Practical guide
Practical guide
Theft or loss of identity documents, identity theft, banking fraud: this guide sets out the procedures, step by step. A technical word you do not know? The glossary explains them.
It's all in a PowerPoint too, if you want to present this platform to your teams or your family.
Download the presentationNIR, FOVeS, KYC, watermark, banking ban: every hard term has a short definition.
Open the glossaryIdentity theft does not always start with a stolen wallet.
It can start when a copy of an identity document is sent, housing, employment, an online procedure, and reused in another context. Here is how to send a copy more safely.
Who can ask for your ID?
Many people and organizations ask for a copy of your ID. Not all requests are legitimate. Here are the most common cases:
Property rental
Agencies, landlords, shared housing platforms
Recruitment / employment
Employers, temp agencies, freelance platforms
Banks and insurance
Account opening, contract subscription
Telecom operators
Mobile subscription, internet box
Vehicle rental
Car rental agencies, car sharing
Health and insurance
Health insurance enrollment, healthcare organizations
Online purchases
Identity verification for major purchases
Educational institutions
Enrollment, scholarships, internships
Always ask yourself: does this person or organization really need my ID? Would a bank account number or proof of address be enough? When in doubt, ask why and on what legal basis.
The 6 golden rules for sharing an identity document safely
Always send a PDF, never a photo
A photo (JPG, PNG) of your ID can be easily reused, printed, or modified. A PDF file with a watermark (see step 2) is much harder to exploit.
How to convert a photo to PDF?
- On iPhone: open the photo → Share → Print → pinch to zoom on the preview → Share the PDF
- On Android: open the photo → Share → Print → Save as PDF
- On PC/Mac: open in software (Word, Paint, Preview) → File → Export as PDF
Add a watermark on every copy you send
It's the first reflex, free and immediate. For real proof in a dispute, the PMI seal adds a certificate that the watermark alone can't give.
A watermark is a semi-transparent text placed over the image of your document. It makes the copy unusable for any purpose other than the intended one.
What should the watermark contain?
On [Today's date]
For [Specific purpose]
Example: "Provided to Durand Real Estate Agency, On 04/11/2026, For apartment rental application 12 Lilas Street"
How to add a watermark?
- Acrobat Reader (free): Open the PDF → Tools → Edit PDF → Add text → Type the watermark → Adjust transparency and size → Place it diagonally on the document
- On smartphone: use a free app like iLovePDF (iOS/Android) → open the PDF → Watermark → custom text → save
- Preview (Mac): Open the PDF → Tools → Annotate → Text → type the watermark → adjust the color to light gray semi-transparent
Verify the recipient before sending
Before sending your ID to anyone, verify:
- Rental: does the agency really exist? Is the property real? Visit before sending your documents
- Employment: is the company registered? Check on societe.com or infogreffe.fr
- Online: is the site using HTTPS? Does it have legal notices? Verifiable reviews?
Warning signs: urgent request "send your documents within 24 hours", request via WhatsApp/Telegram, no official website, listing too good to be true (very low rent, very high salary).
Hide unnecessary information
Does the recipient need all the information on your document? Often, only your name and photo are needed.
- You can hide (blur or cover) the ID card number if only the name is required
- For a rental application: your ID card AND proof of address are enough. Refuse to provide more
- For an employer: they have no right to ask for your bank details or social security number before actual hiring
Keep a record of your submissions
Systematically note to whom, when, and why you sent a copy of your ID. A simple table or a note on your phone is enough:
| Date | Recipient | Reason | Document sent |
|---|---|---|---|
| 04/11/2026 | RecipientDurand Agency | ReasonRental application | Document sentID card (PDF + watermark) |
| 03/15/2026 | RecipientBank X | ReasonAccount opening | Document sentID card + proof of address |
This record will be invaluable if a problem occurs to identify where the leak came from.
What if a copy has already been sent without protection?
Here are the recommended steps:
- Ask the recipient to delete the unprotected copy and resend a watermarked version
- Monitor your FICOBA statement regularly (see the "Bank fraud" section below)
- Sign up for free on ProtectMyId to be alerted if your document is used fraudulently
- If you have serious concerns, file a formal statement at the police station
Businesses: educate your clients on secure document sharing
You collect identity documents as part of your business (real estate, banking, insurance, recruitment, healthcare)? You play a key role in protecting your clients.
Encourage watermarking
Include in your forms: "We recommend adding a watermark with our name and the date on any ID copy submitted." Your clients will trust you more.
