Insurance broker / Insurance questions / Cyber insurance

What to do about online identity theft in Germany?

In short

What to do about online identity theft in Germany: change your passwords at once, block cards and online banking and report it to the police. Dispute every contract you did not make in writing and contact Schufa, the main credit agency, whose data copy is free. You have two weeks to object to a court payment order (Mahnbescheid). A cyber policy helps with the clean up, but you do not need one for these steps.

Request a quote +49 3375 29 12 77

What it costs

What help and prevention for identity theft cost in Germany, based on published prices and test results.

Example	Typical range
Schufa data copy under Art. 15 GDPR	EUR 0
Ongoing Schufa monitoring, smallest package	about EUR 4.95 a month, around EUR 59 a year
Personal cyber policy, basic tariff for one person	around EUR 45 a year
Personal cyber policy paying up to EUR 3,000 per fraud case	around EUR 137 a year
Range of all tested cyber tariffs, one person	EUR 7 to 212 a year

Guide values as of October 2026 from published prices and the consumer test of May 2024.

Police reports, objection letters and court objections cost next to nothing; the postage in the example and the assessment of when monitoring pays off are guide values from our quoting practice.

Identity theft benefits are set out in each tariff's terms; we obtain the exact quote for you.

Worked example

Three orders on invoice in your name

Someone uses your name and date of birth to order electronics worth EUR 1,400 to a parcel locker. Six weeks later a debt collector sends you a reminder.

Online police report, objection by registered mail to shop and debt collector	about EUR 5 postage
Schufa data copy and correction	EUR 0
Claim of EUR 1,400 plus collection fees	you owe nothing if you dispute it in time
The shop sues anyway and you need a lawyer	paid by legal expenses insurance or a cyber policy with legal cover, otherwise by you

With a quick objection the case costs mainly time. It only gets expensive if you miss deadlines or face court proceedings without legal cover.

How you notice identity theft

Most people find out when a letter arrives: an invoice for an order they never placed, a reminder from a debt collection agency (Inkassobüro) or a confirmation of a mobile phone contract. Others notice because they can no longer log in to their email or a social network.

Criminals often need only your name, date of birth and address. With that they order goods on invoice to a parcel locker. Your bank details or passwords do not have to be stolen for this.

The steps in the right order

First close the door: secure your accounts, block cards, check your devices for malware. Then collect evidence and report the crime. Only after that deal with the claims and your entries at credit agencies.

The reason for this order: as long as the criminals can read your mailbox, they also see every password reset email.

What happened	What you do	How fast
Email or social media account taken over	reset the password from another device, switch on two factor login	at once
Unknown debits on your account	block card and online banking, ask the bank for a refund	at once
Invoice or reminder for an order you did not place	dispute the contract in writing, enclose a copy of the police report	within a few days
Court payment order (Mahnbescheid)	file an objection (Widerspruch) with the court	within two weeks
Wrong entry at Schufa	request the free data copy, demand correction in writing	as soon as you have the police report
Fake accounts or profiles in your name	report them to the platform and ask for deletion	at once

You do not have to pay bills that are not yours

If you did not make a contract, you owe nothing. You do have to object actively, though. Write to the shop or debt collector that you ordered nothing, enclose the police report and ask them to block your data. Registered mail (Einschreiben) is the safe way.

With a court payment order the deadline matters. German courts send it in German, and if you do not object in time, an enforcement order follows and your wages or account can be seized even though the claim is false. If you struggle with the language, get help immediately rather than waiting.

What a cyber policy does and does not do

Depending on the tariff, a personal cyber policy pays for a lawyer, helps delete fake profiles and sometimes refunds money that fraudsters took. In a consumer test, 11 of 20 tariffs searched the internet for misused personal data, but none could guarantee deletion.

You still have to take the steps above yourself, and they cost almost nothing. If you already have legal expenses insurance (Rechtsschutzversicherung) and mostly pay by direct debit or credit card, you usually do not need an extra policy for identity theft.

When you do not need paid Schufa monitoring

Paid monitoring services report new entries faster. For most people the free data copy is enough, for example after a data leak and once more two months after the incident as a check.

A monitoring contract is more useful if your data is known to be circulating and has already been misused several times.

Step by step

Change the passwords of email, bank and shops from a clean device and switch on two factor login.
Block cards and online banking via the blocking line 116 116 and reclaim unauthorised debits.
Save screenshots, invoices and reminders and report the crime to the police.
Dispute every claim that is not yours in writing and enclose the police report.
Request the free Schufa data copy and have wrong entries corrected.
Report the case to your cyber or legal expenses insurer if you have one.

Checklist

A separate password for every account
Two factor login for email and bank
Copies of your passport or ID card only sent with parts blacked out
Checked whether your email address is in a known data leak
Free Schufa data copy reviewed once a year
Checked whether legal expenses or contents insurance already help with online misuse

Common mistakes

Ignoring bills that are not yours instead of objecting in writing
Missing the two week deadline for a court payment order
Changing passwords on the infected device that still runs malware
Not reporting to the police, without a report shops and insurers often do not believe you
Buying an expensive monitoring service out of fear although the free data copy is enough

Questions and answers

Frequently asked

Do I have to pay an invoice caused by identity theft?

No. Without a contract made by you there is no debt. You do have to dispute the claim in writing.

Where do I report identity theft in Germany?

To the police, in every federal state also through the online police station (Onlinewache). Keep the case number, shops and insurers will ask for it.

Does the bank pay if strangers use my account?

Yes, it must refund an unauthorised payment. You bear at most EUR 50 unless you were grossly negligent, for example by passing on a TAN.

I have only lived in Germany for a short time. Can I still have a Schufa entry?

Yes, as soon as you have a German address, bank account or phone contract, data about you can be stored. The free data copy shows what is there.

Does contents insurance help with identity theft?

Only with an add-on for online banking or online fraud, and then usually only for money lost, not for fighting off false invoices.

Do I need a lawyer after identity theft?

Often not. If you are sued or a debt collector does not stop, a lawyer is worth it; legal expenses insurance or a cyber policy with legal cover then pays.

Sources

NAMMERT insurance broker

Request a quote: Cyber insurance

We compare insurers and come back to you, in English. Free; the insurer pays our fee.

1Who is it for?

Personal My company

Company Industry Number of employees Annual turnover (roughly)

2Which insurance?

Choose as many as you like. For each one, the details an insurer needs for a quote appear below.

Personal

Business

Please review all my existing policies

3Details

Cyber insurance for businesses in Germany

Annual company turnover * Number of employees * Sector and business activity * Do you sell online or accept card payments? * How is your data backed up? * Is multi-factor authentication set up for email and remote access? * Security incidents in the last five years * Preferred limit of indemnity Rule of thumb: cost of three to four weeks of downtime plus recovery

4Your current policy

Current insurer Policy ends on What matters more to you?

5How can we reach you?

Name * Email * Phone Postcode Town Preferred contact Anything else we should know