When Someone Uses Your Name: Identity Theft and Impersonation

This is serious, and it is not rare. In 2025 the Slovenian police recorded 40.4 million euros of reported online fraud – a third more than the year before – and SI-CERT handled a record number of cases (numbers and cases below). Behind many of these cases is somebody's stolen or faked identity: a hijacked account, a forged sender, a cloned voice, a fake profile. If money is being taken right now, call your bank first and read later.

I am not a lawyer, and scams change every month, so check current guidance before you rely on any detail below. Should you decide to act upon any information on this website, you do so at your own risk!

Jump to Examples

Not long ago somebody close to me told me about strange e-mails he was getting, and it looked a lot like somebody was using his name. While we talked it through, I realised that most people – me included – don't really know what these signs mean, how serious they are, or what to do first. So I sat down and wrote it all in one place.

Identity misuse sounds like something from an American film, with credit scores and social security numbers. In Europe it looks a bit different, but it happens all the time: an e-mail address used to register somewhere, a fake profile that asks your friends for money, a phone contract or an online shop account in your name. The good news is that most of it can be stopped early, if you know what you're looking at.

What "Using Your Identity" Can Mean

It is not one thing. It helps to separate four kinds, because the first steps are different:

• Account takeover. Somebody gets into an account that is really yours – e-mail, Instagram, WhatsApp, a web shop. The most dangerous one is e-mail, because whoever controls your e-mail can reset the passwords of almost everything else.
• Impersonation. Nobody is in your accounts, but somebody pretends to be you: a fake profile with your photos, an e-mail with your address in the "From" line, a WhatsApp message from a "new number". Your friends and family are the target, not you.
• Financial identity fraud. Your name, date of birth, address or a photo of your ID card is used to buy on invoice, open an account, take a loan or sign a contract. You find out when a reminder or a debt collector arrives.
• Just your e-mail address. Somebody types your address when registering – by mistake, to annoy you, or to hide something (more about that below). Often harmless, sometimes the first sign of the other three.

A Bit of History

Pretending to be somebody else is as old as names and signatures – forged letters, stolen cheques, fake documents. The term identity theft itself is younger than most people think: Merriam-Webster dates its first known use to 1964. It became an everyday word only when our identities moved online and companies started to collect them in big databases.

Then the databases started to leak. In 2017 the American credit bureau Equifax lost the data of about 147 million people, including social security numbers, and later agreed to a settlement of up to 700 million dollars. In 2013 the Australian security researcher Troy Hunt started Have I Been Pwned to let people check whether their e-mail appeared in such leaks. By early 2025 it held more than 14 billion leaked accounts from over 800 breaches. There is a good chance your e-mail address is in there too, maybe with an old password. That is not a reason to panic – it is the reason why reused passwords are so dangerous.

How big is the problem? The best public numbers come from the USA. In 2024 the American Federal Trade Commission received more than 1.1 million reports of identity theft, and people reported losing more than 12.5 billion dollars to fraud. E-mail was the most common way scammers made the first contact, ahead of phone calls and text messages.

And now AI. AI has already changed this field a lot, mostly in favour of the criminals. A phishing e-mail in perfect Slovenian, without a single mistake, costs nothing to write. A profile photo of a person who doesn't exist takes seconds. A short recording of somebody's voice, for example from a video on social media, can be enough to clone it. In December 2024 the FBI warned that criminals use generative AI for exactly this: cloned voices of relatives asking for urgent help, fake ID documents, and realistic photos for fake profiles. Their advice is surprisingly old-fashioned and good: agree on a secret word with your family and ask for it when a "relative" calls in panic and wants money. The old signs of a scam – bad grammar, a strange photo – don't work any more. What still works is checking through a second channel.

