Written and reviewed by Josh Kohanim, Esq., California Bar No. 328609 · Published · Reviewed
In this guide
This page was checked against the statutes, the 2026 jury instructions and the cases it cites on November 11, 2026. It is one of the guides on our negligent security page, which covers crimes on property that an owner or business could have prevented. Every case depends on its own facts, and nothing here predicts the result of any one claim.
Businesses open to the public
California's jury instruction on crime on property, CACI No. 1005 (2026 edition), says that a landlord or the owner of a business open to the public "must use reasonable care to protect" tenants, guests or patrons "from another person's criminal conduct on" the property "if the [owner/landlord] can reasonably anticipate that conduct." Whether that duty exists is decided by the judge; whether the steps the owner took were "adequate and reasonable under the circumstances" is decided by the jury.
A store, mall, gas station or convenience store owes that duty to its customers. A business is not an insurer of its customers' safety. Its general duty includes "the duty to take affirmative action to control the wrongful acts of third persons which threaten invitees where the occupant has reasonable cause to anticipate such acts" (Taylor v. Centennial Bowl, Inc. (1966) 65 Cal.2d 114, as quoted in CACI No. 1005).
The Ann M. decision
The California Supreme Court's shopping center case is Ann M. v. Pacific Plaza Shopping Center (1993) 6 Cal.4th 666. A woman working at a store in a strip shopping center was sexually assaulted by a stranger, and she sued the center for not providing guards. The California Supreme Court held that "a high degree of foreseeability is required in order to find that the scope of a landlord's duty of care includes the hiring of security guards," and that this foreseeability "rarely, if ever, can be proven in the absence of prior similar incidents of violent crime on the landowner's premises." Foreseeability means how predictable the attack was from what the owner knew. On that record, the Court concluded the center "owed no duty to Ann M. to provide security guards in the common areas."
Mall common areas
A mall owner still has to take reasonable steps in the areas it controls, even when guards are not required. As CACI No. 1005 quotes Ann M., the owner's duty includes "the duty to take reasonable steps to secure common areas against foreseeable criminal acts of third parties that are likely to occur in the absence of such precautionary measures." Common areas are the walkways, courtyards, restrooms and parking a mall controls. Crime at a neighboring business is weaker proof than crime in the mall itself. Ann M. said only that "It is possible" such crime could supply the foreseeability, and a later decision said it "can help to show" it (Castaneda v. Olsher (2007) 41 Cal.4th 1205).
Mall owners and store tenants
Where the attack happened often decides which company is responsible. Inside a store, the store's operator usually controls the space. In a mall walkway, food court or parking structure, the mall owner or its management company usually does. California's premises instruction, CACI No. 1000, covers a defendant that "owned/leased/occupied/controlled" the property, and "control alone is sufficient" (Alcaraz v. Vece (1997) 14 Cal.4th 1149, as quoted in CACI No. 1000). A security company hired by the mall or the store can be a third defendant. The lease and the security contract usually show who was in charge of patrols, lighting and cameras.
The duty to call 911
Employees who watch an attack on a customer generally must call 911 or take a similar minimal step. In Morris v. De La Torre (2005) 36 Cal.4th 260, a patron was stabbed in the parking lot of an all-night restaurant while three employees watched from inside for seven to eight minutes, and no one called 911. The California Supreme Court held that "as a general matter a proprietor's special-relationship-based duty to its patrons or invitees includes an obligation to make such a call, or to take other similar minimal measures." It called "placing a 911 call" "a well recognized and generally minimally burdensome method of seeking assistance." The Court sent the question of breach to a jury.
Limits of the duty to act
Store employees do not have to fight an attacker or put themselves in danger. Morris said there is no "absolute obligation to call 911," because a call can sometimes make things more dangerous, and that employees "have, at most, a duty" to "warn, to call 911, or to take other similar minimal action." Causation is a separate question. A jury decides whether the failure to act "caused plaintiff to incur greater injury" than the person would have suffered anyway. The minutes that passed, when 911 was finally called and how quickly police arrived are the facts that answer it.
Simple steps during an attack
A business with no duty to hire guards can still be responsible for ignoring an attack in front of its staff. In Delgado v. Trax Bar & Grill (2005) 36 Cal.4th 224, the California Supreme Court held that a business owes a "duty to respond to events unfolding in its presence by undertaking reasonable, relatively simple, and minimally burdensome measures." A store clerk who sees an attack begin is the kind of witness these cases are built on.
