Online identity theft in France: fake profile, loan or purchases in your name

A letter from a debt collection agency demands the instalments of a revolving credit you never signed. The same month, a friend sends you a screenshot of an Instagram profile bearing your name and your photographs, offering investments to your relatives. You lost nothing, clicked nothing, handed over nothing. Someone simply found a copy of your identity document and is living under it in your place. What you must contest, what you must never pay, and how to stop the use of your name.

Identity theft is not a single offence; it is a situation that produces several, and it puts you in an unusual position: you are not the person who lost money, you are the person in whose name the money was obtained. Creditors, platforms and credit files treat you first as the debtor or the author. The whole task is to reverse that presumption, and it starts with an inventory.

Recognising identity theft: four situations

Online, identity theft takes four forms, which call for different responses and often overlap.

The fake profile. An account on a social network, a messaging service or a dating site bears your name and your photographs. It is used to solicit your contacts, to ridicule you, or to sell something on the strength of your name.

The contract taken out in your name. A consumer loan, a phone subscription, an online bank account, a rental, opened with a copy of your identity document and a forged or stolen proof of address. You learn of it from a reminder, a direct debit, or an entry in the Banque de France’s incident file.

Purchases and merchant accounts. Orders placed in your name, sometimes delivered to your address and then collected, accounts on marketplaces, refund or benefit claims made with your data.

Your name given in someone else’s place. A person stopped by the police identifies themselves under your identity, or designates you as the manager of a company, the driver of a vehicle, the holder of a phone line. The fines, the summonses or the prosecutions come to you.

These situations share one source: your identity data is in circulation. An identity document photographed for a rental or a subscription, an application file, a data breach at a service provider, a compromised mailbox are enough. If it is an account that was taken over, the recovery steps are those of our article on hacked accounts; here, the account is yours, but the name no longer is.

Measuring the extent before contesting

You can only contest properly what you have inventoried. Three checks, in this order.

• Bank accounts opened in your name. The national register of bank accounts (Ficoba) lists them. You obtain the list through the secure messaging of your impots.gouv.fr account, or by letter to the tax office for your home. An account you do not recognise is the surest sign of identity theft, and it is often the account into which the fraudulent loan was paid.
• The Banque de France files. The file of repayment incidents on loans to individuals (FICP) and the central cheque file (FCC) can be consulted free of charge, online from your personal area on the Banque de France website, at a counter or by post. An entry you cannot explain names the institution that requested it: that is the one you will have to approach.
• The paper trail. Statements of your own accounts, collection letters, fixed penalty notices, confirmation emails for account openings or orders, search alerts on your name. Keep everything, in chronological order, with the envelopes.

Tell your banks, all of them if you have several, and your employer if payslips may have been used. If your identity document was stolen, lost or used by the impersonator, have it cancelled and renewed: the report dates the moment from which any use of the old document becomes suspect.

The loan or subscription taken out in your name: you owe nothing, and the lender must prove otherwise

This is the point on which victims most often give in, and wrongly. A contract binds only those who consented to it. When the lender or the operator claims the instalments from you, you do not have to demonstrate that you did not sign: you disavow the signature, and it is for the party relying on the document to establish that it is genuine (Article 1373 of the French Civil Code). The Court of Cassation quashed the judgment of a court of appeal that had ordered a borrower to repay a €30,000 loan on the ground that he “does not prove that he is not the beneficiary of the loan offer”: by reasoning in that way, the judges had reversed the burden of proof¹. For an online subscription, an electronic signature is presumed reliable only if the signatory’s identity was verified under the conditions set by decree (Article 1367 of the Civil Code); a sign-up process in which a photograph of an identity card and a selfie were enough is open to challenge, and the lender must produce the complete file.

Three practical consequences. Pay nothing, not even one instalment “to buy time”: a payment will be presented as an acknowledgement. Reply in writing, by registered post, to the lender and to the collection agency, disavowing the signature, attaching the complaint receipt, and requesting a full copy of the application file, identity documents and supporting documents included. Finally, do not base your challenge on the bank’s anti-money-laundering vigilance duties: the Commercial Chamber held in March 2026 that those duties serve only the fight against money laundering and that the victim of a fraud cannot rely on their breach to claim damages². The useful ground is the absence of consent and, for compensation, the lender’s ordinary fault in accepting a visibly altered document or an inconsistent file.

