WOOD, Circuit Judge.

Although almost anyone might feel harassed to some degree when a lawsuit is filed against her, special problems arise when that individual is a victim or a witness of a crime, and the plaintiff is associated with a suspect. Susan Bolden, the Branch Manager for the Midwest America *840 Federal Credit Union (Credit Union), was such a defendant. The district court decided that Bolden was entitled to protection under the Victim Witness and Protection Act of 1982 (the Act), Pub.L. No. 97-291, 96 Stat. 1248 (Section 4 of Pub.L. 97-291, codified at 18 U.S.C. §§ 1512, 1513, 1514, and 1515), which protects victims and witnesses of federal crimes from “harassment.”

The events in this case arose out of Bolden’s effort to cooperate with a federal investigation of a bank robbery that she witnessed, and of which she was a victim. Dewayne Lewis was not the primary suspect in the robbery, but circumstantial evidence indicated that he might have had some role in it. Bolden turned over the names and social security numbers of both Lewis and Todd Andrews, the primary suspect to federal authorities investigating the bank robbery. For her trouble, she was rewarded with this suit by Lewis, seeking $2 million in damages under 42 U.S.C. § 1983 for her role in helping the police — assistance that he claimed violated his rights under the Fourth Amendment. The district court took two actions to which Lewis takes exception here. First, it entered a protective order under 18 U.S.C. § 1514(b) of the Act against Lewis in which it characterized the lawsuit as “harassment” of Bolden and commanded Lewis to desist. Second, it dismissed Lewis’s complaint under Fed.R. Civ. P. 12(b)(6). We affirm both the judgment and the protective order.

The underlying facts are, for the most part, undisputed. On November 28, 2001, the Credit Union was robbed by two masked gunmen. Bolden, on the job as the Branch Manager, witnessed the crime. The district court found in its memorandum decision on the requested protective order that Bolden was interviewed shortly after the robbery by Detective Vaughn of the Allen County Sheriffs Department. As Vaughn was conducting the interview, both Vaughn and Bolden heard a radio transmission from the Fort Wayne police indicating that they may have located a witness. Specifically, the field officers said that a maroon Cadillac with three black males had pulled up next to a vehicle at an apartment complex and the occupants had begun transferring bags or equipment into the other car and tossing items up onto the roof. Bolden then reported to Vaughn that a few days earlier, a maroon Cadillac had been seen cruising around the bank’s parking lot in the early morning. One or more of the occupants — also an African-American male — had gone into the Credit Union and conducted a transaction. Suspicious, the employees had kept a record of the names of the individuals who had transacted business in the bank. They also wrote down a partial license plate number. At some point — unspecified in the district court’s order — Vaughn was given those names. He ran the information through the Bureau of Motor Vehicles and found that Andrews had a maroon Cadillac registered to his name.

Another official investigating the robberies was Special Agent Restitute Loran, an FBI agent who was a member of the local Federal Bank Robbery Task Force (Task Force). Agent Loran also reported the substance of the information collected by Vaughn. Agent Loran’s affidavits, however, do not clearly indicate what the employees witnessed. According to his November 30, 2001, affidavit, prepared immediately after the robbery, the employees were able to identify only Andrews from the record of the earlier transaction. Lor-an’s later affidavit, which had been prepared to support the government’s request for a protective order filed on June 6, 2003, asserted that the Credit Union employees had identified both Andrews and Lewis as the individuals involved in the earlier inci *841 dent. Either way, there is no doubt that after she overheard the radio dispatch, Bolden conducted a search of the Credit Union records and provided the Task Force with Lewis’s name and social security number. Lewis alleges that she did so at the request of the law enforcement officers. Lewis himself did not authorize the search, nor did the police obtain a warrant for the search.

In the end, the authorities obtained a videotaped confession from Andrews, and he was charged with aiding and abetting the Credit Union robbery in violation of 18 U.S.C. §§ 2, 924(c), 2113(a), and 2113(d). Lewis was never charged under either federal or state law with any offense in connection with the robbery because he was incarcerated when the bank robbery occurred.

