Fake Profile in Your Name: Identity Theft and Your Rights

A profile with your name, your photo, maybe even people from your class as followers. The problem: you never created it. A fake profile like this sends messages, posts embarrassing content or asks your contacts for money. It can feel as if someone has stolen your face. But you are not powerless against online identity theft. This article shows how to report a fake profile, what you can do right away and which rights you have in general under German law.

Fake profile or hijacked account?

Two situations look similar but are handled differently:

• Fake profile: someone creates a new account and pretends to be you. Your own account is untouched.
• Hijacked account: someone has gained access to your real account, for example with a guessed or phished password, and is now using it.

With a hijacked account, speed matters. Use the platform's recovery function, change your password, including the one for your email account, and switch on two-factor authentication. Check whether you use the same password anywhere else and change it there too.

Step 1: Secure evidence

Before you report, secure the profile. Once it is deleted, the proof is gone too.

• Note the profile URL and username, not just the display name. Anyone can change that at any time.
• Take screenshots of the profile, posts, stories and comments, each with date and time.
• Messages to others: ask the people the profile contacted to send you screenshots showing the profile name and date.
• Keep a log: when did you find the profile, who told you about it, what has happened since?

How to do this on Instagram, TikTok and other platforms is explained in Securing Evidence of Online Hate.

Step 2: Warn your contacts

Post a short notice from your real account: there is a fake profile in your name; please do not reply, do not send money, do not send anything private. Give the username so others can recognise the profile. This stops your contacts from falling for it, and you are more likely to hear about further messages.

Step 3: Report the fake profile to the platform

The major platforms have a separate category in their reporting menu for accounts pretending to be someone else. Choose this category, not just “harassment” or “spam”. Expect that the platform may ask you to prove that you really are who you say you are. Only use the official reporting channels in the app or on the platform's website. Genuine forms never ask for your password.

The EU Digital Services Act (DSA) requires platforms to accept reports of illegal content, handle them diligently and tell you their decision. If the platform says no, you can file an internal complaint. What to do if nothing happens at all is explained in The Platform Is Not Responding: Complaints Under the DSA.

The General Data Protection Regulation (GDPR) offers an additional route. Under Article 17 GDPR, you can request that personal data about you be erased, for example where it is being processed unlawfully. Your name and your photo are personal data.

Your rights: your name and image belong to you

There is no separate offence called “identity theft” in the German Criminal Code (Strafgesetzbuch, StGB). Even so, the law protects you on several levels.

Right to your name (§ 12 BGB)

Under § 12 of the German Civil Code (Bürgerliches Gesetzbuch, BGB), anyone who uses your name without authorisation and thereby harms your interests must remove this interference. If further interference is likely, you can sue for an injunction (Unterlassung). A profile acting under your name is a typical situation in which this claim may apply.

Right to your own image (§ 22 KUG)

Under § 22 of the Art Copyright Act (Kunsturhebergesetz, KUG), photos in which you can be recognised may in principle only be distributed or shown publicly with your consent. The fact that a photo was publicly visible on your own profile does not mean others may use it for a profile in your name. The law has exceptions (§ 23 KUG), for example for images of contemporary history. Anyone who distributes an image in breach of these rules may commit an offence under § 33 KUG, punishable by up to one year in prison or a fine. It is only prosecuted if a request for prosecution is filed.

General right of personality

Behind both stands the general right of personality (allgemeines Persönlichkeitsrecht) derived from the German constitution (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law, Grundgesetz). It can give rise to civil-law claims for an injunction and removal, and in serious cases for monetary compensation (Geldentschädigung). Which claims exist in a specific case can only be assessed by a law firm.

When a fake profile can be a criminal offence

A fake profile is not automatically a crime. It depends on what is done with it. Possible offences include:

• Stalking (Nachstellung, § 238 StGB). The law explicitly lists: spreading content that makes you look contemptible while pretending it comes from you; distributing images of you; using your data to place orders or to get others to contact you. This is punishable if it happens repeatedly and is capable of significantly affecting your life. Up to three years, in particularly serious cases up to five years.
• Insult, defamation and malicious defamation (§§ 185 to 187 StGB) if the profile is used to spread degrading content or untrue claims about you.
• Data espionage (Ausspähen von Daten, § 202a StGB) if someone gained access to your real account by overcoming a security measure such as a password. Up to three years.
• Fraud (Betrug, § 263 StGB) if the profile is used to ask your contacts for money. They are then victims themselves and can report it too.

Watch the deadlines. Offences under § 33 KUG and the insult offences are generally only prosecuted on a request for prosecution (Strafantrag), and so is § 202a StGB unless the public prosecutor sees a special public interest. You have three months to file the request. Stalking, by contrast, is prosecuted ex officio, meaning the authorities act on their own once they know about it. More on this in Criminal Complaints and Deadlines Explained.

If you are under 18

Bring in an adult you trust. For minors, a request for prosecution is filed by the parents or other legal guardians anyway (§ 77(3) StGB). Talking helps even if you do not yet know what you want to do: Nummer gegen Kummer, a free and anonymous helpline for children and young people, is available on 116 111 (Monday to Saturday, 2 pm to 8 pm, in German). On juuuport.de, young people advise other young people online.

If the profile is used to spread sexualised images with your face, including fake ones: do not take screenshots of them and do not forward anything. Note the link and describe what can be seen. Sexualised images of minors must not be saved or sent (§§ 184b, 184c StGB), not even as evidence. Contact the police, in an emergency on 110. More in Deepfakes and AI Nude Images.

Frequently asked questions

Is a fake profile a criminal offence?

Not automatically. It can become one if it is used, for example, to spread lies, show images without consent or get money from your contacts, or if it is part of stalking. Regardless of that, you can take civil action against the use of your name and your images.

How do I get a fake profile removed?

Report it in the app under the category for accounts pretending to be someone else, and have proof of identity ready. If the platform does not respond, use the internal complaint system under the DSA. You can also request erasure of your data under Article 17 GDPR.

Can someone use my profile picture for another account?

In principle, no. Under § 22 KUG, images in which you can be recognised may only be distributed with your consent. The fact that the image was publicly visible on your profile is not such consent.

Can I find out who is behind the fake profile?

Usually not on your own. In criminal proceedings, the public prosecutor can request data from the platform; under civil law there is, under certain conditions, a right to information that a court decides on. Both require you to act early and to have secured evidence.

Found a fake profile? What you can do now

Secure, report, block – in that order. Warn your contacts and keep the three-month deadline for a possible request for prosecution in mind. If you do not want to deal with this alone, you can report it through our form. If you say yes, your report goes automatically to a suitable cooperating law firm (Kooperationskanzlei) as soon as one is available. If there is no suitable firm right now, you get an email with other places to turn to straight away. Deadlines keep running: you can always file a request for prosecution (Strafantrag) with the police yourself. The legal assessment comes from the law firm, not from us.