The Banque de France listing. The FICP entry does not fall with your challenge: it survives until the declaring institution withdraws it. The Banque de France is not authorised by law to delete an incident on its own initiative. The procedure: ask the institution in writing to remove the entry, with the complaint receipt; if it refuses or does not answer, write to the Banque de France with a signed letter naming the institutions and the incident references, a copy of your identity document and a copy of the complaint. The Banque de France then questions the institution and, where the institution acknowledges the identity theft, adds a special note to its files warning consulting banks that you are not behind the incidents. If the institution maintains the entry, the application for removal is brought before the protection litigation judge (juge des contentieux de la protection) of the judicial court (Article L. 213-4-6 of the Code of Judicial Organisation), not before the enforcement judge, who has no power to rule on it³.

The fake profile: have it removed, then prosecute

A profile that steals your identity is dealt with on two fronts that do not wait for each other.

Removal is obtained from the platform. Every social network has an impersonation reporting form, which asks for a copy of your identity document; the EU Digital Services Act requires the platform to process your notice in a timely, diligent and objective manner, then to notify you of its decision, with information on the possibilities for redress. Before reporting, secure the evidence: dated screenshots, the exact address of the profile and of each post, and, if the profile was used to solicit your relatives or to disparage you, a report by a commissaire de justice (the French judicial officer), because the content will disappear with the account.

Prosecution falls under Article 226-4-1 of the Criminal Code: using a third party’s identity, or data identifying them, with a view to disturbing their peace or that of others, or damaging their honour, is punishable by one year’s imprisonment and a €15,000 fine, doubled where the offender is the victim’s spouse, cohabitant or civil partner. The specific intent required by the text is inferred from the facts: a profile that asks your friends for money disturbs their peace, a profile that publishes in your name words you would never have spoken damages your honour. The Court of Cassation has held that the impersonator is punishable even if they are not the author of the messages published under someone else’s name, as long as they made their publication possible⁴. No repetition is required: a single profile is enough.

The civil route remains open in parallel: Article 9 of the Civil Code allows the interim relief judge to order any measure to stop an invasion of privacy, and the use of your image without your consent gives rise to separate compensation. To trace the author behind the username, the mechanism of requisitions and of the European Production Order is the one we describe in our article on identifying the author of an anonymous account.

The offences committed in your name

The complaint should name each offence, because each opens its own investigative powers and its own compensation.

Fraud (escroquerie, Article 313-1, five years’ imprisonment and a €375,000 fine) is made out as soon as the impersonator obtained property, a service or a loan “by the use of a false name”. The name of a real person is a false name within the meaning of the text, and the use of a document bearing a forged signature is at the same time the offence of forgery⁵. The victim of the fraud is the organisation that was deceived; you, whose name was used, are the victim of the offences committed against your identity, the impersonation and the forgeries, and that is the basis on which you join the proceedings as a civil party.

Forgery and use of forged documents (Article 441-1, three years and €45,000) cover the altered identity document, the fabricated proof of address, the imitated signature.

Taking a third party’s name (Article 434-23, five years and €75,000) punishes whoever takes your name “in circumstances which have led or could have led” to criminal proceedings against you. It is the provision for the fines and summonses you receive for acts you did not commit. The Criminal Chamber applied it in January 2026 to a company director who had used a third party’s identity to designate him as the legal manager of six companies, whose management gave rise to prosecutions for undeclared work, bankruptcy offences and misuse of corporate assets: it is enough that the impersonation could have exposed the victim to prosecution⁶. The penalties for this offence are added, without merger, to those for the offence committed in your name.

Fraudulent collection of personal data (Article 226-18, five years and €300,000) covers the obtaining of your data itself, by phishing, theft or purchase on an illicit market.

To these provisions is added Article 226-4-1, already mentioned, which also applies to legal persons: a company name, a logo, a domain name are “data identifying” a business.

Filing a complaint, and making it your key document

The complaint is filed at a police station or a gendarmerie, which are required to receive it and to issue an immediate receipt (Article 15-3 of the Code of Criminal Procedure), or by registered letter to the public prosecutor at the judicial court for your home, which we recommend as soon as the file involves several contracts or several institutions.