After Andrews filed a motion to suppress evidence of the robbery and his videotaped confession and the court denied that motion, the government disclosed certain Jencks Act materials to the defense. See 18 U.S.C. § 3500. This was how both Andrews and Lewis learned of Bolden’s role in the investigation. On May 14, 2003, Andrews and Lewis separately brought pro se actions in state court against Bol-den, each seeking $2 million in damages from her individually, under 42 U.S.C. § 1983, for disclosing their names and social security numbers to the Task Force. On June 6, 2003, the government responded with a complaint in federal district court seeking a temporary restraining order and a protective order under 18 U.S.C. § 1514(a) and (b), that would prohibit Andrews and Lewis from “harassing, intimidating, deposing or otherwise proceeding against Susan Bolden [in the designated cases].”

In short order, the district court issued an ex parte temporary restraining order against Andrews and Lewis enjoining them from proceeding in any way against Bolden in their pending pro se actions “or in any other state or federal civil proceeding relating to any events or transactions connected with the case of United States of America v. Todd Andrews ... for charges in relation to the November 28, 2001, armed robbery of the Midwest America Federal Credit Union.” Immediately after a hearing held on June 12, 2003, the court converted this into a protective order under § 1514(b) that was to last for three years from the date of issuance; it entered judgment on that order on June 25, 2003, and Lewis’s appeal from that judgment was docketed in this court on June 30, 2003, as appeal No. 03-2734.

In the meantime, Bolden removed both Lewis’s and Andrews’s state court actions to the U.S. District Court for the Northern District of Indiana. There she moved to dismiss for failure to state a claim, arguing both that the § 1983 claim failed for lack of state action and that the Right to Financial Privacy Act (RFPA), 12 U.S.C. § 3403(a), which generally prohibits disclosure of financial records of customers, did not reach her actions. The district court granted her motion and entered judgment in her favor on August 26, 2003, agreeing that there was no state action and finding that she was immune under an exemption to the RFPA, see 12 U.S.C. § 3403(c). Lewis’s appeal from that judgment was docketed in this court on September 15, 2003, as No. 03-3427. In a later order, we consolidated the two appeals. (Andrews’s case dropped out along the way; we therefore have no comment on it.)

For reasons that will become apparent later, we consider first Lewis’s appeal from the judgment dismissing his civil action against Bolden. We apply a de novo standard of review to a district court’s grant of the motion to dismiss for *842 failure to state a claim under Rule 12(b)(6). Olson v. Wexford Clearing Servs. Corp., 397 F.3d 488, 490 (7th Cir.2005). The question before us is whether there is any-set of facts consistent with Lewis’s allegations that would give rise to a right to relief. Hutchinson ex rel. Baker v. Spink, 126 F.3d 895, 900 (7th Cir.1997) (“It is enough if the complaint puts the defendants on notice of the claim and that some set of facts could be presented that would give rise to a right to relief.”). Lewis now relies on the RFPA and state law to support his complaint. He correctly notes that his earlier references to § 1983 and the Fourth Amendment do not prevent him from going forward, because it is well established that litigants do not need to plead legal theories. Like Lewis, we focus most of our attention on his RFPA theory.

Lewis argues that the allegations of the complaint are consistent with a finding that Bolden violated RFPA in two ways: first, that she conducted her search at the direction of law-enforcement officials and thus provided the government with “access to” Lewis’s financial records in violation of 12 U.S.C. § 3403(a); and second, she provided law-enforcement officials with Lewis’s name and social security number, both of which she derived from his financial records. The court assumed favorably to Lewis that Bolden had done all of these things, but it then turned to § 3403(c), which says:

Nothing in this title shall preclude any financial institution, or any officer, employee, or agent of a financial institution, from notifying a Government authority that such institution, or officer, employee or agent has information which may be relevant to a possible violation of any statute or regulation. Such information may include only the name or other identifying information concerning any individual, corporation or account involved in and the nature of any suspected illegal activity.

We agree with the district court that this language shows conclusively that Lewis has not stated a claim under RFPA.

Lewis’s only response is to urge that subsection (c) describes an affirmative defense, and that it was therefore premature for the district court to dismiss his claim on the basis of the complaint. As an abstract proposition, that is usually true because complaints do not have to anticipate affirmative defenses to survive a motion to dismiss. Gomez v. Toledo, 446 U.S. 635, 640, 100 S.Ct. 1920, 64 L.Ed.2d 572 (1980). The exception occurs where, as here, the allegations of the complaint itself set forth everything necessary to satisfy the affirmative defense, such as when a complaint plainly reveals that an action is untimely under the governing statute of limitations. Leavell v. Kieffer, 189 F.3d 492, 495 (7th Cir.1999). Bolden did only what § 3403(c) permitted her to do, even giving Lewis every benefit of the doubt. We similarly see no chance of saving this complaint under the state laws governing disclosures by financial institutions without the consent of the customer. As Bolden points out in her brief, the immunity conferred by § 3403(c) covers not only liability under federal law, but also liability under “any constitution, law, or regulation of any State.”

