Identity Theft: What Can I Do?

Identity theft is one of the fastest growing threats on the internet. Every second, sensitive information such as names, passwords, and personal data is stolen around the world for criminal gain. In 2025, the number of credentials available online reached a record of more than 16.3 billion. A particularly alarming aspect: nearly 70% of these passwords are now available in plain text – a huge increase of 261% compared to the previous year (Identity Breach Report 2026, Constella).

The consequences of identity theft are often devastating. They range from ransacked bank accounts to legal problems due to anti-fraud legislation. In this article, you can learn how to effectively protect your identity online, how to respond if your identity is stolen, and what digital precautions you can take.

Identity theft is the wrongful use of an actual person's information by unauthorised third parties, where criminals use stolen data to conclude contracts, make purchases, or commit crimes in the name of the victim.

Is Identity Theft a Criminal Offence?

Under UK law, “identity theft” does not constitute a specific standalone offence. Instead, it is prosecuted under different laws based on how the stolen identity was misused, including:

• Fraud Act 2006: covering fraud by false representation.

• Forgery and Counterfeiting Act 1981: when “false instruments” are used for the purpose of deception.

• Data Protection Act 2018: when information is unlawfully obtained.

A recent Bitkom study (2025) found that 61 percent of the people surveyed had been the victims of cyber crime in the preceding twelve months. However, only a quarter of those affected filed a complaint with the police.

Criminals are continuously developing new methods to access personal information. As the issue of cyber security now affects us all, it is important to know the most common ones attackers use to steal data.

1. Phishing and Social Engineering

Phishing is when criminals use fraudulent e-mails or websites to trick you into revealing your passwords. This is where social engineering comes in: instead of hacking software, the person is manipulated. Attackers use feelings like stress (for example, “Your account was locked”), curiosity, or a faith in authority to gain your trust. The goal is for you to willingly reveal your sensitive data because you believe that you are communicating with your bank or a reputable company.

2. Data Breaches at a Company

Major data breaches are often the result of large-scale identity fraud. When the databases of online shops or social networks are hacked, millions of data records end up available on the internet or dark web. The IBM Cost of a Data Breach Report 2025 shows that the average cost of such breaches has risen to 4.4 million US dollars worldwide.

3. Malware and Skimming

Malware on your computer or smartphone can record your keyboard entries or spy on all your device’s content. While malware operates in the digital realm, skimming is a physical issue: it involves manipulating devices such as ATMs to steal your card details. The aim of both methods is to gain the information needed to access your account without your knowledge.

4. Misuse on Social Media

This is when criminals make exact copies of your profile under your name. Using your photos and information, they pretend to be you in order to deceive your friends, ask for money, or collect other related personal data. Such misuse often damages both your finances and your reputation.

Victims often do not notice fraud until they have suffered financial losses. Look out for the following warning signals:

• Unexpected invoices: you receive late payment notices for goods or services you never ordered.

• Suspicious account transactions: unknown charges to your bank account.

• Rejected credit: you suddenly have a negative credit rating without any obvious reason.

• Login issues: your passwords no longer work even though you did not change them.

• Notices from the authorities: the police or tax office contact you regarding transactions you know nothing about.

What is the first step to take if you think you may be the victim of identity theft? 
Check your accounts immediately and change all your passwords using a secure device. You should also secure any evidence you may need (screenshots, e-mails).

Identity theft usually leads to a whole host of further issues. It is not just about money.

1. Financial loss: according to Bitkom (2025), the average losses suffered per incident is around EUR 219 but may reach the thousands in individual cases.

2. Reputational damage: illegal business conducted in your name damages your reputation with business partners and the authorities.

3. Physical stress: the feeling of having your personal identity stolen often leads to stress and anxiety.

4. Lengthy clarifications: it can take months to stop demands for payment due to fraud, amend official registers, or correct credit ratings.

If you find out that your data is being misused, you have to respond quickly and in a structured way.

Checklist for Emergencies:

• ✅ Change passwords: use strong, new combinations for all important accounts.

• ✅ Inform your bank: have your cards blocked and submit objections to any unauthorised debits.

• ✅ Secure any proof: save confirmation e-mails, invoices, and IP addresses of attackers.

• ✅ File a report: go to your nearest police station or use the online service. This is an essential legal safeguard.

• ✅ Inform credit agencies: inform credit agencies about the misuse to protect your credit score.

• ✅ Contact platform operators: report hacked profiles to social media providers or online marketplaces.

There is no such thing as complete security online, but targeted precautions let you reduce risk significantly. Data safety begins with your own security awareness.

Practical Everyday Tips

1. Two-factor authentication (2FA): enable 2FA for all your accounts. Even if criminals get your password, the second factor will stop them.

2. Provide data sparingly: think about exactly which companies you trust with your personal information.

3. Regular updates: keep operating systems and apps up to date to eliminate security vulnerabilities.

4. Secure payment methods: use services with buyer protection while shopping online.

5. Use passkeys: this modern alternative to passwords uses the biometrics on your device (such as your fingerprint or a face scan). As no classic text code is submitted, this method is immune to conventional phishing attempts.

Omniac is a digital early-warning system that provides transparency online and alerts you if your personal data has been compromised. In a world with more than 567,000 data breaches per year (Constella, 2026), it is impossible for you to keep oversight over all your data alone.

Omniac continuously searches verified data breaches on the internet, deep web, and dark web for your information. You are notified immediately if it finds your e-mail address, phone number, or other personal details. Personal responsibility is the best protection: the earlier you learn that your data has been exposed, the quicker you can respond and protect yourself against its misuse.

Depending on your location, there are specialist agencies that you can contact.

In the UK, the Information Commissioner’s Office is another important source of information for data breaches and potential threats.

The fight against identity theft requires a rethink. As attackers get more and more professional, a simple password is no longer enough. Companies and private individuals alike need to invest in their digital security.

Multi-factor authentication (MFA), prompt reporting to the police, and the use of early-warning systems such as omniac give you a solid basis for your data security. Omniac helps to provide transparency about stolen data and raise your security awareness.

Do not wait until you have suffered financial loss. Check whether your information is affected regularly and take proactive action.