Where They Get Your Data

• Leaks. A web shop or a forum you used years ago gets hacked, and your e-mail, password, address and phone number end up on lists that are sold and traded.
• Phishing. A fake parcel, bank or "your account will be closed" message, and a page that looks real. You type the password yourself.
• Info-stealer malware. A cracked game, a fake update or a "free" program that quietly copies the passwords saved in the browser and the login cookies – with the cookies they can sometimes skip the password and even the second factor.
• What we publish ourselves. Date of birth, school, the dog's name, the photo of a new car with the number plate, a boarding pass with the booking code. Each piece is harmless; together they answer "security questions" and make a fake profile believable.
• Photos of documents. A photo of an ID card sent over a chat "for the apartment rental", a scan in an old e-mail, a copy left at a hotel. With a photo of a document, many online services will open an account.
• The phone number. If somebody talks the mobile operator into moving your number to a new SIM card (SIM swapping), they receive your SMS codes.
• A lost or stolen wallet. Still a classic.

What Somebody Can Do With It

Documented Cases and Numbers

So that this doesn't stay abstract – these are real, documented cases and figures, most of them from Slovenia:

• Slovenia, 2025 – record year. SI-CERT handled 6,196 incidents, 35% more than in 2024, among them 1,995 phishing cases. They write that phishing is still the main tool for getting into people's accounts. The police recorded 40.4 million euros of reported online fraud, 33% more than in 2024. (SI-CERT, report for 2025)
• Slovenia, 2024 – fake investments with famous faces. Investment scams alone cost Slovenians more than 19 million euros, on average more than 27,000 euros per victim, according to police data quoted by SI-CERT. They are advertised on Facebook with the misused photos and names of well-known people and brands. (N1, May 2025)
• Slovenia, 2025 – even the Prime Minister. Paid Facebook ads used edited photos of Prime Minister Robert Golob in the style of a Slovenian newspaper, with a made-up story about his arrest, to lead people to crypto and similar scams. The government reported them and published what it found. (gov.si, February 2025)
• Slovenia, 2024 – "Hi mum and dad". SMS messages from an unknown number pretending to be your child with a broken phone, moving the conversation to WhatsApp or Viber and asking for money. (N1 / Varni na internetu, May 2024)
• Slovenia, August 2025 – a forged voice on WhatsApp. In the Goriška region an employee received a voice message and a profile that pretended to be a representative of a foreign business partner, and transferred tens of thousands of euros to an account abroad. Voice and profile were both fake. (N1, August 2025)
• Hong Kong, 2024 – a whole video call of fakes. A finance employee of the engineering company Arup (the firm behind the Sydney Opera House) joined a video call with what looked like the CFO and colleagues – all of them deepfakes – and made 15 transfers worth about 25 million US dollars. Arup confirmed that fake voices and images were used. (CNN, May 2024)
• USA, 2024. More than 1.1 million identity theft reports to the FTC and 12.5 billion dollars of reported fraud losses (above).

Most of them have the same two things in common: somebody trusted a name, a face or a voice without checking it through a second channel, and by the time anybody checked, the money was gone. The losses that SI-CERT hears about are reported voluntarily, so the real numbers are higher.

Reading the Strange E-mails

Strange e-mails are often the first sign, so I'll go through them carefully. Different e-mails mean very different things:

Registrations and reset codes without any "new sign-in" alert usually mean that somebody is trying, but is not inside yet. That is the best moment to react – before the "new sign-in" e-mail arrives.

What to Do – in This Order

1. Calm down and keep the evidence. Don't click, don't reply, don't pay. Take screenshots, keep the e-mails (don't delete them), write down dates and times. You'll need them for the bank, the platform and the police.
2. Secure the e-mail account first – from a device you trust, not the one that might be infected. New long password (from a password manager), a second factor (an authenticator app or a passkey), "sign out of all other sessions", and then check what attackers like to change: the recovery e-mail and phone, forwarding rules, filters that hide or delete messages, connected apps and app passwords. Example 2 shows where to click.
3. Then the other important accounts: bank, PayPal and similar, the Apple, Google or Microsoft account, social networks, shops with a saved card. A new, different password on each, and a second factor. If you used the same password anywhere – change it there too.
4. Money. Call the bank if anything looks wrong, block the cards, turn on a notification for every payment. In Slovenia, look at your credit record in Moj SISBON (Example 3) – a loan or a leasing contract you don't know about will show up there.
5. The phone number. If SMS codes stopped arriving or the phone suddenly shows "no service", call the operator immediately – that's how a SIM swap looks. Ask whether they can protect changes to your number with a password or require a visit in person.
6. Warn the people around you. A short message to family and friends: "Somebody is pretending to be me; if 'I' ask for money or codes, call me first." Report fake profiles to the platform (Example 4).
7. Report it. The addresses for Slovenia are in the next section. Reporting feels pointless when nothing was stolen yet, but it gives you a document with a date – useful if a debt collector appears months later.
8. Write down what happened while you still remember: a simple timeline in a text file. And put a reminder in the calendar to check SISBON and the e-mail account again in a few weeks.

