Contents
Short answer
If someone orders goods or signs contracts in your name, you don’t simply have to pay – but you should act: secure evidence, lock down affected accounts, inform your bank and the merchants, report it to the police and dispute every unjustified claim in writing. Never ignore a court payment order (gerichtlicher Mahnbescheid).
What is identity misuse?
In short
Criminals use your data – such as name, date of birth, address, bank or login details – to pose as you. They order goods, take out subscriptions or contracts, or open accounts with payment services. Often you only notice when invoices, reminders or debt collection letters arrive.
Account taken over or new account opened?
This distinction matters. If an existing account was taken over, the priority is recovering and securing it. If a new account or contract was opened in your name, you never had access – the task is to report the misuse to the provider, dispute the claim and demand that the account be blocked or deleted.
Typical signs
- Order confirmations or parcels you didn’t order
- Invoices or reminders from merchants you never bought from
- Debt collection letters about unknown claims
- Welcome emails for new accounts you didn’t create
- Changed passwords, email addresses or phone numbers in your accounts
- Debits you can’t account for
- Contracts, for example for mobile or streaming, you never signed
Step by step
Example: you receive a reminder for 240 euros for a buy-now-pay-later purchase from an online shop you never ordered from. The delivery address is a parcel locker you don’t know.
- 01
Secure evidence
Keep all letters, emails, envelopes and parcels. Take dated screenshots of orders, bank statements and account changes. Note when you noticed what. You’ll need these documents for disputes and the police report.
- 02
Secure affected accounts
From a trusted device, change the passwords of affected accounts – your email account first, because it can be used to reset many other logins. Sign out unknown sessions, check stored email addresses and phone numbers and turn on two-factor sign-in.
- 03
Inform your bank and payment service
Report unauthorised debits to your bank straight away via its known phone number or banking app. Direct debits and card payments may be reversible. If an account with a payment service was opened in your name, report it to that service directly.
- 04
Inform merchants and providers
Write to every affected company that you did not place the order or sign the contract. Ask them to block the account and confirm it. Keep copies of your letters.
- 05
Report it to the police
File a report with the police – in person or, in many German states, via the online police station (Onlinewache). The confirmation or case number helps you with merchants, debt collectors and credit agencies.
- 06
Dispute unjustified claims
Dispute invoices, reminders and debt collection claims in writing, in a way you can prove. Quote your police case number if you have one. Don’t pay just to make it stop. For a court payment order, use the enclosed objection form within the deadline; legal advice, for example from a consumer advice centre (Verbraucherzentrale), can be useful.
- 07
Check credit agencies
Request a free copy of your data from credit agencies such as SCHUFA under Art. 15 GDPR. This shows whether contracts or negative entries are stored in your name. You can have incorrect entries corrected by referring to the identity misuse.
- 08
Keep watching other accounts and contracts
Over the following weeks, check statements, post and emails more closely. Check whether your data appears in known data breaches and repeat the data request after a few months if needed.
Checklist
- Letters, parcels, screenshots and a timeline are secured.
- Email and affected accounts have new passwords and two-factor sign-in.
- Bank or payment service has been informed.
- Every affected company has received a written dispute.
- A police report has been filed and the case number noted.
- Deadlines from any court payment order are noted and met.
- Data copies from credit agencies have been requested.
Common mistakes
- Leaving reminders or debt collection letters unanswered instead of disputing the claim.
- Ignoring a court payment order – enforcement can follow.
- Paying out of uncertainty even though you ordered nothing.
- Disputing only by phone, without written proof.
- Opening or passing on parcels from orders that aren’t yours instead of contacting the merchant.
Frequently asked questions
Do I have to pay an invoice that isn’t mine?
If you did not enter into the contract yourself, the German consumer advice centres say you don’t have to pay – the company must prove the contract. What matters is that you dispute the claim in writing.
Should I ignore a debt collection letter?
No. Dispute the claim in writing with the debt collector and the original company, referring to the identity misuse and your police report.
Should I report it to the police?
Yes, that usually makes sense. The report documents the misuse and helps you with companies and credit agencies.
How do I find out whether other contracts exist?
A free data copy from credit agencies shows stored contracts and entries. Also pay close attention to post, emails and bank statements over the next weeks.
What if a court payment order arrives?
Don’t ignore it. Object within the deadline stated in the order. Legal advice can be useful here.
Sources
- Verbraucherzentrale – Identitätsmissbrauch: Fremde nutzen Ihren Namen
- Verbraucherzentrale – Was tun, wenn Kriminelle in Ihrem Namen einkaufen?
- Polizeiliche Kriminalprävention – Identitätsdiebstahl
- Polizeiliche Kriminalprävention – Checkliste Identitätsdiebstahl (PDF)
Checked on 7 October 2026.
This information is for general guidance only and does not replace individual legal advice.