Measures and the notice required
California courts weigh how burdensome a safety measure is against how foreseeable the attack was. Each row below pairs a measure with the notice the cases describe.
| Measure at a store, mall or gas station | Notice usually needed | Authority |
|---|---|---|
| Hiring or posting security guards | Heightened foreseeability, usually prior similar violent crimes on the premises | Ann M. (1993); Delgado (2005) |
| Securing mall common areas with reasonable steps | Foreseeable crimes likely to occur without precautions | Ann M. (1993), as quoted in CACI No. 1005 |
| Calling 911 or warning when staff see an attack unfold | Actual notice of an attack in progress or about to happen | Morris (2005); Delgado (2005) |
| Physically stopping the attacker | Not required of employees | Morris (2005), footnote 5 |
Gas stations and convenience stores
Gas stations and convenience stores are judged by the same rule as any business open to the public: reasonable care against crime the business could reasonably anticipate (CACI No. 1005). Late hours and cash on hand do not by themselves require guards. Costly measures need prior similar crimes at that location (Ann M.), while a call for help needs only staff who see the attack (Morris). An attack at the pumps or in the lot raises the question of who controlled that area. A Court of Appeal said that general awareness of "rowdy or troublesome conduct" does not make "aggressive parking lot assaults reasonably foreseeable" (Williams v. Fremont Corners, Inc. (2019) 37 Cal.App.5th 654, as quoted in CACI No. 1005). Our guide to parking garage and parking lot attacks covers lots.
Possible defendants
When someone is attacked on property in California, the people who may be responsible include the property owner, the property management company, the security company and any business that controlled the area. Each may have its own liability insurance. California requires every licensed private patrol operator to keep commercial general liability insurance of at least $1,000,000 for any one loss or occurrence (Business and Professions Code section 7583.40). Whether a policy pays for a particular attack depends on its terms, so the policies must be obtained and read.
Large and self-insured companies
A national retailer or an institutional mall owner is a different defendant from a single-building owner. Large companies often carry insurance programs with deductibles or self-insured retentions, which means the company pays the first part of a claim itself before an insurer does. At a mall, the store and the owner of the common areas may each have separate coverage. Large companies also keep written security policies and incident records, which can show what they knew.
Punitive damages require clear and convincing evidence of oppression, fraud or malice (Civil Code section 3294), and against a company the conduct must involve an officer, director or managing agent. The California Supreme Court has said that public policy prohibits insurance from paying punitive damages (PPG Industries, Inc. v. Transamerica Insurance Co. (1999) 20 Cal.4th 310).
The attacker's share of fault
In California, a jury can assign part of the fault to the attacker. Each defendant pays only its own share of noneconomic damages, such as pain and emotional distress (Civil Code section 1431.2), and a Court of Appeal has applied that rule to a bar whose patron was assaulted by a third person (Weidenfeller v. Star & Garter (1991) 1 Cal.App.4th 1). Economic damages, such as medical bills and lost earnings, are not divided this way.
A store's or mall's own percentage of fault therefore drives much of what it pays. Our guides to when the attacker is mostly at fault and insurance and who pays explain how the shares and the policies fit together.
Evidence from the business
The evidence in a store, mall or gas station case is mostly in the business's hands. It includes inside, outside and pump camera footage; incident reports for the attack and for earlier crimes at that location; the names and statements of employees on duty; the time of any 911 call; and the security contract and patrol logs. Police calls for service to the address can show earlier trouble. Agencies must make public "the time, substance, and location of all complaints or requests for assistance" (Government Code section 7923.615). No California statute we found requires a private business to keep its video for a set time, so a written preservation letter should go out quickly. Our negligent security evidence checklist lists who holds each record.
Filing deadlines
Most California injury lawsuits must be filed within two years of the injury (Code of Civil Procedure section 335.1). Some claims have more time, including claims based on a sexual assault, which our guide to sexual assault on someone else's property explains. Our negligent security deadlines guide lists each period, and the deadline calculator gives a starting estimate. If someone died, our wrongful death page explains who can bring the claim. A fall or other hazard in a store is covered on our premises liability page.
No fee unless we recover. If there is no recovery, you owe no fee and no case costs.
Sources cited
- Judicial Council of California Civil Jury Instructions (CACI), 2026 edition, Nos. 1000 and 1005: courts.ca.gov
- Ann M. v. Pacific Plaza Shopping Center (1993) 6 Cal.4th 666: CourtListener
- Castaneda v. Olsher (2007) 41 Cal.4th 1205: CourtListener
- Morris v. De La Torre (2005) 36 Cal.4th 260: CourtListener
- Delgado v. Trax Bar & Grill (2005) 36 Cal.4th 224: CourtListener
- Business and Professions Code section 7583.40: california.public.law
- Civil Code section 3294: california.public.law
- PPG Industries, Inc. v. Transamerica Insurance Co. (1999) 20 Cal.4th 310: CourtListener
- Civil Code section 1431.2: california.public.law
- Weidenfeller v. Star & Garter (1991) 1 Cal.App.4th 1: CourtListener
- Government Code section 7923.615: california.public.law
- Code of Civil Procedure section 335.1: california.public.law