It should contain the inventory made above: each contract, each account, each profile, with references, dates, amounts and the name of the organisation, copies of the reminders, and the circumstances in which your data may have been obtained. It cites the offences one by one and expressly requests the useful requisitions: application files from the lenders, IP addresses and contact details registered with the platforms, the identity of the holder of the accounts into which the funds were paid.

The complaint receipt is then the document you will attach to every challenge: to the lender, the collection agency, the Banque de France, the operator, the platform, the authority claiming a fine from you. Cybermalveillance.gouv.fr, the French government’s cybercrime assistance service, recommends adding a sworn statement that you are not the author of the acts complained of. Without the receipt, you are a debtor who disputes; with it, you are a victim who reports.

The limitation period for these offences is six years. The challenges, however, cannot wait: a FICP entry takes effect the next day, and an order to pay keeps running.

The impersonated business: fake website, fake director, fake bank details

Identity theft also targets businesses, and increasingly so: a website that copies your name and your branding to sell what you will never deliver, a professional profile in your director’s name that canvasses your customers, an email announcing a change of bank details. The fact sheet published in May 2026 by cybermalveillance.gouv.fr with the FEVAD, the Ministry of the Interior and the ANSSI sets out the steps: keep the evidence, identify the host and the domain name registrar through a Whois or RDAP service and contact their abuse reporting services to have the site taken down, report the accounts used to the platforms, ask search engines to delist the site, and file a complaint.

The offences widen: to identity theft and fraud is added trademark counterfeiting (Articles L. 713-2 and L. 716-10 of the Intellectual Property Code, three years and €300,000, increased to seven years and €750,000 where the acts are committed on an online public communication network). Where the fake site or profile is also used to disparage you, the short time limits of press law apply as well, and we set them out in our article on online reputation.

Obtaining compensation

Identity theft costs time, expenses, sometimes a refused loan or rental for as long as the listing lasts, and damage to reputation. These losses are compensated on two fronts.

Against the impersonator, once identified: joining the proceedings as a civil party before the criminal court or the investigating judge, for the whole loss, both non-material and material.

Against the organisation that contracted with the impersonator: reimbursement of the sums debited from your accounts, and damages where an ordinary fault of vigilance is established, for instance the acceptance of an identity document whose date or photograph did not match, or of a proof of address inconsistent with the file. Most legal protection insurance policies cover these steps; check yours.

Frequently asked questions

Do I have to repay a loan taken out in my name by an impersonator?

No. A contract binds only the person who signed it, and when you disavow the signature, it is for the lender to prove that it is yours, not for you to prove that it is not. Pay no instalment, reply in writing with the complaint receipt and request the complete application file.

I am listed at the Banque de France for a loan I never took out: how do I get out?

First ask the institution that declared the incident to remove the entry, with the complaint receipt. If it refuses or does not answer, write to the Banque de France with a signed letter, a copy of your identity document and a copy of the complaint. If the institution acknowledges the identity theft, a note is added to the files; if it maintains the entry, removal is sought from the protection litigation judge.

How do I find out whether accounts or loans have been opened in my name?

The list of bank accounts opened in your name is obtained from the Ficoba register, through the secure messaging of your impots.gouv.fr account. Loans in default and cheque bans are checked by exercising your right of access to the Banque de France’s FICP and FCC files, free of charge, online.

Is a fake profile in my name that says nothing nasty an offence?

Yes, as long as it is made to disturb your peace or that of others, or to damage your honour. A profile that solicits your contacts, that has you say what you did not say or that attributes to you an activity you do not carry on meets that condition. A mere namesake, without your photographs or your data, is not identity theft.

My identity data was obtained from a copy of my ID card: what should I do with the card?

Have it cancelled and renewed: the report dates the moment from which any use of the old one becomes suspect. For the future, only send a copy after writing across the document the purpose of sending it, the date and the recipient.

How long do I have to act?

Six years for the complaint, from the facts. But the challenges to the bank, the application for removal and the takedown of the fake profile must be started without delay: every day of listing is a day of refused credit, and every day of a fake profile is one more contact solicited in your name.