Identity theft

Identity theft is the misuse of personal data (identity) of a natural person by a third party.

The term "identity theft" is very common, but it is not as accurate as "identity fraud" because in a typical theft, something is taken from the beneficiary so that he or she no longer has it. In identity theft, however, the beneficiary can continue to use his identity.

The goal of identity theft may be to achieve a fraudulent pecuniary gain or to discredit the rightful owner of the identity (rare).

Identity theft involves using a range of personal data in addition to the name, such as date of birth, address, driver's license or social security numbers, bank account or credit card numbers, to evade establishing one's actual identity or to falsify it. The more matching data the abuser has, the more confidently he will succeed in the impersonation.

Data that has already been obtained can be used to determine further data. The insurance industry, for example, ran into problems of explanation because a television station obtained the insurance data of the owners - in particular the complete addresses - via license plates selected by chance in road traffic, and the reporter then appeared at the door of the vehicle owners. In the course of the telephone conversations, an accident was first claimed, with which one always gets the name of the insurance company and the contract number via the central call of the car insurers. Then a call was made to the identified insurance company with the contract number, claiming, for example, that the company had just moved and only wanted to check the correctness of the address. As a rule, the insurance company in question would then give the name of the owner and the address - in the good faith that they were talking to the owner.

The misuse of another's identity can lead to indebtedness for the victim or, if criminal acts are carried out in the name of the identity theft victim, to unjustified penalties. If the misuse is discovered, the perpetrator will not only be punished for the misuse itself, but will have to bear the financial damage caused and pay the penalties for the acts committed on behalf of the victim.

Particularly in e-commerce, for example when conducting transactions via the Internet auction house eBay, which does not yet carry out legally binding identity verification, identity theft can have a significant impact on business partners. According to the rulings of the Cologne Higher Regional Court of 6 September 2002 and the Erfurt Local Court of 14 September 2001, when contracts are concluded on the Internet, the seller must prove that the buyer is identical to the alleged account holder. The most effective way for victims of identity theft to defend themselves after the offence has become known is to file a criminal complaint (also against unknown persons) with a police station.

Illegally operating credit agencies manipulate the computers of the respective target persons by phishing, pharming and spoofing and thus first obtain the identity (for example nickname in connection with a password). With this stolen identity, they then gain access to data at online consultancies, contact portals, Internet auction houses and others (information theft) and market the obtained data to "interested parties" (criminals).

Nicknapping

A special form of identity theft is nicknapping (composed of nick, as an abbreviation for nickname, and napping in allusion to kidnapping): the appearance on the Internet under the name or pseudonym of another discussion participant or user.

Since the Internet is also and increasingly used in a public context, it is often possible to use an arbitrary name instead of one's real name. This applies to mailing lists as well as to Usenet and forums.

In doing so, it is possible to use not only invented, but explicitly the names of real existing persons, who do not necessarily have to be aware of the use by third parties. In the case of discussion platforms that require registration, it is necessary that the person in question either does not have a user account themselves or that double registration is possible. The use of pseudonyms in factually similar forums or portals also constitutes a form of nicknapping, provided that there is no independence of the persons involved and the pseudonym is assigned to a known person in the corresponding topic society, i.e. it has a high recognition value.

In terms of criminal law, the misuse of a real name and that of a nickname are to be assessed differently. While the use of a false name in connection with further data and facts about the person is always punishable, the use of the same nickname cannot usually be prosecuted, as nicknames are not protected. Legally equivalent to the "civil name" are only artist names registered in the identity card.

Accounts

Especially on platforms such as XING or StudiVZ, the creation of accounts (or "profiles") under the name of colleagues or fellow students has become a problematic matter for the persons concerned. Since photos of the victims are usually also available, very realistic-looking profiles can be created, with the help of which false information can be passed on to third parties or information can be requested from third parties in good faith.

In this special case, genuine identity theft is conceivable, because in the case of platforms that only allow registration for the same data, the identity holder can no longer create an account if someone has misused his data to create an account.