We therefore affirm the judgment of the district court in No. 03-3427, dismissing Lewis’s private civil action against Bolden.

Ill

We have not yet had occasion to address the standard of review for a protective order granted under 18 U.S.C. § 1514(b). Because these orders are in substance injunctions against the defendant, we think that the same abuse of discretion standard should apply to them that we normally use in cases reviewing the issuance of preliminary injunctions. *843 Compare Brotherhood of Maint. of Way Employees v. Union Pac. R.R. Co., 358 F.3d 453, 457 (7th Cir.2004) (applying an abuse of discretion standard to a district court’s grant of a preliminary injunction); Zurich Am. Ins. Co. v. Superior Court for California, 326 F.3d 816, 824 (7th Cir.2003) (applying an abuse of discretion standard to review a district court’s order enjoining as state court proceeding).

We are now ready to address Lewis’s appeal from the judgment ordering him to refrain from harassing or otherwise proceeding against Bolden in any court for matters arising out of the Credit Union robbery. The court relied for that order on the authority conferred in 18 U.S.C. § 1514, which permits the government to apply for a temporary restraining order or a protective order “prohibiting harassment of a victim or witness in a Federal criminal case.” § 1514(a) (temporary restraining order), (b) (protective order). The statute defines the term “harassment” to mean “a course of conduct directed at a specific person that — (A) causes substantial emotional distress in such person; and (B) serves no legitimate purpose.” § 1514(c)(1). The term “course of conduct” is defined as “a series of acts over a period of time, however short, indicating a continuity of purpose.” § 1514(c)(2).

The district court offered several reasons for its conclusion that a protective order for Bolden was warranted in this case. First, it thought it likely that Lewis and Andrews were seeking discovery in the civil case (which at the time was still in the state court). It noted that the Eleventh Circuit has held that filing a civil lawsuit to avoid restrictions on criminal discovery, “while at the same time attempting to intimidate a witness,” is exactly the type of harassment that § 1514 was designed to eliminate. See United States v. Tison, 780 F.2d 1569, 1573 (11th Cir.1986) (finding a threatened state civil action for slander was a “course of conduct” that met the definition of harassment under § 1514). In addition, the court found that imposing on Bolden the prospect of defending herself against claims amounting to $4 million was really a veiled attempt to discourage her participation in the government’s criminal case. On a more subjective note, the court relied on an affidavit submitted by Agent Loran, in which he reported that he had been in touch with Bolden since the filing of the civil actions, and she told him that she felt threatened, intimidated, harassed, outraged, and frightened. Finally, the court summarized its conclusion as follows:

The concern about litigation against prospective witnesses is particularly heightened where, as here, the lawsuit on its face appears to be vexatious because, among other things, there may not be state action as required under § 1983, the Fourth Amendment does not apply to private actions, and federal banking law allows for certain disclosures without liability attaching. Though the validity of the claims asserted in the state actions are matters which ultimately will have to be decided by the Allen Circuit Court, it appears that the filing of the state court actions was not done for a legitimate purpose (such as to vindicate a specific right) but more likely than not was a tactical decision to intimidate and harass prospective witness Bol-den. This is something which this Court cannot countenance and for which section 1514 provides a remedy in the form of a protective order.

Lewis has argued on appeal that his conduct of filing the civil action could not, as a matter of law, constitute harassment for purposes of § 1514, because the act of fifing a lawsuit does not constitute a “course of conduct” as § 1514 defines that term; that he brought his suit in good faith; that the suit served a legitimate *844 purpose, namely, asserting alleged rights under the Fourth Amendment and RFPA; that his lawsuit is protected under the “safe harbor” provision of § 1515(c); and that the simple act of filing a lawsuit is incapable of causing substantial emotional distress. In addition, he argues that the district court was wrong to conclude that he filed his civil action in order to circumvent the Federal Rules of Criminal Procedure. The government, responds that Lewis has waived his arguments about “course of conduct”, the “safe harbor” provision of § 1515(c), and the circumvention of the criminal rules. We do not read the record so narrowly. Lewis’s pro se filings in opposition to the protective order set forth the substance of the arguments he is now pressing, and so we are not prevented from reaching the merits by any waiver. This is especially appropriate because Lewis never received any notice alerting him to the need to file a proper response to the government’s motion. Compare Lewis v. Faulkner, 689 F.2d 100, 102 (7th Cir.1982).

