California's identity theft law may be applied as well because it could be argued that pretexting involves some form of identity theft, Wiggins aid. HP's board and the phone carriers may bring lawsuits as well.

Federal action, including an SEC investigation is possible. The SEC doesn't disclose its investigations, but if a public company is facing a formal SEC investigation it may disclose that fact, said Wiggins, who previously worked for the SEC.

Although federal law requires telephone carriers to protect the privacy of phone records, the states have been moving to clear up any ambiguity over pretexting. In the last two years, more than 11 states have passed laws imposing sanctions on pretexting, said Joseph Sanscrainte, a telecommunications and privacy lawyer with Bryan Cave LLP in New York.

California doesn't have a pretext-specific ban, but the states that do are Arizona, Connecticut, Colorado, Georgia, Maryland, Michigan, Minnesota, Okalahoma, Rhode Island and Washington, Sanscrainte said. He added he expects other states to follow.