each element is considered in turn, and the requirements a claim must meet are covered in more depth elsewhere on this site.

The idea that ties these elements together is foreseeability. A business is not an insurer of everyone's safety, and it is not automatically liable each time a crime occurs on its property. The law generally asks whether the business knew, or had reason to know, that a criminal attack of this kind was a real risk.

This distinction can feel unfair to someone who was hurt. The attack was real, the injuries are real, and the business was where it happened. But an attack alone does not establish that the business was at fault. The claim turns on what the business knew or should have known, and what it did with that knowledge. For a person deciding whether to look further into what happened, that shifts the focus from the moment of the attack to the months and years before it.

Foreseeability: What the Business Knew — and When That Matters to Your Claim

Courts deciding whether a criminal attack was foreseeable usually look backward in time. They commonly consider prior similar criminal incidents on or near the property, the nature of the business, and the conditions around it. A business that has seen repeated robberies in its parking area stands in a different position from one with no history of violent crime.

One state's highest court has set out this standard in detail. In Timberwalk Apartments, Partners, Inc. v. Cain, 972 S.W.2d 749, a 1998 decision of the Supreme Court of Texas, the court addressed when one who controls premises owes a duty to invitees to protect them from the criminal acts of third parties. Under that Texas rule, the duty arises when the controller knows or has reason to know of an unreasonable and foreseeable risk of criminal acts. The Texas court looked at how close earlier crimes were to the property, how recent and frequent they were, how similar they were to the crime at issue, and how publicized they were, so that the controller knew or should have known of them.

That is Texas's rule. It is not the rule everywhere. Courts in other states frame foreseeability in their own ways. Some place heavy weight on prior similar incidents, while others look more broadly at the full set of surrounding circumstances. A national page cannot say which approach applies to a particular attack; that depends on the state where it happened.

For someone in your position, the practical point is that foreseeability is usually proven, or disproven, with records. Earlier police calls, the business's own incident reports and documented complaints can bear directly on whether the risk was one the business knew or should have known about. The shootings and assaults pages on this site look at how foreseeability questions arise in those kinds of attacks.

What Evidence Bears on a Negligent Security Claim

Two questions run through most of the evidence in these cases: did the business have notice of a foreseeable risk, and were its security measures reasonable? The records that often matter in these cases include:

• incident reports and police reports involving the property;
• prior crime reports for the surrounding area;
• surveillance footage from the property;
• security staffing records, schedules and guard logs;
• lighting inspection and maintenance records;
• the names and contact information of witnesses;
• medical records documenting the injury and treatment.

Incident and police reports can show whether the business had prior notice of criminal activity. A pattern of earlier calls about fights, robberies or assaults may bear on foreseeability, while an absence of such reports may cut the other way. Neither one settles the question alone.

Surveillance footage and security logs speak to a different issue: whether the security the business did have was working and adequate. Footage may show whether cameras covered the area, whether a guard was posted, and how the attack unfolded. Staffing records and lighting records can show what was in place that night compared with what the business had planned.

Medical records connect the attack to the harm. They document the injuries, the treatment and the course of recovery, which is how the damages element is shown.

If you were hurt, the records that usually matter are held by different people. Some are in your own hands, such as medical records and photos. Some are held by the business, a property manager or a security company. Some are held by the police. Many families find that the hardest part is not knowing which records exist or who has them, and that is often where the strength of a claim is shaped.

How Fault Is Allocated When More Than One Party May Be Responsible

Comparative fault is a rule used in many states that divides responsibility for an injury among the people whose conduct contributed to it, often by assigning each a share. In a customer attack, the parties whose conduct may be weighed can include the business, a separate property owner or landlord, a security contractor hired to protect the premises, and the attacker.

Each may have played a different role. A business may operate a store in a shopping center it does not own. The landlord may control the parking lot and its lighting. A contractor may have agreed to provide guards. Who controlled what is often as important as what went wrong, and the parking lots and garages page on this site looks at how that question plays out in shared spaces.

The attacker's criminal act does not automatically wipe out a business's potential responsibility. Courts generally examine whether the attack was a foreseeable result of inadequate security. If it was, the business's failure may still be treated as one cause of the harm, even though someone else committed the crime. A civil claim against the business is also separate from any criminal case against the attacker.

Some states use contributory fault rules instead, which can treat the injured person's own conduct very differently. States also differ on how a share of fault assigned to the injured person affects a claim, and on whether each defendant answers only for its own share.

Damages rules differ by state as well, including what categories of loss the law may allow and whether limits apply. How fault is divided can affect what the law may allow at the end of a case, which is one reason these rules are rarely a side issue.

Deadlines and State-Law Differences Worth Knowing Before You Decide Anything

A statute of limitations is a law that sets the period within which a civil claim must be filed in court. Each state sets its own period for injury claims. The clock typically begins to run on the date of the injury, and in some states it may begin when the injury was or reasonably should have been discovered. States also recognize their own exceptions, which can change when the period starts or how long it lasts.

When an attack takes a life, a different body of law usually applies. Wrongful death is a claim brought by certain family members or the estate after a person dies because of another's wrongful act or neglect. Each state's wrongful-death statute sets who may bring the claim, what the law may allow, and its own deadline. Who may step forward after a death is covered on the who can bring a claim page.

The consequence of missing a filing deadline is serious: the claim is generally barred, no matter how strong the facts may be. That is not a reason for panic, but it is a reason the question of which deadline applies, and when it began, deserves a clear answer.

Limitation periods, fault rules and damages rules all differ by state, and an attack at a business can sometimes raise more than one of them. If you are unsure which state's rules govern what happened, or when a deadline may have started, a conversation with our attorney can help you sort out which rules may apply. You can request a case evaluation through this site.