What is identity theft, and how do I tell if it has happened to me?

More context

Identity theft is the broad name for any crime where someone uses your personal information to act as you — opening accounts, taking credit, claiming refunds, signing contracts, sometimes evading justice in your name. It is a slower-burn problem than simple card fraud (which most people experience as a refused chip-and-pin and a replacement card in the mail). When it happens, the damage often unfolds across months: the loan you never took out turning up on a credit application years later, the tax notice for income you never earned, the phone line your name unexpectedly carries.

The categories that matter, in practice:

• Financial-account fraud. A criminal opens a bank account, a credit card, a personal loan, a mobile-phone subscription, or a “Buy Now Pay Later” account in your name. The bills default, and your name takes the credit-score hit.
• Tax and benefits fraud. Filing a false tax return or claiming benefits in your name, often to redirect a refund. The IRS, French Direction Générale des Finances Publiques, UK HMRC all see this; the resolution time can run into a year.
• Medical identity theft. Less common in France’s universal-coverage system; very common in the US private-insurance system, where stolen identities are used to claim treatments that then attach to the victim’s medical history.
• Criminal identity theft. A criminal stopped by police identifies as you, the citation or even arrest goes on your name. Rare but slow to undo.
• Synthetic identity fraud. A criminal combines a real ID number (often a child’s, who will not check for years) with fabricated other details to build a “person” who can take credit. This is the fastest-growing variant in the US and Europe.

How criminals get the data, in 2026:

1. Large data breaches. France saw a string of major ones in 2024 — telcos, banking, public services, healthcare — exposing tens of millions of records of name + DOB + address + sometimes ID details. Once a dataset like that is on dark-web markets, it gets resold and reused for years.
2. Targeted phishing for ID documents. “Please upload a photo of your ID to verify your account” — from a fake bank, a fake delivery, a fake job offer, a fake renter-screening site. Once they have the photo, they have what they need to apply for credit.
3. Account takeover that exposes documents. A reused password gets your email; your email contains the ID photos you sent your bank ten years ago; the attacker now has them.
4. Physical theft. Stolen wallets, mailboxes (in France, vol au courrier), unshredded paper records.

The signals you should react to immediately:

• Mail from any bank, lender, telecom, or utility about an account you did not open.
• A credit application denied for reasons you do not recognise (because the same identity was just used).
• A collections agency calling about a debt you do not remember.
• A tax notice or refund delay you do not expect.
• Multiple small unfamiliar transactions on your account (“testing” transactions before bigger ones).
• A new utility or phone bill in your name at an address you do not know.

The first 48 hours, if you suspect identity theft:

1. Document what you saw. Letter, notice, email — screenshot or photograph.
2. Contact every financial institution you have an account with. Ask for fraud flags on your accounts. Change passwords.
3. In France: contact the Banque de France, query the FICOBA registry (lists every bank account opened in your name) and FICP (incidents of credit), and consider an opposition Préventive at the CNAJF / FNCI for cheques. The CNIL has a step-by-step page.
4. File a complaint. In France, the pré-plainte en ligne for cyber-related offences, then an appointment at your local commissariat. Police take this seriously and a written complaint is what banks usually require to clear fraudulent debts.
5. Notify the regulator if a data breach was the source. CNIL in France; equivalents elsewhere.

Who pays: in France, EU PSD2 and Article L. 133-19 of the Code monétaire et financier mean the bank usually absorbs the loss if you reported promptly and were not grossly negligent. In the US, federal law caps consumer liability for credit-card fraud at $50 and most issuers waive it. The deadline to dispute is generous on paper (13 months in France) but acting in the first 48 hours dramatically improves the practical outcome.

Prevention is the long-running boring habit, not a single product. Treat your ID number, your social-security number, and your full DOB as semi-secret — given only to institutions legally entitled. Be suspicious of any “verification” asking you to upload an ID photo to a process you did not initiate. Use unique passwords on accounts that hold your identity (a password manager does this for free). Turn on two-factor authentication on the master accounts that gate all the others (email, bank, government portal). Periodically check the registries that catalog accounts in your name. None of this is exciting; all of it is what actually works.