Identity Theft: Examples and Consequences of Data Theft

A case of identity theft is usually only noticed by victims some time after the incident. For example, it may no longer be possible to log into your own email account, or credit card details may have been used by hackers for online purchases. It is particularly easy for hackers when digital data is inadequately protected online, making it simple to harvest personal information such as names, addresses, and phone numbers. We explain the consequences of identity theft and how best to protect yourself against it.

What is identity theft?

Identity theft involves the unauthorized acquisition and subsequent regular misuse of personal data by third parties. The goal of data theft is usually to obtain financial advantages made possible by the stolen information. Highly sought-after data includes bank or credit card numbers, driver's license or social security numbers, which are at the top of the perpetrators' lists. Especially with data stored online, such as PayPal or online shop login credentials, hackers find it easy to access this information through digital attacks, often due to weak passwords. The data harvested by the perpetrators can then be misused for a wide variety of purposes. Sensitive victim data can also reach perpetrators via phishing emails, which can then lead to digital identity theft.

Therefore, it is important to protect not only data in paper form but also that which is stored digitally. The consequences of identity theft are usually devastating, as the perpetrators cloak themselves in a false identity—for example, by pretending to be someone else online—and are often difficult to identify, as they may even be able to bypass two-factorauthentication using the stolen data.

As soon as identity theft is discovered, it is important to report it immediately to the police and to block all affected accounts. Since the GDPR came into effect, companies are generally required to report data breaches that could facilitate identity theft.

Examples of identity theft and data misuse

Data theft and subsequent identity misuse can occur for various motives. The following cases and examples are common in instances of identity theft: 

• Ordering goods: Perpetrators order goods to their own address but in the name of third parties whose data has been stolen. After high-value goods have been ordered by the perpetrators and delivered, but the invoice remains unpaid, the unsuspecting victim must justify themselves to the relevant online shops or collection agencies. The motive behind this is for the perpetrators to resell the swindled goods and profit from them.
   
• Social media and identity misuse: To damage someone's reputation online, perpetrators often gain access to their Facebook or other social media login credentials to post questionable content in the victim's name. Alternatively, they may create fake profiles using the victim's name. The motive here is often to ruin the victim's reputation. Other users on the social network have no way of knowing that the fake profile was not created by the victim themselves.
   
• Offline identity theft: It is not only online that personal data can be misused. It also happens that perpetrators assume another person's identity after committing a crime, having obtained the necessary information through deception. This allows them to conceal their criminal history. In most cases, however, this form of identity theft is quickly discovered during an identity check.
  ‍

• Social security number misuse: The theft of a social security number has serious consequences, including tax fraud, abuse of the social security system, and damage to credit ratings. Perpetrators use the victim's social security number to apply for loans, social benefits, or tax refunds, causing significant financial harm. Victims should act immediately by notifying the social security office, placing a credit freeze, monitoring their social security record, and filing a police report.

What are the penalties and consequences of identity theft?

Under current legislation, identity theft can be prosecuted under Section 238 of the German Criminal Code (StGB). This provision criminalizes the misuse of personal data. The penalty for identity theft can include a fine or even imprisonment.

But what are the consequences for the victims? It can happen that email accounts are blocked, leaving victims unable to access them. If perpetrators use stolen data to access third-party accounts and order goods, victims may, in the worst-case scenario, face collection agencies demanding payment. If credit card details have been stolen and used, the money is usually lost for good.

Tip: If you would like to check whether you have ever been a victim of identity theft, you can do so via the Hasso Plattner Institute check.

How to protect yourself from identity theft

Digital identity theft is not uncommon. Therefore, protecting your personal data and ensuring online security should be a high priority and never taken lightly. To make it significantly harder for hackers to get their hands on sensitive information, you should strictly follow these fundamental guidelines:

• Regularly check your online accounts (bank accounts, online shop accounts, and social media profiles) as well as your deposits and withdrawals
• Use a paper shredder for documents containing sensitive information
• Store personal documents securely so that unauthorized individuals cannot access them—both online and offline
• Use protection services that provide alerts for specific account logins
• Ensure data security through strong passwords and multi-factor authentication
• Install antivirus software and perform regular security updates to prevent cyberattacks

Despite all precautions, it is always important to be mindful of where you share, enter, or store your data. Often, a name is all it takes for perpetrators to assume a false identity and misuse someone else's data.