Identity Theft – How to Take Legal Action in Germany

The increasing use of digital technologies is leading to an increasing number of cases of cybercrime in Germany and worldwide. In addition to companies and public authorities, private individuals are also frequently targeted. A wide variety of criminal offences under German law can be committed through data or identity theft. The aim of the perpetrators is usually to obtain as much data as possible and use it for their personal gain. The perpetrators use a wide variety of methods to achieve this.

In cyberattacks on companies, perpetrators often use hacker attacks or phishing emails to commit corporate identity theft. However, private individuals in Germany are also subject to such attacks. Perpetrators use the data obtained to commit further offences, such as reselling the information or using it for their own abusive purposes.

For example, those affected receive deceptive emails or direct messages asking them to provide personal data. Phishing emails also often contain links, as well as a request for the reader to click on them and enter data on the website that looks genuine. Perpetrators make the emails or websites appear particularly trustworthy so that the attack on the sensitive and personal data of those affected is often not recognisable as such. Perpetrators also use malware that is installed on the victim’s data carrier via an attachment in the email, for example, or hack accounts on social platforms.

The victims of identity theft do not immediately realise that their personal data has been obtained by an unauthorised person. Perpetrators often use the data obtained to conclude contracts in the name of the person concerned. As a result, those affected are wrongly asked to make payments and negative entries may be made with Germany’s leading provider of credit and information services for consumers and companies called Schufa and comparable credit agencies. It is also possible that the person concerned may be accused of having committed a criminal offence.

Identity theft is not an independent offence that is standardised in the German Criminal Code (StGB). When committing identity theft, the following offences, among others, can be realised:

• Spying on and intercepting data (Section 202a StGB),
• Data theft according to Section 202d StGB,
• Stalking according to Section 238 StGB,
• Falsification of evidential data according to Section 269 StGB,
• Deception in legal transactions in data processing (Section 270 StGB),
• Fraud or computer fraud according to Sections 263 f. StGB.

In addition to criminal prosecution of the perpetrators, it may also be possible to enforce claims under German civil law – such as a claim for injunctive relief or damages. The claim can be directed against the perpetrators or the platform that disclosed the sensitive data. In such a case, our lawyers first determine which claims the affected parties are entitled to in the individual case and provide support in enforcing them.

Those affected should first file a complaint with the police. If, as the victim of identity theft, you realise that payments have been made via your account that you did not make yourself and therefore cannot attribute to you, you should further contact your bank immediately and have your bank account blocked. You should also notify any credit reference agencies of the circumstances so that they can take measures to protect you.

In addition to these measures, those affected should change their passwords and check other access data. If your data has been used to place online orders for which you are now being asked to pay the invoice, you should first check this invoice. If you have already received a reminder, you have the option of lodging an objection against the corresponding notices. Our legal team will support you in taking the legal measures available to you.

Companies can take preventive measures to protect against corporate identity theft, such as introducing security protocols and employee training. There are also measures available to private individuals to reduce the risk of identity theft:

• Use varying and secure passwords: For one, it is advisable not to use the same password for every website. When creating an account, you should rather make sure to create a new password each time. On the other hand, these should be as secure as possible and should not be passed on to anyone else under any circumstances. In addition, regularly changing the passwords you already use can also contribute to security.
• Use two-factor authentication.
• Check possible phishing emails: You should be particularly careful with links and attached files in emails whose sender you do not know. It could be a phishing e-mail. Therefore, always check the sender of an e-mail and do not open the attached file or the link provided.
• Install protection devices such as anti-virus programmes.

This list is not exhaustive. Also bear in mind that identity theft cannot only take place online. You should therefore also handle your private and sensitive documents with care, especially when disposing of them.