Accept only PDF files
Refuse JPG/PNG photos of ID documents in your collection process. Require PDF format. It's more secure and easier to archive.
Delete copies after use
In compliance with GDPR, do not keep copies of ID documents beyond the time necessary for processing. Inform your clients of the retention period.
Verify with ProtectMyId
Integrate the ProtectMyId API into your onboarding processes to verify in real time whether a presented document has been reported stolen. It's the missing piece in your KYC.
Learn more about business plans →Here are the steps to follow after the loss or theft of your identity documents.
File a police report or declare the loss
Go to the police station or gendarmerie to file a report (in case of theft) or a loss declaration. You will receive a receipt essential for subsequent procedures.
You can save time by filing an online pre-complaint on the Ministry of the Interior website. An appointment will be scheduled for you to officially sign the complaint.
Get your documents replaced
| Document | Procedure | Cost | Timeline |
|---|---|---|---|
| National ID card | ProcedurePre-application on France Titres (ANTS) + equipped city hall | Cost€25 (fiscal stamp) | Timeline2 to 6 weeks |
| Passport | ProcedurePre-application on France Titres (ANTS) + city hall | Cost€86 + €25 = €111 | Timeline2 to 4 weeks |
| Driver's license | ProcedureOnline application on France Titres (ANTS) | Cost€25 | Timeline15-20 business days |
| Health card | ProcedureReport to CPAM via ameli.fr or call 3646 | CostFree | Timeline2 to 3 weeks |
For the health card, download a rights certificate from ameli.fr in the meantime.
Report the theft on ProtectMyId
Sign up for free on ProtectMyId and report your stolen document. After validation by our team, the document will be listed in our database, accessible by partner organizations (banks, insurers, government agencies).
Identity theft is a criminal offense under article 226-4-1 of the Penal Code: up to 1 year imprisonment and €15,000 fine.
If the fraudster is a spouse or partner: 2 years and €30,000.
File a complaint for identity theft
File a complaint at the police station or by registered letter with acknowledgment of receipt to the Public Prosecutor of the competent Judicial Court. Prepare all evidence: creditor letters, suspicious bank statements, formal demands received, etc.
Identify the extent of the fraud
Request your FICOBA statement (Bank Accounts Registry) on impots.gouv.fr > "Other services" > "Access the FICOBA file". This statement lists all bank accounts opened in your name, including those opened fraudulently.
Exercise your GDPR rights with the companies involved
Send access requests (Article 15 GDPR) to each company involved (banks, telecom operators, online retailers...). They have 1 month to respond. Request:
- Copies of contracts signed in your name
- Identity documents provided during sign-up
- Proof of identity verification performed
- Transaction/operation history
These documents are essential evidence for your criminal and civil case. If no response within 1 month, file a complaint with the CNIL.
Request deletion of fraudulent data (Article 17 GDPR)
Once the fraud is documented, request the erasure of all data related to fraudulently opened accounts/contracts. Since the processing of your data is unlawful (you never consented), erasure is a legal right.
Get support and, if needed, consult a lawyer
ProtectMyId supports you through your reporting and follow-up steps. If the dispute drags on (a bank's continued refusal, blacklisting that persists, unrepaired harm), a lawyer can take on your case and pursue the appropriate remedies. Keep all your evidence: it will be decisive.
A Banque de France listing, loans taken out without your knowledge, accounts opened without your agreement: here are the procedures to restore your situation.
The FCC (Central Check Registry) and FICP (Credit Incident Registry) are managed by the Banque de France. If a fraudster used your identity, you may be wrongly listed.
Removal procedure:
- Contact the Banque de France to check your status (online or at a branch)
- Identify the reporting institution
- Send a registered letter with acknowledgment of receipt to that institution with a copy of your police report, requesting removal
- The institution must notify the Banque de France, which proceeds with removal within 4 business days
- If refused, take the matter to the Judicial Court
Favorable case law (CA Versailles, May 27, 2025): once identity theft is proven, the institution has an obligation of complete erasure. It cannot impose any "special mention" not provided for by law.
Banks often use standard arguments to refuse. Here's how to respond:
"The transaction was validated in accordance with your usual habits"
Your response: Article L.133-18 of the Monetary and Financial Code requires immediate reimbursement of unauthorized transactions. The burden of proving your "gross negligence" lies with the bank, not you.
"You shared your codes"
Your response: Even in cases of sophisticated phishing or spoofing, recent French Supreme Court case law considers that this does not automatically constitute "gross negligence". The bank must prove your fault, not merely allege it.
