consumer law and identity theft