First, identify the nature of the incident
‘Data misuse’ can refer to a variety of situations. The appropriate response depends on what has actually happened:
- In the case of a data leak or data breach, personal data has been disclosed or may have fallen into the wrong hands. Actual misuse may not yet have taken place.
- In the case of unauthorised publication, details such as your name, address, telephone number, photos, documents or private messages are publicly available on the internet.
- In the case of impersonation, a profile is created in your name, using your photo or other personal details.
- In the case of identity misuse, your data is used to place orders, enter into contracts, create accounts, send messages or impersonate you to others.
- Account takeover involves an existing email, Google, payment or suchen.expert account being hijacked.
- Financial misuse results in unrecognised debits, credit enquiries, payment demands or other financial consequences.
A data breach alone does not prove that contracts have already been concluded or accounts taken over. Conversely, identity theft can also occur using publicly available data without any specific data breach being known.
Preserve evidence at an early stage
Document the incident before content is deleted, profiles are blocked or pages are altered. However, this should not delay urgent protective measures such as blocking a card or an account.
Where available, secure the following:
- full URLs and profile or listing links,
- usernames, profile and listing IDs,
- screenshots with date and time,
- the original emails, SMS messages and other messages,
- full sender details and, where applicable, email headers,
- contract, invoice, order or payment-reminder details,
- payment and transaction details,
- names and contact details of the organisations involved,
- a chronological note of when you identified and reported each matter,
- case or reference numbers, if assigned to you.
Where possible, do not alter original files or messages. Do not reopen any suspicious attachments or links. Do not publish evidence on social media and do not disclose other people’s personal data in the process.
Do not disclose any further data
End any suspicious communication and do not send additional copies of identity documents, selfies, bank details, sign-in details or signatures. After an initial misuse, perpetrators often try to obtain further information under the pretext of a check, refund or damage mitigation.
Never share passwords, one-time codes, PINs, TANs, full activation or reset links or session cookies. Alleged support staff, banks, the police and purported recovery services do not need these secrets either.
To make contact, use only official addresses, websites and telephone numbers that you found yourself. Do not use contact details from a suspicious message.
Secure email, Google and platform accounts
Make security changes on a trusted device. If you previously installed unknown software, executed a suspicious attachment or allowed remote access, first use a different device.
First secure the email or Google account used to sign in to and recover access to other services:
- set a new, unique password if sign-in details may have been affected,
- check signed-in devices and sessions,
- remove any unrecognised connected applications,
- check recovery email addresses and phone numbers,
- check forwarding, filtering and deletion rules in your email account,
- enable multi-factor authentication or a passkey if the provider supports this.
Then change the passwords for other affected accounts. If a disclosed password was used more than once, replace it with a separate password for every service.
If you notice anything unusual in your suchen.expert account, follow the detailed instructions in What should I do if I suspect unauthorised access to my account? For advice on protecting your email account, see How can I make sure my email address is protected?
Responding to a data breach notification
If a company or service informs you of a data breach, verify the notification through an official channel that you accessed independently. Phishing messages may use an alleged data breach as a pretext.
Ask or check the following:
- what types of data are affected,
- when the incident took place,
- whether passwords, security details, payment information or identity documents may be affected,
- what protective measures the data controller recommends,
- which official contact channel can be used to ask further questions.
Change a password if it might itself be affected, if you use it across multiple services, or if there are further signs of unauthorised access. The mere disclosure of an email address does not automatically require you to change all your passwords, but it does increase the risk of targeted phishing attempts.
After a data breach, be particularly alert to personalised messages. Perpetrators may use genuine details to make fake messages appear credible. Further guidance is available in How do I recognise phishing attempts and fake messages?
Report unauthorised data disclosures or fake profiles
First preserve the affected page, the exact URL, the profile and the published information. Then report the content to the operator of the relevant website or platform. Describe specifically:
- which data or images are affected,
- why the publication or use may be unauthorised,
- which URL or profile is affected,
- whether a profile is impersonating you,
- whether messages, offers or payment demands have already been circulated in your name,
- what action you are requesting, such as review, restriction, correction or removal.
Send only the information required to associate your report with the matter. If identity verification is requested, ask about the purpose, legal basis, data required and a secure transmission method. Do not send a complete copy of an identity document without being asked.
Inform known contacts via a trusted channel if the fake profile is sending messages in your name. Ask them not to open any links, pay any money or disclose any personal data.
Removal from one platform does not automatically eliminate copies that have already been made, search engine listings or publications on other websites. Report every known location to the relevant operator. Refrain from making public accusations or issuing your own appeals for information.
Dispute unknown contracts, orders or accounts
If a company claims that an order, account, mobile phone contract, loan or other contract has been taken out in your name, contact them using independently verified contact details. State in writing that you did not initiate the transaction and request:
- that it be flagged as possible identity misuse,
- a review of the underlying documents and contact details,
- information about which data is being processed and the source from which it was obtained,
- a copy or clear information about the alleged transaction,
- correction of inaccurate data,
- where legally possible, a restriction on further processing whilst the matter is being investigated.
Do not admit liability or make any payment solely as a result of pressure or an unexpected claim. However, do not ignore any correspondence either. Short deadlines may apply to objections, court correspondence, debt collection proceedings and other formal steps. If necessary, seek help in good time from a consumer advice centre or a solicitor.
Filing a criminal complaint or reporting identity misuse does not automatically terminate an alleged contract or claim. You should therefore keep replies and supporting evidence organised.
Check SCHUFA only if creditworthiness or contractual misuse is possible
A SCHUFA check is particularly advisable if there are signs of unauthorised credit enquiries, bank accounts, mobile phone contracts, purchases on account or other transactions relevant to creditworthiness. A published photograph or a spam email alone does not automatically require a report to SCHUFA.
