An example: Daniel deals with orders he never placed
Fictional example: Daniel, an Irish teacher living in Vienna, finds two parcels from an electronics shop outside his flat, although he never ordered there. A week later, a payment provider sends a reminder for €480. The account is in his name and at his address, but linked to an email address he does not know.
Daniel does not pay. He reports the case to the police and writes to the shop and the payment provider, enclosing the police confirmation. He keeps the parcels ready for collection and asks the credit agencies for a copy of his data. When an Austrian court later sends a conditional payment order, he lodges an objection within the four-week deadline.
How can you tell that someone is using your identity?
Germany’s consumer advice centres (Verbraucherzentrale) describe a typical pattern: criminals open accounts with payment services in other people’s names, and many victims only find out through a debt collection letter. Either an existing account of yours has been taken over, or someone has opened a new account in your name that sends all messages to an email address the fraudsters chose.
If one of your accounts was taken over, secure it first, starting with your email: see Email account taken over: check forwarding rules and linked accounts. France’s cybercrime assistance service also advises keeping all evidence, telling every bank you use and having misused identity documents cancelled and replaced.
Tip: If a reminder only arrives by email, check it through your own login with the provider. Unexpected invoice by email: a calm way to check it shows how.
What do you do in the first hour, the first day and the first week?
| When | What you do | What to watch out for |
|---|---|---|
| First hour | Collect all letters, parcels and emails; pay nothing | Keep everything as evidence |
| First hour | Tell your bank if bank details may be affected | Have cards blocked if card data were stolen |
| First day | Report it to the police | Keep the confirmation; some companies ask for it |
| First day | Dispute the claim in writing | Enclose the police confirmation |
| First week | Request your data from credit agencies and report the misuse | Spot other contracts in your name |
| Ongoing | Open court and enforcement letters at once | Note the deadline |
Log dates, senders, amounts, reference numbers and your steps. Documenting a digital incident without giving away more data has a template.
How do you dispute invoices, reminders and collection letters?
You do not have to pay for orders someone else placed in your name, says Austria’s Watchlist Internet. Many companies still ask for the money, so object actively.
Do not ignore a reminder, or the payment provider never learns about the identity theft. The Verbraucherzentrale advises objecting promptly and in writing; after that, further letters about the same claim can be ignored.
- Parcel received: tell the company you did not order it. Keep the parcel ready for collection or ask for a returns form. Do not pay the return postage.
- Invoice only: say that you never received a parcel and cannot send anything back.
- Debt collection letter: object in writing and enclose a copy of the police report. Under German rules, the agency then has to prove that a contract with you exists.
- Repeated orders: some companies want a separate police report for each order. Alternatively, report repeated order fraud as a whole.
Sample wording for your objection
“Dear Sir or Madam, I dispute your claim dated [date], customer number [number]. I did not place this order and have no contract with you. My details were misused; a copy of my police report is enclosed. Please cancel the claim, close the account and confirm this in writing. Yours faithfully”
What if a court order or enforcement notice arrives?
Letters from a court or enforcement office need immediate attention. In German and Austrian payment order procedures, the court does not first check whether the claim is real. Miss the deadline and the creditor can enforce it, even though you never ordered anything.
| Country | Document | Deadline | What you do |
|---|---|---|---|
| Germany | Court payment order (Mahnbescheid) | 2 weeks from service | File an objection with the court |
| Austria | Conditional payment order (Zahlungsbefehl) for claims up to €75,000 | 4 weeks | Lodge an objection; the court then holds a hearing |
| Switzerland | Summons for payment from the debt enforcement office | On delivery or within 10 days | Object orally or in writing, on delivery or at the debt enforcement office |
| France | Order to pay (injonction de payer) | 1 month from service by a commissaire de justice | Lodge an opposition; without it the order can be enforced |
| Italy, Spain | Court orders and enforcement letters | Check the document straight away | Act immediately and get legal advice |
Without an objection in Switzerland, the debt enforcement office can seize income and assets. For your individual case, a consumer organisation or lawyer can advise you.
Where do you report it, and which records do you check?
- Germany: report it to the police, for example via the online police station (Onlinewache). Request your free data copy from SCHUFA and report the misuse to the credit agency.
- Austria: report it to the police against persons unknown and ask credit agencies for a copy of your data.
- Switzerland: credit agencies must answer access requests within 30 days (Article 25 FADP); wrong data can be corrected (Article 32 FADP).
- France: file a complaint with the police or gendarmerie, or in writing with the public prosecutor. Contact the Banque de France and check the FICP, FCC and FICOBA files.
- Italy: check the Bank of Italy’s Central Credit Register (Centrale dei Rischi), free via the online services portal with SPID, CNS or CIE; the reply normally comes within 30 days.
- Spain: request your report from the Bank of Spain’s Central Credit Register (CIRBE). If it shows a loan you did not take out, ask the lender to correct or cancel the data, and complain to the Bank of Spain if that fails.
Across the EU, organisations must give you a free copy of the personal data they hold on you, normally within one month, and you can ask them to correct wrong data. Otherwise, complain to your national data protection authority. Credit checks are explained in Credit refused: ask for the credit check and score to be explained.
Common mistakes
- Leaving reminders unopened, so the provider never learns about the misuse.
- Treating a court payment order like an ordinary reminder and missing the deadline.
- Paying the return postage for a parcel you never ordered.
- Objecting only by phone, with nothing in writing.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Do I have to pay for orders I did not place?
No. You do not have to pay for orders someone else placed in your name. Many companies still ask for the money, so dispute the claim in writing. If a debt collector writes, enclose a copy of your police report; in Germany, the agency then has to prove that a contract with you exists. For your individual case, a consumer advice centre can help.
Do I need a separate police report for every order?
Some companies ask for a separate report against persons unknown for each order. If new orders keep appearing, Watchlist Internet says you can also report repeated order fraud as a whole, which should then also satisfy companies that ask for a report. Give the police every order you know about and report new cases as they come in.
What is different in Switzerland?
EU law does not apply automatically. You object to a summons for payment on delivery or within 10 days at the debt enforcement office, orally or in writing. Credit agencies must answer access requests within 30 days under Article 25 of the Federal Act on Data Protection, and wrong data can be corrected under Article 32. A debt counselling service can help with specific debts.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- Your Europe: Data protection and online privacySource review date:
- Verbraucherzentrale (Germany): What to do if criminals shop in your name (in German)Source review date:
- Watchlist Internet (Austria): Criminals ordering products in my name (in German)Source review date:
- oesterreich.gv.at: Payment order procedure (in German)Source review date:
- ch.ch: Debt enforcement, summons for payment, objectionSource review date:
- FDPIC (Switzerland): Credit and collectionSource review date:
- Cybermalveillance.gouv.fr: Identity theft, what to do (in French)Source review date:
- Service-Public.fr: Order to pay procedure (in French)Source review date:
- Bank of Italy: Access to Central Credit Register data (in Italian)Source review date:
- Bank of Spain: Central Credit Register CIRBE (in Spanish)Source review date:
