Online identity theft: what to do.

Digital identity theft represents one of the most insidious forms of wrongdoing in the digital environment, as it allows an individual to appropriate, use, or improperly exploit someone else’s personal data to assume a false identity, access accounts, enter into contracts, obtain financing, make purchases, open bank accounts, or engage in illegal activities while shifting the consequences onto the person whose identity has been unlawfully used. The problem becomes particularly sensitive when identity documents, credentials, photographs, bank data, phone numbers, or personal information are stolen, as these, when combined appropriately, can enable the perpetrator to present themselves online as if they were actually the victim. Therefore, identity theft should not be considered merely a violation of privacy, as the consequences can extend to the financial, contractual, and criminal spheres of the affected individual. One of the most common situations is when an individual discovers that they have been identified as the counterparty of a loan, a phone contract, a purchase, or a bank account that they never requested. In other cases, the identity is used to create fake profiles on social networks, send messages, post content, contact other people, or engage in activities that can compromise the victim’s reputation. Particularly serious is the scenario where the stolen identity is used to commit further fraud, as the seemingly involved individual may find themselves needing to prove they are not the author of the contested transactions. When one realizes they are a victim of identity theft, timeliness becomes essential. It is necessary to accurately reconstruct what has happened, keep every communication received, acquire copies of documents that may have been illicitly used, and gather all information related to contracts, loans, purchases, accounts, or transactions that are foreign to one’s intent. If the identity has been used to enter into a contract or obtain financing, it is advisable to immediately contest the transaction with the interested party, asking for verification of the actual identity of the counterparty and that necessary measures be taken to prevent further consequences for the victim. If bank accounts, payment cards, or other financial instruments are involved, it is necessary to promptly inform the bank or the relevant intermediary and verify the transactions carried out, requesting the blocking of any potentially compromised tools. If instead, the theft concerns a social media account or an email account, one should immediately proceed to change the credentials, disconnect other devices that may be associated with the account, and activate two-factor authentication if available. Additionally, it is crucial not to delete conversations, messages, emails, access notifications, photographs, screenshots, or any other digital elements that may document the incident. Preserving evidence can be crucial in the subsequent reconstruction of the facts and in identifying the responsible party. From a legal standpoint, the conduct must be examined in light of the concrete methods through which the identity was acquired and used, which may give rise to various types of offenses depending on the nature of the activities carried out. The victim can therefore assess the possibility of filing a report with the competent authorities, providing the most precise reconstruction possible of the incidents and making all collected documentation available. The report not only serves as a direct tool for establishing responsibility but may also be essential for demonstrating to banks, financial institutions, companies, digital platforms, or other parties that the contested transactions were carried out by third parties without the consent of the interested party. In addition to criminal protection, it may be relevant to consider personal data protection as well. When personal information has been unlawfully processed or disclosed, the interested party has the tools provided by regulations regarding personal data protection and may, depending on the specific situation, exercise their rights against the data controller or contact the Data Protection Authority. The civil dimension of the matter may also become particularly important when identity theft results in pecuniary or non-pecuniary damages, contractual disputes, derogatory notices, damage to reputation, or other concretely demonstrable consequences. Each situation must therefore be examined in its specificity, avoiding considering identity theft as solely a digital phenomenon. Behind the abusive use of a name, a document, or an account, there can indeed be legal consequences of considerable importance. A person who discovers they have been a victim of identity theft should therefore act without delay, secure their accounts and financial instruments, formally contest unrecognized transactions, preserve all elements of evidence, and timely evaluate the applicable criminal, civil, and data protection initiatives. In a society where an increasing part of personal, professional, and financial life occurs through digital tools, the protection of identity does not only concern safeguarding a password or a document but defending the person in their legal, economic, and reputational dimension. When someone improperly uses our identity, they are not simply appropriating certain data: they may attempt to appropriate our very legal representation in the digital world. And it is precisely for this reason that the timeliness of intervention and the correct legal qualification of the facts can be decisive.