Front Page: NCSC-FI
Front Page: NCSC-FI
Go to Search

Advice for victims of identity theft or data breaches

Information security now!

Identity theft can take place following a data breach, for example. Keep reading for advice on how to proceed if you have been targeted by identity theft or your personal data has been made public as a result of a data breach.

The information used to perpetrate identity theft can be collected in a number of ways, including phone calls from scammers pretending to represent technical support.

What is identity theft

Identity theft entails using someone else’s identity. To this end, perpetrators of identity theft make use of another person's personal data, identification data or other information that can be used to identify an individual. Such information includes names and address details, personal identity codes, phone numbers and online banking credentials.

In practice, identity theft may mean assuming the identity of another person and using it to make a purchase at an online store, which is then billed to the victim of the identity theft.

Criminals use a number of methods to collect the personal data required to commit identity theft, including exploiting data leaks on the internet or perpetrating phishing scams. The kind of personal data used to commit identity theft has recently been obtained by criminals via scam phone calls in which they have claimed to represent technical support.


“A person who in order to deceive a third party unlawfully uses the personal information, access codes or other corresponding identifying information of another and in this manner causes economic loss or more than petty impediment to the person to whom the information belongs, shall be sentenced for identity theft to a fine.”

Criminal Code, chapter 38, section 9a

Victims of identity theft or data leaks can take steps to protect their information.

What can I do if I have been the victim of identity theft?


Make sure you carefully consider the following steps. A ban on address changes, for example, has consequences when submitting a notification of a change of address. Familiarise yourself with the available options, materials and services carefully before taking action.

If you have fallen victim to identity theft or your personal data has been disclosed as a result of a data leak, you can take the following steps to protect your information.

  1. Prevent financial damage. If a criminal has gained access to your online banking account or your credit card details, contact your bank immediately.
  2. Report the offence to the police. You can file a report online. (External link)
  3. Apply for a personal credit ban (“oma luottokielto”). In order to ensure that the ban is comprehensive, it should be applied for using both the Suomen Asiakastieto Oy (External link) and the Bisnode Finland Oy (External link) services. The credit ban is subject to a fee.
  4. Apply to the Finnish Patent and Registration Office for a registration ban (External link).  Also make sure that any existing information cannot be altered without first contacting you at a specific phone number or email address.
  5. Apply for a ban on address changes or address change protection via Posti’s customer service (External link)
  6. If criminals have gained access to the picture or details of your identification, notify the police of a lost document (External link) and apply for new identification.
  7. Consider protecting your address information. (External link)

If your personal and address data require particular protection, consider applying for a non-disclosure for personal safety reasons and address protection. Applications for a non-disclosure for personal safety reasons can be submitted to the Digital and Population Data Services Agency. (External link) The decision to apply should be based on careful consideration. The need for a non-disclosure for personal safety reasons must always be justified, and an application is required in all cases.

More information on identity theft is available from a range of sources.