Where to Report in Slovenia

The law, in short. In the Slovenian Criminal Code, Article 143 (zloraba osebnih podatkov) covers, in its fourth paragraph, taking over another person's identity or using their personal data to exercise their rights, in order to gain a benefit or to harm their dignity. According to the Information Commissioner's opinion on fake profiles, this is the provision that covers identity theft, it is prosecuted on the victim's proposal, and you report it to the police or the state prosecutor; you can also claim damages. Whether a particular case is a crime is decided by the courts. For your own case, ask a lawyer – this is only the map, not the advice.

The Foundation Today

None of this is optional any more. These few things are today's minimum – for every account that matters, on every device, for every person in the family:

1. Two-step verification (a second factor) everywhere it exists – first e-mail, then bank, then the Apple, Google or Microsoft account, then social networks. Better a passkey or an authenticator app than SMS. A Microsoft study from 2023 found that it reduced the risk of an account being taken over by 99.22%, and by 98.56% even for accounts whose password had already leaked.
2. Updates, automatically and quickly – phone, computer, browser, router, apps. Attackers don't only steal passwords: in the Verizon breach report for 2025, stolen credentials were the way in for about 22% of breaches, and exploited software vulnerabilities for 20%, up by a third in one year. A device that no longer gets updates should be replaced or kept off the Internet.
3. A different password for every account, from a password manager. Then one leak stays one leak. You remember only one long passphrase.
4. Check through a second channel before you act. Before money, codes or passwords leave your hands: call back on the number you already know, log in to the bank yourself, ask the family code word. This is the one rule that also works against AI fakes.
5. Notifications on. A message for every card payment, for every new sign-in, and in Slovenia for every new contract or inquiry in SISBON. You can't stop everything, but you can notice in minutes instead of months.
6. A backup of what you couldn't replace – if an account is lost for good, the photos and documents shouldn't go with it (see Constructing a Backup).

How to set these up step by step is in Security Considerations, with a checklist for one evening.

Making It Harder

On top of the foundation, these are the extra things that matter for identity:

• Protect the main e-mail like a key to the house. It gets the best password and a passkey or authenticator app, and it is not the address you type into every shop. Use a second address (or aliases, if your provider has them) for shopping, newsletters and Wi-Fi logins.
• Don't send photos of documents if you don't have to. If you must, cover what isn't needed and write across the photo who it is for and the date ("for apartment X, 26 Oct 2026, only"). Search your own mailbox for old scans and delete them.
• Share less in public. Birthday, school, address, the names of pets and children – a profile that is visible only to friends gives a fake profile much less to copy.
• A family code word. Especially with older parents and with kids. If "your son" calls from an unknown number and needs money now, the word decides.
• Check from time to time: Moj SISBON (or better, turn on its notifications), Have I Been Pwned with a notification for your addresses, the list of devices on your Google, Apple or Microsoft account.
• Every payment gets a notification. Most banks can send one for each card payment – fraud is noticed in minutes instead of at the end of the month.
• Lock the SIM and the phone. A SIM PIN and a screen lock; more in How Safe Is Your Phone?

Examples

Example 1: Is This E-mail Really From Them?

