This is probably one of the most worrying questions after a data breach:

"What if someone is now using my identity to open a bank account or apply for a loan?"

The fear is understandable.

Name.

Address.

Date of birth.

Phone number.

Email address.

IBAN.

Tax information.

Sometimes, even a copy of an identity document.

When several pieces of this information are circulating, a fraudster may try to impersonate you.

But there are two mistakes to avoid.

The first is panicking and assuming that a data breach automatically means someone has already opened an account in your name.

The second is failing to investigate when genuine warning signs appear.

In France, several official databases can help you check part of the situation.

They are called FICOBA, FICP and FCC.

But be careful: they do not serve the same purpose.

First: A Data Breach Does Not Automatically Mean Identity Theft

This is an essential distinction.

The DGFiP made this clear following the unauthorised access to the FICOBA database in 2026: accessing bank details or civil identity records does not automatically mean someone's identity has been stolen.

In the absence of suspicious transactions, the administration indicated that there was no need to undertake additional procedures purely as a precaution.

The same principle applies after a larger data breach.

Your information may have been stolen without ever being used.

However, if you notice:

• A letter from a bank you do not recognise.
• A repayment demand for a loan you never took out.
• An unknown direct debit.
• A new bank card you never requested.
• An unexplained loan rejection.
• A notification that an account has been opened.
• An entry in a banking incident register that you know nothing about.

Then you need to investigate.

And this is where the official databases become useful.

1. FICOBA: Check Bank Accounts Opened in Your Name

Let's start with the most important one.

FICOBA stands for:

Fichier national des comptes bancaires et assimilés — the French national register of bank and similar accounts.

It lists accounts opened in France, including bank accounts, postal accounts, savings accounts and other equivalent accounts.

The CNIL, France's data protection authority, explains that FICOBA contains information such as:

• The institution managing the account.
• The account number and type.
• The dates on which the account was opened, modified or closed.
• The account holder's surname, first name, date and place of birth, and address.

However, FICOBA does not contain account balances or transaction histories.

That matters.

FICOBA can tell you:

"An account exists at this bank in your name."

But not:

"It contains €5,000 and this particular transaction was made."

How Can You Access FICOBA Today?

Since January 6, 2025, individuals have no longer needed to request this information from the CNIL.

You can access it through:

impots.gouv.fr → Your personal account (Votre espace particulier) → Other services (Autres services)

The CNIL has officially confirmed this change in procedure.

So if you genuinely suspect that an account has been opened in your name:

1. Go directly to impots.gouv.fr.
2. Log into your personal account.
3. Open the Autres services section.
4. Access the service relating to bank accounts / FICOBA.
5. Review the list.

What Should You Look For?

You should recognise the institutions and accounts listed.

If you see a bank you have never dealt with, do not immediately assume it is fraud.

Investigate first.

An old account you forgot about may appear.

A closed account may also be listed along with its closure date.

But a recently opened account at a completely unfamiliar bank deserves immediate investigation.

What If I Find an Account I Do Not Recognise?

The CNIL explains that if you identify an error in FICOBA, you should contact the banking institution managing the account.

If you suspect identity theft:

1. Contact the bank concerned.

Do not use a phone number from a suspicious email.

Find the institution's official contact details yourself.

2. Explain that you dispute the account opening.

Ask about the procedure for reporting suspected identity theft.

3. Keep every document.

Letters, emails, account references, screenshots and dates.

4. File a police complaint.

Service-Public explains that someone who discovers their personal information is being used without their knowledge can file a complaint and notify the organisations involved.

5. Inform your own banks.

They should be aware that your identity may be used fraudulently.

2. FICP: Check for Credit Repayment Incidents in Your Name

The second important database is FICP:

Fichier national des incidents de remboursement des crédits aux particuliers — the national register of personal credit repayment incidents.

Be careful about a common misunderstanding.

FICP Is NOT a Database of All Your Loans

This is important.

You cannot simply ask:

"Show me every loan currently taken out in my name."

FICP mainly records credit repayment incidents and certain information relating to overindebtedness proceedings.

The Banque de France confirms that this includes incidents involving consumer credit, mortgages and overdrafts.

Therefore:

No FICP entry does not mean that no fraudulent loan exists.

A fraudster may have taken out a loan very recently, before any missed payment has been reported.

However, if a fraudulent loan is not repaid and the lender reports the incident, you may discover its existence through FICP.

