A customer sucker-punches a cashier over a refund. A drunk patron shoves a bouncer. A delivery driver pulls a knife on a clerk during a robbery attempt. These are not freak accidents. They are foreseeable risks in many businesses, and the law often treats them as the employer’s problem, not just the criminal’s problem. If you run a business, hire staff, or work in a customer-facing role, you need to understand how liability attaches when a customer harms an employee. The core question is simple: did the employer do enough to prevent a known risk? If not, the employer pays damages, even though the person who threw the punch is the one who committed a crime.
The foundation of workplace violence liability is the employer’s duty to provide a safe workplace. That duty, which comes from general negligence law and workers’ compensation statutes in most states, does not stop at slippery floors or faulty machinery. It extends to protecting employees from violence. Courts have recognized for decades that an employer who knows or should know that a workplace has a high risk of assault has a legal obligation to take reasonable steps to reduce that risk. Reasonable steps depend on the nature of the business. A convenience store open at 2 a.m. in a high-crime area faces different expectations than a law office in a quiet suburb. The law does not require employers to guarantee safety, but it requires them to act sensibly based on what they know or what they should investigate.
Foreseeability is the pivot point. In a negligence lawsuit after a customer attacks an employee, the employee must show that the employer could have predicted a violent incident. That is not hindsight. It is evidence of prior incidents, complaints, or industry patterns. If a bar has had three fights in the past month, the owner cannot claim surprise when a fourth fight injures a bartender. If a fast-food restaurant routinely deals with aggressive customers who have thrown objects and shouted threats, the manager cannot shrug off a broken jaw as a random act. Foreseeability also arises from the nature of the business itself. Gas stations, liquor stores, pawn shops, and hospitals are known to face elevated violence risks. In those settings, courts are less forgiving of an employer who fails to install security cameras, hire security guards, or train staff in de-escalation.
But foreseeability alone does not make liability automatic. The employer must also fail to take reasonable action. That failure is called negligence. For example, a retail store that knows about a series of shoplifter confrontations might be negligent if it does not train employees on how to handle those encounters. A hospital emergency room that knows patients and family members often become combative might be negligent if it does not limit access, provide panic buttons, or ensure enough staff on duty. On the other hand, an employer who has taken credible steps—such as installing security glass, hiring a guard, or creating a clear protocol for threatening situations—will have a strong defense. The law does not penalize employers for failing to prevent every possible assault. It penalizes them for ignoring warning signs.
A related legal theory is negligent hiring or negligent retention. If an employee is the one committing violence against another employee, different rules apply. But for customer-on-worker violence, the employer is often strictly liable under a different rule: respondeat superior, which means “let the master answer.“ However, that rule generally applies when an employee acts within the scope of their job. A customer is not an employee, so that doctrine does not apply. Instead, the employer’s liability comes from its own actions or inactions—its own failure to manage the premises, its own lack of security, its own faulty policies. That is why these cases are not automatic. The employee must prove the employer breached a duty.
Workers’ compensation adds another layer. In most states, an employee who is injured on the job, including by an assault, can claim workers’ comp. That system pays medical bills and a portion of lost wages regardless of fault. In exchange, the employee usually gives up the right to sue the employer for negligence. But there is an exception for intentional misconduct or gross negligence. Also, many states allow the employee to sue a third party, such as the customer who committed the assault. The employer might then be dragged into the lawsuit if the customer claims the employer’s poor security contributed to the incident. The result is a tangle of rules that vary by state, and no business owner should assume a single approach works everywhere.
What does this mean in practice? Employers must treat customer violence as a real hazard, not an afterthought. They should assess their specific risks, train employees on how to respond, and document any incidents or threats. A simple log of verbal altercations can become crucial evidence later. If a business does nothing after a threat, and then a customer attacks, the employer’s liability is hard to escape. The legal system expects a business to protect its workers from dangers that are reasonably visible. In an era where rage and instability are common, that expectation grows every year. Workers who are hurt by customers are not just victims of a crime. They are often victims of a workplace that should have known better.