Another potential obstacle, however, arose during oral argument: has Lewis’s challenge to the protective order become moot as a result of the conviction of Andrews in the underlying criminal case or as a result of the district court’s decision to dismiss his civil action under Rule 12(b)(6), which we have concluded was correct. We think not. First, the fact that Andrews has now been convicted in no way protects Bolden from further harassment by Lewis. Nothing in § 1514 indicates that Congress meant to terminate protection as of the time the trial was over. The person for whose benefit the protective order is entered must simply be “a victim or witness in a Federal criminal case,” as Bolden was. The only aspect of the case that Andrews’s conviction affects is the possibility of abusing the discovery process. That, however, was not the central reason why the district court issued the order. Because that particular reason has now. disappeared, we disregard it in our evaluation of the order.

What should we do about the fact that the civil suit that was the vehicle for the harassment has now definitively been terminated in Bolden’s favor? The protective order was to last for three years, but it is likely that any other civil action Lewis might try to bring based on the events relating to the bank robbery would be barred by claim preclusion. Perry v. Globe Auto Recycling, Inc., 227 F.3d 950, 952 (7th Cir.2000) (applying federal claim preclusion inquiry into the “identity of claims, identity of parties, and a prior final judgment on the merits,” also known as the transactional test). Nevertheless, as we know from extensive experience in this court, the fact that a litigant is likely to lose a case does not mean that he will not file something. From time to time, we must even resort to monetary sanctions or filing bars to restrain abusive litigants. See Support Sys. Int’l v. Mack, 45 F.3d 185, 186 (7th Cir.1995) (ordering the clerk of the court to return any papers the defendant attempted to file in all civil actions until he paid the sanctions entered against him for his numerous frivolous and fraudulent filings); Alexander v. United States, 121 F.3d 312, 315 (7th Cir.1997) (entering a modified Mack order to address a prisoner’s repeated filing of civil actions and successive collateral attacks that automatically denied the later type of filings on the 30th day of the month unless otherwise instructed by the court). We are not suggesting that Lewis’s single ease was enough by itself to warrant a Mack or Alexander order; our only point is that the termination of his pending civil action against Bolden does not render the protective order moot.

In arguing that his lawsuit serves a legitimate purpose, Lewis relies on the “safe harbor” provision of 18 U.S.C. § 1515(c), *845 which provides that nothing in the Act “prohibit[s] or punish[es] the providing of lawful, bona fide, legal representation services in connection with or anticipation of an official proceeding.” Section 1515(c), however, is primarily concerned with protecting defendants from protective orders that would constrain investigation and preparation for their defense in criminal cases or other “official” proceedings. There is nothing “official” about Lewis’s action, and thus it does not qualify for the exemption recognized by § 1515(c). Even if we were wrong about that, we have already noted that Bolden’s disclosures were permitted by the statute. The exclusion from the statutory prohibition that § 1515(c) describes thus has no application to Lewis’s case.

Lewis argues on the merits that lawsuits are not the kind of thing that can constitute “harassment” for purposes of § 1514. But there is nothing in the statute that says this, and we see no reason to come to such a conclusion. Indeed, this strikes us as a situation rather like the one that the Supreme Court faced in Vendo Co. v. Lektro-Vend Corp., 433 U.S. 623, 97 S.Ct. 2881, 53 L.Ed.2d 1009 (1977), in which the question was whether one lengthy state court proceeding could amount to an anti-competitive practice, because it was brought solely to harass the target company unlawfully and to eliminate competition. In Vendo, the situation was complicated by the fact that the Anti-Injunction Act, 28 U.S.C. § 2283, prohibits most injunctions against ongoing state-court proceedings. In the end, however, a majority of the Court agreed that in principle, one or more state court proceedings could be the kind of anticompetitive practice that the antitrust laws are designed to prevent. See 433 U.S. at 644 n. *, 97 S.Ct. 2881 (calling for “a pattern of baseless, repetitive claims or some equivalent showing of grave abuse of the state courts”) (opinion of Blackmun, J.); id. at 652-53, 97 S.Ct. 2881 (opinion of Stevens, J.). If lawsuits, whether in state or federal court, can be a form of harassment for the antitrust laws, we see no reason why they cannot also be a form of harassment for the Victim Witness and Protection Act, 18 U.S.C. § 1514(c).

