What should I do first of all?
Block, above everything else. Call the emergency blocking number 116 116 – it can be reached 24 hours a day, 365 days a year, free of charge from Germany, and from abroad on +49 116 116 at your provider's rates. This single number lets you block not only bank and credit cards, but also online banking access, the identity card's online ID function and SIM cards. Note the date and time of the call, as well as the blocking confirmations: when it later comes to who is liable for which loss, it often depends precisely on when you started acting. Only after that come the police report, the data copy and the request for deletion.
Do I have to report it to the police?
You do not have to, but you should – for a very practical reason. Identity misuse is a criminal offence, and the report gives you a case number. Going forward, this case number is your most effective document: companies, debt-collection services and credit reporting agencies treat a matter backed by a police case number differently from a bare claim that you did not enter into a contract. The report is free of charge, can be filed at any police station – even outside your place of residence – and, in many federal states, also online. Afterwards, quote the case number in every letter to companies and to SCHUFA.
How do I get rid of the entries that are not mine?
Via two routes at the same time, and your starting position is better than it feels. First: write to every company involved and dispute the debt expressly and in writing. That is not merely a defence – it changes the legal position, because § 31 Abs. 2 Nr. 4 BDSG allows a report by this route only if the debtor “has not disputed the debt”. Second: demand deletion from SCHUFA under Article 17 GDPR (DSGVO). A contract you never entered into cannot meet the requirements for a lawful report in any case. Enclose the case number of the police report with both.
How long does a protective marker stay stored?
That cannot be answered reliably, and that is why no figure is given here. SCHUFA offers notices or markers intended to alert contract partners to possible misuse – but the scope, requirements and duration are determined by the company itself, and there is no statutory period for this. Fixed figures circulating online cannot be confirmed in any officially accessible source. Precisely because you want to rely on protection in this situation, a made-up figure would be especially harmful. The right approach: when it is set up, have the scope and duration confirmed in writing, and set yourself a reminder to check in good time and extend it if necessary.
SCHUFA says it cannot do anything — is that true?
Only partly, and the distinction helps you. It is correct that SCHUFA did not enter into the contract and does not know the facts – it was the company that reported it, and that company can withdraw the report fastest. That is why the route also always runs via the creditor. It would be wrong, however, to conclude from this that there are no claims against SCHUFA: it is the controller responsible for the processing and owes the deletion of unlawfully stored data under Article 17 GDPR (DSGVO), as well as notification of all recipients under Article 19 GDPR. If it stands by its refusal, the free complaint to the data protection supervisory authority under Article 77 GDPR (DSGVO) is the next step.
Do I have to pay the debts until everything is resolved?
You do not owe a debt arising from a contract you did not enter into – and you should not settle it “as a precaution” either, just to have peace of mind. A payment can be understood as an acknowledgement, and § 31 Abs. 2 Nr. 3 BDSG even names express acknowledgement as a separate ground that makes a report lawful. What you should do instead: dispute it in writing and verifiably, quote the case number of the criminal complaint, and object to the report. If post arrives from a debt-collection company, the same applies – dispute it there in writing too. In the case of a court payment order (Mahnbescheid), however, you must lodge an objection within the period stated on it, or it becomes final.
How do I even notice that someone is using my identity?
Often late, and mostly indirectly – which is why the annual check is more than a formality. Typical signs: post about contracts you do not recognise, reminders or debt-collection letters about unknown debts, unexplained refusals for loan, tenancy or mobile-phone contracts, or direct debits you cannot account for. The most reliable method remains the free data copy under Article 15(3) GDPR (DSGVO): it shows all contracts and enquiries running under your name. In doing so, check particularly the enquiries from companies – enquiries from providers you have never dealt with are often the first visible sign, frequently before a negative entry is created.
Can I claim compensation?
Possibly, but the question usually has more than one addressee. Against the company that entered into the contract without an adequate identity check, contractual and tortious claims may come into consideration. Against SCHUFA, a claim under Article 82 GDPR (DSGVO) comes into consideration if it processed data unlawfully; the Federal Court of Justice (BGH) confirmed on 13 May 2025 (VI ZR 67/23) that even loss of control alone can amount to non-material damage. There is no fixed amount – what matters are all the circumstances of the individual case. So gather evidence of the concrete consequences from the outset: letters of refusal, contracts that fell through, extra costs. And get advice, rather than counting on a specific sum.