"Strong authentication validated"
Your response: The mere fact that strong authentication was recorded does not prove that you performed it. The bank cannot rely solely on its technical logs.
Escalation in case of deadlock:
- Written complaint to customer service (registered mail)
- No satisfactory response within 2 months → Banking mediator (90 days max to respond)
- Report to the ACPR (regulatory pressure on the bank)
- As a last resort → Judicial Court (no lawyer needed up to €10,000)
The FICOBA (Bank Accounts and Similar Accounts Registry) lists all accounts opened in your name in France. It's the essential tool for discovering fraudulently opened accounts.
How to access it (since January 2025):
- Log in to impots.gouv.fr
- Go to "Other services"
- Click on "Access the FICOBA file"
- Choose "Request made for your own account"
The statement includes accounts opened and closed in the last 10 years.
For credit card fraud specifically, use the Perceval service from the Ministry of the Interior.
Important: Perceval does not replace filing a police report. It allows you to report the fraud and provides additional evidence to obtain reimbursement from your bank.
Right of access (Art. 15)
Obtain a copy of all data held in your name by any organization. Free of charge. Response within 1 month.
Right to erasure (Art. 17)
Demand the deletion of data collected through fraudulent contracts/accounts. Since the processing is unlawful, erasure is a legal right.
CNIL complaint
If an organization does not respond within 1 month, file an online complaint on cnil.fr. The right to erasure is one of the most frequent grounds for complaints to the CNIL.
Letter template
The CNIL provides official letter templates. Always include: a copy of your ID, your criminal complaint reference, and a precise description of your request.
Useful contacts and resources
Banque de France
banque-france.fr
FCC/FICP consultation, banking ban
CNIL
cnil.fr
Data protection, GDPR rights, complaints
Cybermalveillance
cybermalveillance.gouv.fr
Cyber-fraud diagnosis and support
Defender of Rights
defenseurdesdroits.fr
Mediation with government agencies
Service-Public.fr
service-public.gouv.fr
All official administrative procedures
Report a document on ProtectMyId
The service is free for individuals. Once the report is validated, partner organizations can consult it.
Frequently asked questions
What to do after theft, loss or identity fraud
The first steps, in order. Technical terms (FOVeS, FICOBA, FCC) are defined in the glossary.
What should I do immediately after my identity documents are stolen or lost?
File a complaint (theft) or a loss declaration at a police station or gendarmerie, and keep the receipt. An online pre-complaint on the Interior Ministry website can start the process before the appointment. Then: block payment cards, reapply for the documents via France Titres, and report the document on ProtectMyId.
How do I replace an ID card, passport, driving licence or Carte Vitale?
ID card, passport and driving licence: start on France Titres (ANTS), then a town hall equipped for ID card and passport. Carte Vitale: report via ameli.fr or 3646, and download a rights certificate in the meantime. Keep the loss or theft receipt: it is required for these applications.
What if someone is already using my identity?
File a complaint for identity theft (French Criminal Code, article 226-4-1). Then request your FICOBA statement on impots.gouv.fr to see accounts opened in your name, and exercise your GDPR access right with each organisation involved. ProtectMyId® supports you through these steps, with its own team.
What is FICOBA and how do I obtain it?
FICOBA lists bank accounts opened in your name in France, including those opened without you. Since 2025: impots.gouv.fr, “Other services”, “Access the FICOBA file”, request for your own account. The statement covers accounts opened and closed over ten years.
Which GDPR rights can I exercise against organisations that hold my ID?
Right of access (article 15): a copy of the data, reply within one month, free of charge. Right to erasure (article 17) if the processing is unlawful, for example a contract opened without you. If there is no reply within one month, a complaint can be filed on cnil.fr.
How do I get an unjustified FCC or FICP listing removed after identity theft?
Check your status with Banque de France, identify the reporting institution, then send it a registered letter with a copy of the complaint. It notifies Banque de France, which removes the listing within four working days. A refusal can be challenged before the judicial court.
How do I send a copy of my ID so it cannot be reused elsewhere?
Send a PDF, not a photo, and add a named watermark: recipient, date, purpose. For a loan, a long-term rental or a legal file, PMI Seal adds a signed certificate. That replaces neither a police report nor reporting the document on ProtectMyId if it is already compromised.
Frequently asked questions
All our frequently asked questions
Answers are grouped by topic, on the page each one belongs to.