Identity fraud and phishing — how criminals abuse your data

Identity fraud: when someone else takes over your life

Identity fraud is one of the fastest-growing crimes in the Netherlands. Criminals use stolen personal data to make purchases, take out loans or even register entire businesses in your name. The Fraudehelpdesk receives thousands of reports annually from people whose identity has been misused, and the actual scale is presumably much larger.

The consequences for victims are severe. Unexpected collection letters, a negative credit registration, problems with the tax authorities or even police investigations linked to your name — clearing up the damage can take months to years. And it often starts with something seemingly innocent: a phishing email, a data breach or a carelessly shared copy of your identity document.

When you are a victim of identity fraud, a professional social media and digital investigation can help trace the source of the misuse and collect evidence for criminal charges or civil proceedings.

How criminals obtain your data

The methods fraudsters use to acquire personal data are becoming increasingly sophisticated. Veilig Internetten (Safe Internet), an initiative of the Ministry of Economic Affairs, warns about the following techniques:

• Phishing via fake emails and texts mimicking banks or government agencies
• Smishing and vishing via SMS or phone calls requesting PINs or payments
• Data breaches exposing personal data later traded on darknet marketplaces
• Social engineering using social media and public registers to impersonate you
• Fake domains resembling well-known brands with subtle spelling differences
• Skimming and shoulder surfing to copy payment details physically

The problem is that many victims only discover their data has been misused weeks or months later. By then, the fraudster has already caused significant damage.

What you can do as a victim

If you suspect your identity has been misused, swift action is essential to limit further damage:

• File a police report to demonstrate victim status to institutions
• Contact your bank to block or reverse unauthorised transactions
• Report to the Fraudehelpdesk to help identify patterns and warn others
• Check your BKR credit registration for loans taken out in your name
• Contact the Central Identity Fraud Reporting Centre for identity restoration
• Change all passwords immediately and activate two-factor authentication

These steps are necessary but do not always provide insight into who committed the fraud and how your data ended up in criminal hands. That is where professional investigation adds value.

How SAJ Recherche investigates identity fraud

At SAJ Recherche, we conduct investigations into identity fraud and phishing aimed at tracing the source of the misuse and collecting evidence admissible in legal proceedings.

• Digital trace analysis of phishing emails, fake websites and metadata
• Social media investigation to map who had access to your personal data
• Network analysis connecting different reports, accounts and transactions
• Reporting in a legally admissible report for charges or civil proceedings

All investigations are conducted under POB licence 8779 and in compliance with GDPR, ensuring results are legally admissible.

Practical example: identity fraud following data breach

A business owner from North Holland discovered that multiple business accounts had been opened in his name at various banks, with suspicious transactions pointing to money laundering. SAJ Recherche mapped all fraudulent registrations and transactions in his name. Through OSINT investigation and data breach analysis, we traced the source to a compromised external service provider whose stolen data, including his citizen service number and ID copy, had been traded on a darknet forum. With our report, the victim cancelled all fraudulent registrations, filed a successful police report and had the damage fully restored.

Prevent your identity from falling into the wrong hands

Identity fraud often begins with a small moment of carelessness. A click on the wrong link, a passport copy in an unsecured email or a reused password. The consequences, however, can be enormous.

Suspect your identity is being misused? Contact SAJ Recherche for a confidential consultation.