You can request a free copy of your data from SCHUFA under Article 15 of the GDPR and check whether any unrecognised enquiries, contracts or claims are stored. Treat this data copy as confidential because it may contain extensive personal information.
SCHUFA also offers its Registration of identity fraud procedure. According to the requirements published there, you will need, amongst other things, a form, proof of identity and evidence of a police report. Use only the official SCHUFA channel and check the current requirements there.
Registration does not replace direct clarification with the companies that reported an unauthorised contract or claim.
If other credit reference agencies appear to be involved, contact them directly as well. Do not send personal data as a precaution to a large number of unknown organisations.
Inform banks and payment service providers
If bank, card or payment details are affected or unrecognised transactions have already appeared, contact your bank, card issuer or payment service provider immediately through the official channel. Ask them to check whether access to accounts, cards or direct-debit mandates must be blocked and transactions disputed.
Monitor further transactions and watch out for small test debits. Changing your password does not replace either blocking a card or reporting a transaction. A refund or reversal cannot be guaranteed.
The differences between PayPal, card payments, SEPA direct debits and bank transfers are explained in What should I do about suspicious PayPal or payment transactions?
Identity documents, SIM cards and other forms of proof
If an identity card has actually been lost or stolen, report the loss or theft immediately to the competent identity-card authority or the police and have the online ID function blocked. Information is available on the Federal Portal page for blocking the online ID function.
If only a copy of an ID document or a photograph of the document has been shared, the appropriate action depends on the extent and specific nature of the misuse. Blocking the document or issuing a replacement is not automatically necessary in every case. Seek advice from the ID card authority or the police regarding the specific circumstances.
You should also contact the relevant issuing authority if your driving licence, residence permit, health card, loyalty card or a similar document has been lost, forged or misused.
If an unrecognised SIM-card change, a sudden loss of mobile reception or suspicious activity appears in the customer account, contact the mobile network operator immediately. A phone number that has been taken over can be misused for sign-in and recovery procedures.
Inform suchen.expert
If the misuse concerns a suchen.expert profile, listing, message or data published there, contact support using the official contact form.
The following information is helpful:
- the affected profile or listing link,
- listing and message IDs,
- a brief timeline of events,
- the specific data that has been misused,
- redacted screenshots,
- reports already made or blocks already put in place,
- a police reference number, if available and relevant to the investigation.
Do not send passwords, codes, complete reset links, session cookies, complete card details or identity documents unless requested. Information about data processing by suchen.expert can be found in the Privacy Policy.
suchen.expert can review incidents and content within the platform using the available information. This cannot guarantee the complete removal of data already disseminated externally, the restoration of all content or the resolution of private claims.
Exercise data protection rights for a specific purpose
Depending on the situation, you may have rights under the General Data Protection Regulation (GDPR) vis-à-vis the organisation responsible for data processing. These include, in particular:
- the right to access personal data being processed, as well as information on the purposes, sources and recipients, in accordance with Article 15 of the GDPR,
- the right to rectification of inaccurate data in accordance with Article 16 of the GDPR,
- erasure under the conditions set out in Article 17 of the GDPR,
- restriction of processing under the conditions set out in Article 18 of the GDPR,
- objection to certain processing operations under Article 21 of the GDPR.
Address your enquiry as specifically as possible to the data controller or their data protection contact. Specify the data concerned and the action you are requesting. Keep a record of your enquiry and the response.
These rights are not unlimited. Statutory retention obligations, the defence of legal claims, the rights of other people, freedom of expression and information or other legal grounds may preclude complete erasure or the disclosure of information. The data controller may also require appropriate identity verification.
The binding text and the conditions are set out in the General Data Protection Regulation on EUR-Lex.
Refer the matter to a data protection supervisory authority
If you have reported potentially unlawful processing and the controller has not responded appropriately, or if a data protection breach persists, you may lodge a complaint with the competent data protection supervisory authority. Which authority is competent depends, amongst other things, on the organisation responsible, its registered office and the area concerned.
The German Data Protection Conference publishes a list of federal and state data protection supervisory authorities. The Federal Commissioner for Data Protection is not automatically responsible for every private company; often, a state supervisory authority is the correct point of contact.
A complaint to the supervisory authority does not replace a criminal complaint, a response to a claim within the applicable deadline or advice on civil law. Nor does it guarantee the immediate deletion of content or damages.
Contact the police in cases of identity misuse or suspected criminal offences
You can file a criminal complaint in cases involving false contracts, orders or accounts, financial loss, account takeovers, forged documents, blackmail, threats or other specific acts of misuse. The German police online reporting portal is available for non-urgent cases. In an immediate emergency, call 110.
Provide a factual chronology and the preserved original documents. Ask for an incident or case reference number if one is assigned. It may later be useful when dealing with companies, banks or SCHUFA. However, a criminal complaint guarantees neither that a perpetrator will be identified nor a refund or the automatic correction of records held by third parties.
Further official guidance is available from the Police Crime Prevention Service in Preventing identity theft: how to protect your identity online.
Continue monitoring the consequences
During the following period, check your email, Google, payment and other affected accounts. Watch for new orders, payment reminders, credit enquiries, address changes and messages sent to your contacts. Keep new incidents together with the existing chronology and inform the organisations already involved if there are further developments.
Be particularly cautious of alleged investigators, lawyers, data protection advisers or recovery services that contact you unexpectedly and promise guaranteed deletion, account recovery or recovery of funds in return for an advance payment. Verify such contacts independently.