This is an important limitation that many articles fail to mention.

What Can FICP Tell You?

When you exercise your right of access and a record exists, the information may include:

• The number of incidents.
• The institution or institutions that reported them.
• References for the contracts involved.
• The registration date.
• The expected removal date.
• The type of credit.

Imagine you have never applied for a loan from a particular institution, but its name appears in your FICP record.

That is when you need to act.

3. FCC: Check Certain Incidents Involving Cheques or Bank Cards

The third database is FCC:

Fichier central des chèques — the French central cheque register.

It records certain incidents involving:

• Unpaid cheques.
• Restrictions on issuing cheques.
• Certain withdrawals of bank card privileges.

As with FICP, this database does not contain your entire banking history.

It is used to identify specific incidents.

An unfamiliar FCC entry may therefore be another indication that an account or payment method has been used under your identity.

The Banque de France explains that a person listed in FCC can obtain information about the account concerned, the reason for the entry, the relevant dates and the institution that reported the incident.

How Can You Access FICP and FCC?

The Banque de France allows individuals to exercise their right of access.

You can do this:

• Through your personal Banque de France online account.
• In person at a Banque de France branch.
• By post.

The Banque de France also explains that personal information about whether someone is listed in these databases is not disclosed by phone.

You can call for assistance or to make an appointment, including through the French number 34 14.

But you cannot simply call and expect to be told whether you are registered.

The Three Databases to Remember

Here is the simple version.

FICOBA

Answers:

"Which bank accounts are registered in my name in France?"

Very useful for detecting an unknown account.

FICP

Answers something closer to:

"Is there a credit repayment incident or an overindebtedness record associated with my identity?"

It does not list every existing loan.

FCC

Answers questions such as:

"Are there any incidents involving cheques or certain bank card restrictions under my identity?"

The three databases complement each other.

None of them is a universal fraud detection system.

There Is No Magic Button to "See Every Loan Opened in My Name"

This is probably the most important point in the article.

Unlike FICOBA for bank accounts, there is no central public database that allows an individual to instantly see a complete list of every outstanding loan taken out in their name, whether payments are up to date or not.

FICP is an incident register.

It is not a general credit register.

This means that after a data breach, the absence of suspicious FICP records is reassuring, but it is not an absolute guarantee.

You also need to pay attention to what is happening around you.

The Warning Signs That Really Matter

A Letter From an Organisation You Do Not Recognise

A bank.

A credit provider.

A telecom operator.

A debt collection agency.

Do not automatically throw the letter away because you assume it was sent by mistake.

Check it.

An Unknown Repayment Demand

You receive a message saying:

"Your loan instalment is overdue."

But you never took out that loan.

This is a serious warning sign.

Service-Public specifically identifies loans taken out in a victim's name as a possible consequence of identity theft.

An Unexplained Banking Refusal

You apply for a loan or a payment method.

Your bank refuses and mentions a Banque de France registration you knew nothing about.

Check FCC and FICP immediately.

Unknown Direct Debits

Review your accounts regularly.

An unusual direct debit does not necessarily mean someone has completely stolen your identity, but it needs to be identified quickly.

Account Opening Emails

You receive:

"Welcome to..."

Even though you never opened an account.

Do not click the button in the email.

Go directly to the institution's official website and contact it.

Beware of Fake "Anti-Identity-Theft" Services

Here is the paradox.

You are worried your identity has been stolen.

So you search for:

"How can I check my identity after the DGFiP data breach?"

A fake service may then offer:

"We can check every account opened in your name. Send us your ID card and your tax assessment notice."

You have now handed even more documents to a potential fraudster.

For FICOBA, FICP and FCC, use official services:

• impots.gouv.fr
• banque-france.fr
• service-public.fr

Do not pay an unknown website to perform these checks on your behalf.

What Should You Do If Identity Theft Is Confirmed?

If you actually discover an account, a loan or a banking incident fraudulently created under your identity, the situation changes.

It is no longer just a suspicion.

The Banque de France recommends that victims:

1. File a police complaint promptly.
2. Inform their banks.
3. Check accounts opened under their identity through FICOBA.
4. Check for possible FCC and FICP registrations.

Service-Public also recommends notifying the financial institutions or other organisations involved and including useful evidence with the complaint.