The "From" line of an e-mail is just text – anybody can write anything there. What the receiving server actually checked is in the headers. In Gmail open the message, click the three dots and choose Show original; in Outlook on the web it's View → View message source (the menu names change now and then). Gmail shows the result of three checks at the top:

SPF:   PASS with IP 209.85.220.41
DKIM:  'PASS' with domain bank.example
DMARC: 'PASS'

In the full headers look for the line Authentication-Results. A forged message looks more like this:

Authentication-Results: mx.google.com;
       spf=fail (domain of bank.example does not designate 203.0.113.5 as permitted sender)
       dkim=none;
       dmarc=fail (p=REJECT) header.from=bank.example

dmarc=pass means the message really came from a server allowed to send for that domain. It does not mean the message is honest – a scammer can register bank-example-secure.com and pass every check for it. So read the domain after the @ letter by letter. dmarc=fail for a domain that should be strict (a bank, a big shop) is a strong sign of forgery. How SPF, DKIM and DMARC work is in Constructing E-mail.

Example 2: Checking an E-mail Account for Intruders

This is the order I would go in, on a computer. For a Google / Gmail account:

1. myaccount.google.com/security: Recent security activity and Your devices – sign out every device you don't recognise. Check the recovery phone and e-mail.
2. In Gmail: settings (gear) → See all settings → Filters and Blocked Addresses. A filter that deletes or archives messages from your bank, or anything with "security" or "password" in it, is a classic trick to keep you blind.
3. Same place, Forwarding and POP/IMAP: is your mail being forwarded to an address you don't know?
4. Under Third-party apps & services in the Google account, remove anything you don't use.

For a Microsoft / Outlook account the same ideas are under account.microsoft.com/security (sign-in activity) and in Outlook settings under Rules and Forwarding.

Then search the mailbox for the traces of registrations from the last months. In Gmail's search box:

newer_than:90d subject:(welcome OR verify OR confirm OR "password reset" OR "new sign-in")

Go through the list and make two piles: services you know (fine) and services you don't. For the second pile, visit the service's own website (not the link in the mail), use "forgot password" with your address to see whether an account exists, and if it does, take it over and delete it or ask the service to close it. It's boring work for an evening, but at the end you know exactly where your address is used.

Example 3: Checking Your Credit Record in Slovenia

In Slovenia, loans, leasing, credit cards and overdrafts are recorded in SISBON, a system run by the Bank of Slovenia. If somebody takes a loan in your name, it shows up there. You can see your own record for free:

1. Open moj.sisbon.si and log in (through SI-PASS) with an electronic ID card or a qualified digital certificate.
2. Look at the contracts (posli) and at the inquiries (vpogledi) – who looked at your data, when and why. An inquiry from a lender you never contacted means that somebody probably applied for credit in your name.
3. Turn on the notifications by e-mail or SMS: for new contracts, changes and inquiries. The inquiry notice comes immediately, so you hear about a loan application in your name the same day, not months later.
4. Anything you don't recognise: call that bank or company the same day, and report it to the police.

There is also a free mobile app (Moj SISBON), which you activate through the web version. SISBON shows credit – loans, leasing, cards, overdrafts – not every kind of debt, so it is one check among several, not a guarantee.

Example 4: Somebody Made a Fake Profile of You

1. Collect evidence first: screenshots of the profile, its address (URL), and the messages it sent, with dates. Once it's reported, it may disappear.
2. Report it as impersonation, not just as spam. On Facebook and Instagram open the profile, then the three dots → Report → the option about pretending to be someone → Me; TikTok has a similar "pretending to be someone" option. If you don't have an account there, the platforms have help-centre forms for impersonation reports. Ask a few friends to report it too.
3. Warn your contacts on your real profile and through another channel.
4. If it asks people for money or spreads lies about you, report it to the police as well, with the screenshots.
5. Make your real profile harder to copy: fewer public photos, friend list hidden, profile visible only to friends.

A Few More Thoughts

What I took from that conversation: the strange e-mails are not the problem, they are the warning. Somebody who notices the registrations and the reset codes and reacts calmly – new password, second factor, a look at the filters, a message to friends – usually stops it before anything is taken. The damage happens to people who don't look, or who panic and click.

AI makes the scams cheaper and more convincing, and that will not go back. A message can look perfect, a voice can sound exactly like your child, a profile can have a face that never existed. So the defence moves from "spot the mistake" to "check through a second channel": call back on the number you know, ask the family code word, log in to the bank yourself instead of clicking. It is a small habit, and it works against the newest tricks as well as against the oldest ones. Talk about it at home – with the kids and with the grandparents, because the same trick can be written for either of them.