Online Identity Theft: What to Do

With a stolen identity, strangers can cause serious harm. They may take out subscriptions and other contracts in your name, make purchases, or create user accounts. People often notice identity theft only when bills and payment reminders arrive or unauthorized charges appear in their account.

Protect your digital identity

• Share information sparingly. Think carefully about which websites you share personal information with. If you use social networks, create separate groups, for example. You can then share different things with close friends than with coworkers.
• Don’t accept every friend request. Instead, connect with people you have actually met before. 
• Be selective about the identities you use publicly. For example, use a different email address for entering contests or participating in discussion forums than you use for work or communicating with friends.
• Keep your devices up to date and install updates regularly.
• Use antivirus software and your systems' firewalls.
• Never click links in emails from unknown senders, and do not open attachments if they come from someone you do not know.
• Use strong passwords or, even better, two-factor authentication .
• Use unique passwords and usernames for different services.
• Before entering sensitive information such as your address, date of birth, or payment details, make sure an online store is trustworthy.
• When entering sensitive information, make sure no one is standing behind you.
• When you are on the go, be sure to use a secure connection.
• If you plan to sell, give away, or dispose of a device, make sure it no longer contains any personal data. 

How to find out whether your identity has been stolen

If signs are mounting that your identity has been misused, it is usually already too late. It is therefore a good idea to find out whether personal information has already been published online, for example on the dark web. To check, you can use the BSI security test or the Hasso Plattner Institute security check . In each case, all you need to do is enter the email address you want to check. The response will tell you whether—and if so, which—data was already publicly accessible.

How to respond

If you have a reasonable suspicion that your personal data has been stolen, take the following steps:

• Change the login credentials for all your accounts across all online services and offerings. 
• Tell friends and people you know about the data theft so they can carefully scrutinize future messages from you or alleged social media posts. 
• Use up-to-date software to check all your devices for viruses and malware. 
• Review your bank and credit card statements more closely. Keep a close eye on these documents over an extended period to spot unauthorized charges sooner. 
• Request a current report from Schufa. This is also one of the best ways to identify transactions you did not initiate.

If criminals succeed despite all precautions, the victim faces a frustrating and time-consuming process. 

• Go to the police and file a report. This is also advisable for liability reasons.
• Don’t ignore collection letters and inquiries from merchants; instead, seek a dialogue. If in doubt, get help from an attorney.

Of course, no one is liable for someone else’s actions. However, in each individual case, the victim must prove that they were not the person behind the order, the criminal shop, or the malicious defamation. 

And this can result in costs, for example if you seek help from an attorney. „Cyberversicherungen“ can help cushion such risks, and their coverage often also includes automatic dark web monitoring. This then searches for compromised data (for example, owlDetect).