Although there might have been some question about the Anti-Injunction Act when the district court initially entered its temporary restraining order and the protective order, that concern evaporated when Lewis’s state court action was removed to the federal court. (We add that it is by no means clear that the Anti-Injunction Act would have prohibited this order. Despite the language of the statute, the “expressly authorized” exceptions need not be spelled out, see Mitchum v. Foster, 407 U.S. 225, 237, 92 S.Ct. 2151, 32 L.Ed.2d 705 (1972). Instead, the Act of Congress purportedly authorizing the injunction must create “a specific and uniquely federal right or remedy, enforceable in a federal court of equity, that could be frustrated if the federal court were not empowered to enjoin a state court proceeding.” Id. at 237-38, 92 S.Ct. 2151. Section 1514 may well satisfy that test.) Once the action was in federal court and Lewis was squarely within that court’s personal jurisdiction, it had all the power it needed to enjoin him from engaging in abusive litigation techniques. It also had the power to order him to refrain from a particular course of future litigation in any court, federal or state. Such an order by definition could not interfere with any pending state court action, which is all that the Anti-Injunction Act addresses.

The only question remaining is whether the district court abused its discretion in entering the order against Lewis on these facts. The district court relied heavily on Tison, as we noted earlier, in which the Eleventh Circuit held that a civil defama *846 tion suit constituted harassment under § 1514 and granted the government’s motion for a protective order enjoining the state court proceeding. There, the court’s primary reason for its holding was based on its finding that the timing of Tison’s defamation suit indicated that his purpose was not legitimate. It appeared that Tison was trying to circumvent the criminal discovery rules for his own criminal prosecution. Tison is not a perfect match with Lewis’s case, but it does represent the conclusion of a sister circuit that some lawsuits may be within the scope of § 1514. See also United States v. Stewart, 872 F.2d 957, 962-63 (10th Cir.1989) (stating that a protective order that directed the defendant to cease taking discovery in his civil case under § 1514 is consistent with a district court’s authority under Rule 16(b) to prohibit attempts to avoid limitations of criminal discovery rules).

While we might have preferred a more thorough exploration of the equities of Lewis’s case, the district court said enough to allow us to follow its thinking. The court also skirted the limits with respect to its abbreviated handling of the evidence. Instead of hearing directly from Agent Loran and Bolden, for example, it relied almost exclusively on Agent Loran’s affidavit for such critical findings as Bolden’s substantial emotional distress. This is especially troubling given the requirement in § 1514(b)(2) for the defendant to have the opportunity to cross-examine witnesses. Compare United States v. Carmichael, 326 F.Supp.2d 1267 (M.D.Ala.2004). In Carmichael, the district court conducted two evidentiary hearings in connection with the government’s motion for a protective order requiring a defendant to take down a website soliciting information on his criminal case, including information about the government’s witnesses. In doing so, the court heard testimony from the DEA agents on the case and two of the witnesses testified regarding their fears due to the website, ultimately concluding- the government failed to meet its burden that the protective order was warranted. Id. at 1275-76,1301.

Perhaps this would justify reversal, if it were not for several additional considerations. First, the protective order was limited to a three-year period, almost two years of which have already run; if Lewis wants relief from it, he can always return to the district court and move under Fed. R. Civ. P. 60(b) for modification. Second, we learned at oral argument that the district court was correct to be concerned that Lewis was not likely to abandon his efforts to obtain redress here. We were told at oral argument that he has filed a new action, and our check of the records of the Allen County Circuit Court reveals that he indeed filed a new civil action for damages against Midwest Federal Credit Union. See Docket No. 02-C01-0309PL-114 (filed Sept. 22, 2003). This action, while not against Bolden, illustrates why some risk of harassing litigation remains for the period covered by the protective order. We are satisfied that the district court did not abuse its discretion in entering the order.

We conclude, therefore, that the district court was authorized to enter a protective order enjoining Lewis from pursuing or instituting any new litigation against Bol-den. As the victim of a credit union robbery who was only trying to help the police in a manner expressly authorized by law, Bolden is entitled to protection from lawsuits demanding millions of dollars from her personally that are based on her assistance to the authorities — lawsuits that require her to hire a lawyer and to expend significant resources in her defense. We *847 also affirm the district court’s judgment in Lewis’s civil action.

AFFIRMED.