Step 1 — Keep Everything

Before asking anyone to delete or remove anything:

• Take screenshots.
• Keep letters.
• Keep emails.
• Record reference numbers.
• Record dates.
• Keep the contact details of the institutions involved.

This information may help you dispute the transactions and demonstrate identity theft.

Step 2 — File a Police Complaint

When an offence has actually been identified, you can file a complaint.

Service-Public explains that you should include the evidence available, such as screenshots, messages, documents or repayment demands.

A data breach alone does not necessarily require every affected person to file an individual complaint.

But discovering an account or loan actually created under your identity is a different situation.

Step 3 — Contact the Institution Where the Account or Loan Was Opened

Explain clearly:

"I am a victim of identity theft. I dispute having opened this account / taken out this loan."

Ask for:

• The situation to be frozen.
• The dispute procedure.
• The documents required.
• Any incorrect registrations or reports to be corrected.

Send a copy of the police complaint if the organisation requests it.

Step 4 — Inform Your Usual Banks

Even if they are not directly involved.

A compromised identity may be used in several attempts.

Your bank may increase its vigilance and advise you on measures appropriate to your situation.

Step 5 — Check All Three Databases

After confirmed identity theft:

FICOBA → Unknown accounts.

FICP → Unknown credit incidents.

FCC → Unknown incidents involving cheques or cards.

The Banque de France explicitly recommends these checks for victims of identity theft.

Step 6 — Do Not Pay a Debt Just Because a Letter Uses Your Name

This is essential.

If a credit provider demands repayment of a debt arising from a contract you never signed:

Do not automatically acknowledge the debt.

Dispute it.

Explain the identity theft.

Provide supporting documents and the police complaint.

An official demand bearing your real name does not necessarily prove that you actually signed the contract.

After the DGFiP Breach and Other Major Leaks, Should You Check FICOBA Every Month?

No.

Your response should remain proportionate.

Following the unauthorised access to FICOBA in February 2026, the DGFiP explicitly stated that, in the absence of suspicious transactions, an additional access request was not necessary solely because information had been consulted.

The same logic applies here.

You do not need to spend your life checking three databases.

However, you should check them if:

• You receive a suspicious letter.
• You discover an unusual banking transaction.
• You become a victim of confirmed identity theft.
• You have sent an identity document to a fraudulent organisation.
• Your bank tells you about an unknown registration.
• An organisation demands repayment of an unfamiliar debt.

The objective is vigilance, not permanent anxiety.

A Practical Action Plan to Keep

If My Data Has Simply Been Leaked

• I secure my email account.
• I use unique passwords.
• I enable multi-factor authentication.
• I monitor my bank accounts.
• I am cautious about callers who know my real personal information.
• I keep official notifications relating to the breach.

If I Notice Something Unusual

• I check FICOBA.
• I check FCC and FICP if the circumstances justify it.
• I contact the institution concerned directly.
• I keep the evidence.

If Identity Theft Is Confirmed

• I file a police complaint.
• I inform my banks.
• I dispute fraudulent accounts or contracts.
• I check FICOBA.
• I check FCC and FICP.
• I keep a complete record of everything I have done.

What Major Data Breaches Should Teach Us

The problem is no longer simply:

"Has my password been stolen?"

An identity consists of many pieces of information.

Name.

Address.

Date of birth.

Email.

Phone number.

IBAN.

Documents.

Professional information.

Tax information.

A fraudster may collect different pieces from several unrelated incidents.

That is what makes large data breaches dangerous over time.

But there is some good news too.

France has several mechanisms that can help detect certain fraudulent uses of an identity.

You simply need to know where to look.

Conclusion

If you are worried about identity theft, remember three names:

FICOBA. FICP. FCC.

But above all, remember what they actually mean.

FICOBA may reveal a bank account opened in your name.

FICP may reveal a repayment incident involving a loan registered under your identity, but it is not a list of all your loans.

FCC may reveal certain incidents involving cheques or cards.

These databases are useful.

But none of them is a magic tool for detecting every possible type of fraud.

The best approach remains a combination of:

Watching for unusual warning signs.

Using official services.

Acting quickly.

Preserving evidence.

And never waiting several months to respond when an organisation contacts you about something you never authorised.

After a data breach, the real question is not:

"Should I be afraid that someone might use my identity?"

It is:

"Will I recognise the first warning signs and know how to quickly check whether something has been done in my name?"

Now, the answer can be yes.