Situation
Identity theft: document the uses and notify the organisations concerned
Start by listing what is being used in your name: an account, a document, a purchase, a loan, a phone line or a profile. Keep the messages and supporting documents, then report each use to the organisation concerned before taking the appropriate formal steps.
Practical page · ~5 min read · we will never ask for your codes or your passwords.
Do this right away
Three steps before anything else: change the password of the accounts involved from a clean device; if your bank details may have been captured, call your bank to block your card and keep an eye on your accounts; and don’t delete anything: messages, emails, screenshots and the addresses of the fake sites serve as evidence.
Recognising the situation
Identity theft almost always starts with your data being captured, then reused in your name. Here are the signs that should alert you.
A fake message from a public body
Health Insurance (Ameli), the tax office, the Personal Training Account (CPF), URSSAF: a convincing text or email, a pretext about a refund, an update or settling your account, and a link to a fake site designed to capture your data.
Access you don’t recognise
Unknown sign-ins, devices or sessions, a recovery address or number added without your knowledge, a discreet forwarding rule on your email: all doors that a third party may have opened onto your accounts.
Your data reused in your name
Login details entered on a fake site, bank details handed over, then uses you don’t recognise: messages sent, orders, posts, or an account opened in your name.
Act fast, but in the right order
The right order avoids two common mistakes: leaving an access active, or deleting an item useful to the file too soon. We always separate what is observed from what is assumed.
Stabilise, then check
Sign in from a device you know is clean, avoiding public networks. Note the symptoms and keep the useful screenshots. Then go through what you don’t recognise: recent sign-ins, locations, devices and browsers, as well as transactions, orders or messages made in your name.
Regain, then clean up
Change the password of the accounts involved, restore the recovery details (secondary address, phone number) and turn on two-factor authentication. A password is not always enough: sign out of unknown sessions, delete suspicious forwarding rules and filters, and remove third-party apps and delegations you don’t recognise.
Your email first
Your mailbox is often used to reset all your other accounts and to receive alerts. If it may have been affected, deal with it first: it is the key that protects your bank, cloud, social media and customer accounts.
Bank, report, police report
Depending on what was affected, a few official steps limit the consequences and build your file.
Your bank
If card or bank details may have been passed on, block your card without delay and keep an eye on your accounts. Dispute any transaction you did not authorise with your bank: this is a separate step from reporting.
Report the message or the site
Forward a fraudulent text to 33700. Report a fraudulent website through PHAROS (internet-signalement.gouv.fr). To be pointed to the right procedure, cybermalveillance.gouv.fr assesses your situation.
Notify the organisation being impersonated
Never use the link you received: open the official site yourself by typing the address (ameli.fr, impots.gouv.fr, moncompteformation.gouv.fr) and use their channels to report the fraudulent use of their name.
File a police report
If you have suffered a loss (an account opened in your name, an application made without your consent, extortion) file a police report at a police station or gendarmerie. Your timestamped file (screenshots, emails, addresses of the fake sites) makes this easier.
Never do this
Some reflexes make the situation worse or play into the scammer’s hands. Keep them in mind.
- Don’t click on the link in the message: open the official site yourself by typing the address by hand. The genuine procedures are there.
- No public authority asks for your full bank details or your login details by text or through a link.
- Cold calling about the CPF is banned: any call or text offering to “use your CPF entitlement” is fraudulent.
- Don’t do anything in a hurry: haste is exactly what the scammer is after. Take the time to check.
- Don’t use a paid recovery “service” that asks for money or your codes: use the official procedures, which are free.
Get help
The free pre-diagnosis assesses your situation, identifies the useful evidence and tells you whether you need an intervention, a report or simply some support. Galyct Perso informs and supports you, but does not replace your bank, the police or a lawyer, and guarantees no result: no identification of the culprit, no guaranteed cancellation of fraudulent applications. We will never ask for your codes, and your data stays in France.
Official sources: Cybermalveillance.gouv.fr · PHAROS.
Guides and situations to go further
Depending on what was affected, these pages complete the work of regaining control and securing your accounts.
Hacked email account
Your email is the key to all your accounts: regain access to it, remove hidden forwarding rules and unknown sessions.
Open the guide →Hacked social media account
Regain access through the official channels, secure your other accounts and warn the people close to you.
Open the guide →Preserving evidence
Before cleaning up or deleting: what to capture and keep so you don’t weaken your case.
Open the guide →Filing a police report & reporting
Police report, Cybermalveillance.gouv.fr, PHAROS: what each official service is for and in what order to use them.
Open the guide →