Identity theft: taking back control, step by step

Identity theft does not always come in the form of a fake ID card. It often starts more discreetly: a compromised email account, a copy of a document sent to the wrong place, a profile created with your photo or a bill opened by someone else.

The first reaction is sometimes to look for who is responsible. In the first few hours, another question is more useful: what access does the perpetrator still have and what could they do next?

Distinguish between situations

An identity can be used in several ways:

• creating a fake profile to contact your friends and family;
• taking over an email account or social network;
• taking out a subscription or a loan;
• changing bank details;
• using a copy of a document;
• fraud in the name of a manager or an organisation.

These situations call for different steps. A timeline and an inventory of the affected accounts prevent you from dealing only with the first symptom.

Warning signs to watch for

A password reset email you did not request, a login from an unknown device, a message sent to your contacts, a letter about a contract you do not recognise or an unusual bank transaction.

The disappearance of certain emails is particularly important. An attacker who controls a mailbox often creates rules to forward messages, hide alerts or delete replies from a bank.

Also look for silent changes: recovery address, phone number, authorised apps and devices marked as trusted.

First priority: take back your email

Email is often what allows the other accounts to be reset. If possible, use a device you trust.

1. Change the password to a unique value.
2. Enable a passkey or a second factor.
3. Sign out of all sessions.
4. Check the recovery addresses and numbers.
5. Delete any unknown forwarding rules or filters.
6. Revoke any apps you do not recognise.

If you can no longer log in, use the provider's official recovery procedure. Do not accept help from an account that contacts you out of the blue on a social network: fake recovery services target victims precisely when they are in a hurry.

Then deal with accounts in order of impact

After email, check your financial accounts, identity services, social networks and shops that store a payment method.

For each account:

• change the password if it was reused;
• review the login and transaction history;
• revoke sessions;
• check the recovery information;
• export or screenshot the traces before they disappear.

Do not immediately delete a fake profile or a message if doing so risks losing evidence. Keep the URLs, usernames and dates, then use the platform's reporting procedure.

Build a usable file

A messy pile of screenshots slows things down. Create a simple timeline:

• date and time;
• event observed;
• account or organisation concerned;
• action you took;
• contact or case reference;
• related evidence.

Keep the original emails where useful, with their full headers. Note the numbers you called and ask banks or organisations for written confirmation of the steps taken.

This file will be useful to the police, but also for disputing a contract, explaining a transaction to your bank or showing that an account was compromised before a purchase.

Documents and means of payment

If a Belgian identity document is lost or stolen, use Doc Stop to block it. For a bank card, contact Card Stop and your bank.

If a copy of a document has been passed to a fraudster, explain this in your police report and to the organisations concerned. A copy cannot be "cancelled" like a card, but a dated report helps you dispute any later use.

For future procedures, avoid sending a full copy when it is not necessary. Where accepted, add the date and purpose on the copy to make it harder to reuse.

Unknown contracts, subscriptions and loans

Contact the organisation using its official contact details and dispute the commitment in writing. Ask for the available information about the sign-up and for the evidence to be preserved. Attach the police report receipt once you have it.

Do not simply pay to "close the file" without disputing it. A first payment may be interpreted as acceptance of the contract.

Keep the replies and dates. If the organisation held your data and a breach is behind the fraud, ask it to explain what happened and what measures have been taken.

Fake profiles and impersonation on social media

Warn your friends and family through a channel you control. Ask them not to reply, not to send money and to send you the profile's URL.

Report the impersonation through the platform's dedicated procedure. You may sometimes be asked for an identity document to prove who you are; check that you are on the official site and mask unnecessary information if the procedure allows it.

Avoid lengthy conversations with the perpetrator. They may use your replies to improve their imitation or delete the account before the evidence has been preserved.

When an organisation is impersonated

A fake domain or a fake manager can deceive customers and suppliers. The organisation must communicate quickly through its verified channels, specify its official addresses and explain how to confirm a payment request.

The IT team must find out whether the impersonation comes only from an external domain or from a genuine email compromise. The two situations look alike to the recipient, but the internal response is not the same.

A procedure for changing bank details with independent confirmation greatly reduces fraud, even when the message comes from a mailbox that really has been compromised.

Keep watch after the incident

Closing a fraudulent account does not always end the identity theft. The data may be resold and reused.

For several months:

• review your financial statements;
• open any letters about unknown contracts;
• check logins to your essential accounts;
• watch for password reset requests;
• keep the police report number and the timeline.

Do not rush into signing up for a service that promises total monitoring. Check what it collects, what it can actually detect and how to cancel it.

The psychological impact is real

Having your identity stolen feels as if someone can act anywhere in your name. Methodically taking back access and documenting the steps helps you regain a sense of control.

Ask someone close to you to help with phone calls and paperwork. The victim does not have to carry the whole procedure alone, especially when the fraud has been going on for several days.

Belgian resources

• Safeonweb — advice and reporting
• Belgian police — declarations and complaints
• Data Protection Authority
• Card Stop: `078 170 170`
• Doc Stop: `00800 2123 2123`