Identity theft after a data breach

Someone is using your identity after a hack? The signs, what to do right away (police report, bank, organisations) and how to protect yourself.

When a breach contains your name, date of birth, address, bank details or a copy of an ID document, a scammer can use them to act in your name: open an account, take out a loan or subscription, or hijack your phone line.

Signs of identity theft

• Letters, reminders or debt collection for contracts you never signed;
• unknown parcels, orders or subscriptions;
• an unexpected credit refusal or a credit record you do not understand;
• sudden loss of signal on your phone (your number may have been moved to another SIM card);
• online accounts created in your name.

What to do right away

1. File a police report with all the evidence (letters, screenshots, statements). The report number will help you dispute each fraudulent contract.
2. Tell your bank and block any payment method involved.
3. Contact each organisation where a contract was opened in your name: send them the police report and ask for cancellation in writing.
4. Check your credit file with the credit reference agencies or central bank of your country.
5. Tell your mobile operator if you lose signal suspiciously.

Protecting yourself afterwards

• Never share a code received by text, even with someone claiming to be your bank.
• Send ID documents with a watermark stating the recipient and the date.
• Keep a copy of every step you take.
• Have your data erased from sites that no longer need it: see GDPR erasure request.

If the breach caused you harm, you may claim compensation: see data breach compensation.