Identity theft means that someone uses your personal data to conclude contracts, place orders or open accounts in your name. For students this is particularly risky, because many data points circulate early, for example through registrations, part-time jobs and online accounts. This guide explains the most important immediate steps and how to protect yourself in advance.
Short answer: In a case of identity theft, first inform your bank, have suspicious payments checked and block cards. Then secure evidence and report the matter to the police. These steps match the general measures against fraud listed in a prevention notice of the Ennepe-Ruhr-Kreis district police authority (Police NRW, status February 2025). The notice covers fraud cases in general and not identity theft specifically. Last updated: November 2026.
The most important points
- Act first: inform your bank, have payments checked and block cards.
- Secure evidence before you clean up messages or accounts.
- Report the matter to the police and document the process.
- Check contracts, orders and accounts for use by third parties.
- Pay claims from debt collection agencies only after checking them.
How to recognise identity theft
Misuse often comes to light only when post, reminders or debt collection letters arrive. Sometimes notifications about orders, direct debits or password resets reveal the process earlier. Do not be reassured by such messages, but check them.
| Sign | What to check |
|---|---|
| Reminder or debt collection letter for a contract you never concluded | Check the contract and the provider before you pay |
| Orders you did not place | Check the shop customer account and contact the provider |
| Direct debits you do not recognise | Inform your bank and object to the direct debit |
| Password emails you did not request | Change passwords and check account activity |
The immediate steps in the right order
- Contact your bank or payment service, have suspicious payments checked and block affected cards.
- Secure evidence: letters, emails, screenshots and bank statements.
- Report the matter to the police, in person or through the online police report service.
- Change passwords and check whether the same login details are used elsewhere.
- Inform affected providers in writing and object to unjustified contracts.
The order matters, because payments and accounts must be secured first. Only then does correspondence with providers and debt collectors make sense.
Why evidence matters so much
Without records it is hard to prove that you never concluded a contract. Keep all letters in their original form and note the date, provider and content. The same Police NRW prevention notice lists securing evidence as a step in cases of fraud.
Do not delete suspicious messages in haste. Even seemingly harmless emails can matter later when the origin of the data is in question.
What you can do to prevent it
- Use strong, different passwords and enable a second confirmation step wherever it is offered.
- Share ID and account details only when the recipient has been checked.
- Never disclose login details by email or phone when someone asks for them.
- Check post and reminders promptly, so that you meet deadlines.
Prevention is no guarantee, but it makes misuse considerably harder. Anyone who checks their accounts regularly notices irregularities earlier.
Why students can be particularly affected
During a degree, addresses, accounts, insurance policies and part-time jobs change more often than in many other phases of life. With each change, data is entered, passed on and sometimes forgotten. If you do not keep your documents organised in one place, you quickly lose track, and fraudsters exploit exactly that.
Many students also sign up for services online and agree quickly. Before you send copies of ID or bank details, check which data you really need to provide and whether the provider appears trustworthy.
Checking your accounts after an incident
- Review bank statements for unknown direct debits and credits.
- Check credit card statements for online purchases you did not make.
- Look through your inbox, spam folder and customer accounts for confirmation emails.
- Check mobile phone and insurance accounts for new contracts.
The earlier you spot irregularities, the easier it is to limit the damage. Note the date, amount and provider for each irregularity so that you can document it later.
A practical habit helps as well: keep a short list of your important accounts, with the provider, the payment method and the date you last checked it. Reviewing that list once per term takes a few minutes and shows quickly where something has changed without your knowledge.
Keep copies of the documents you receive from banks, authorities and insurers, both digital and on paper, so that you can compare them quickly if something looks wrong.
Frequently asked questions
Must I pay debt collection claims if I do not know the contract?
No, but you should check them before paying. The guide on debt collection letters explains the steps for clarifying a claim.
Does a police report help with financial losses?
The report documents the matter and forms the basis for further steps. Whether and how losses are reimbursed is decided by your bank and the providers concerned.
May I ask which data companies store about me?
Yes. Under the GDPR you can ask companies which data they process about you. The steps are explained in our guide on the right of access.
Does insurance help with identity theft?
That depends on the policy. Whether an insurer covers costs is stated in its terms. How insurance responds to the consequences of fraud is covered in the guide on phishing losses linked below.
Staying calm on the phone and in writing
If someone calls or writes and claims to act for an authority, a bank or a debt collection agency, while demanding an immediate decision, pause. Check the claim through your own route. Do not use the number the caller gives you, but the number published on the official website.
Fraudsters often rely on urgency and fear. A calm reply in writing, in which you ask for the claim to be documented, is usually the better response. Legitimate institutions can wait for a check.
So what do you do now?
- Inform your bank today and block affected cards.
- Secure evidence and report the matter to the police.
- Check contracts and accounts, object to unjustified claims in writing and change your passwords.
Related reading
- Consumer rights in everyday life: protection against fraud and unfair contracts
- Social media account hacked: first steps for students
- Debt collection letters: what to check before you pay
- Phishing losses: does insurance pay the money back?
- Right of access under the GDPR: which data companies hold about you
Sources:
Last updated: November 2026. This guide is general information, not individual advice.
