Advice for victims of identity theft or data breaches

Information security now!

Published 25.10.2020 10:42

Identity theft can take place following a data breach, for example. Keep reading for advice on how to proceed if you have been targeted by identity theft or your personal data has been made public as a result of a data breach.

What is identity theft

Identity theft entails using someone else’s identity. To this end, perpetrators of identity theft make use of another person's personal data, identification data or other information that can be used to identify an individual. Such information includes names and address details, personal identity codes, phone numbers and online banking credentials.

In practice, identity theft may mean assuming the identity of another person and using it to make a purchase at an online store, which is then billed to the victim of the identity theft.

Criminals use a number of methods to collect the personal data required to commit identity theft, including exploiting data leaks on the internet or perpetrating phishing scams. The kind of personal data used to commit identity theft has recently been obtained by criminals via scam phone calls in which they have claimed to represent technical support.

“A person who in order to deceive a third party unlawfully uses the personal information, access codes or other corresponding identifying information of another and in this manner causes economic loss or more than petty impediment to the person to whom the information belongs, shall be sentenced for identity theft to a fine.”

What can I do if I have been the victim of identity theft?

Make sure you carefully consider the following steps. A ban on address changes, for example, has consequences when submitting a notification of a change of address. Familiarise yourself with the available options, materials and services carefully before taking action.

If a criminal has gained access to your online banking account or your credit card details, contact your bank immediately.

You can file a report online (External link)

You can set a voluntary ban on credits for yourself in the Positive credit register's e-service. The voluntary ban on credits can be set either for an indefinite or a fixed period. You can remove the credit ban at any time.

Positive credit register (External link)

If you wish, you can choose that your bank account number can be changed only by a person who has logged in to MyTax. If you do so, the account number cannot be submitted on paper.

Go to MyTax and select Taxpayer details.
Scroll down to Setting security restrictions on the use of Tax Administration services.
Select Change the restrictions.
Under Method of reporting details, select Reporting details permitted in MyTax only.
Click Next.
Re-check the changes you made and click Submit.

Vero: Submitting or changing your bank account number (External link)

Apply to the Finnish Patent and Registration Office for a registration ban (External link). Also make sure that any existing information cannot be altered without first contacting you at a specific phone number or email address.

Prohibition of registration to the Finnish Trade Register, the Finnish Register of Associations and the Finnish Register of Foundations (External link)

Digital and Population Data Services Agency: Block a notification of move (External link)

If criminals have gained access to the picture or details of your identification, notify the police of a lost document and apply for new identification.

Reports of missing documents (External link)

Digital and Population Data Services Agency: Tietojen luovuttamisen kieltäminen (External link)

If your personal and address data require particular protection, consider applying for a non-disclosure for personal safety reasons and address protection. Applications for a non-disclosure for personal safety reasons can be submitted to the Digital and Population Data Services Agency. (External link) The decision to apply should be based on careful consideration. The need for a non-disclosure for personal safety reasons must always be justified, and an application is required in all cases.

Contact the following organisations for more information on identity theft.

Victim Support Finland (RIKU):
How can I protect myself from identity theft and reduce the risks of other crimes resulting from it? (External link)
What to do if your personal data has been leaked online (External link)

ENISA:
ENISA Threat Landscape 2020 - Identity Theft (External link)