Is there a loan on your BKR credit report that you never took out? Then immediately dispute with the lender that you entered into the agreement and ask for an investigation into the application, the identification and the payout. In addition, request correction of inaccurate personal data. A police report or a report to the CMI helps to put the facts on record, but does not automatically remove the registration.
Nederlands: Lees dit artikel in het Nederlands: BKR-registratie door identiteitsfraude: onbekend krediet betwisten
Türkçe: Bu makaleyi Türkçe okuyun: Kimlik dolandırıcılığı nedeniyle BKR kaydı: tanımadığınız bir krediye itiraz
Written by Onur Arslan, attorney at Arslan Advocaten. Registered in the specialisation register of the Netherlands Bar for employment law and personal injury. Last updated: 17 September 2026.
Distinguish between an administrative error, an unfamiliar trade name and actual misuse of your identity. A registration you do not immediately recognise does not in itself prove that fraud has been committed. It is, however, a reason to seek clarity quickly and to limit further consequences.
How can an unknown loan end up in your name?
Someone may use stolen personal data to try to apply for a loan, phone financing or another financial product. Bank or contact details may also be used without permission. Which checks the provider carried out, and whether an agreement with you was actually concluded, must be investigated on the basis of the file.
There are also less serious explanations. A lender may use a different trade name, or an old loan may have been transferred to another party. Sometimes an agreement was taken out jointly, or the entry relates to a purchase on instalments that you described differently.
So start by identifying the contract: number, date, amount, product and original provider. Request written information through a verified channel. Do not pay an unknown caller simply to make an alleged BKR entry disappear quickly.
First steps if you suspect identity fraud
- Keep an up-to-date BKR report and note the date on which you discovered the unknown entry.
- Contact the registering lender through an official channel.
- Specifically dispute that you applied for the loan or concluded the agreement.
- Ask for an investigation, the relevant file data and measures against further incorrect processing.
- Secure the accounts involved and report the loss or misuse of documents where necessary.
- If there are concrete indications, file a police report and consider reporting to the CMI.
Ask the lender to confirm that your report has been received. Ask which department is conducting the investigation and how you can send additional information. A phone call is useful for quick action, but afterwards set out the essentials in writing so that it is clear what you have disputed.
Dispute the debt and the registration separately
A request for removal from BKR does not always make it sufficiently clear that you also deny the underlying agreement. Address both elements. For example, you state that you did not apply for credit, did not consent to the agreement and dispute the data based on it.
A lender that demands payment from you must be able to substantiate its claim adequately. Which party has to prove which facts depends on the claim and on the dispute. A specific response to the documents provided is therefore more important than simply repeating that you know nothing about it.
A correction at BKR does not automatically end every debt collection claim. Conversely, once an error has been acknowledged, you should check whether the registration, the internal records and any debt collection agencies involved have also been updated. Ask for confirmation of all agreed corrective actions.
What information should you request from the provider?
Request the application, the agreement, the signing data and the relevant identification information. Also ask for an explanation of the contact details used and of the account into which the credit was paid. In the case of purchase financing, the order, the delivery address and the communications may be relevant.
Digital agreements can be concluded without a handwritten signature. The absence of a paper signature therefore does not automatically prove that no agreement exists. Examine which electronic actions were recorded and why the provider attributes them to you.
Likewise, a copy of an identity document bearing your name does not in itself prove that you made the application. In identity fraud cases in particular, genuine personal data can be used without permission. Ask how the provider checked who was acting and what inconsistencies appear from the file.
Compare the evidence
| Information in the application file | Possible verification question |
|---|---|
| Phone number or email address | Was it yours and did you have access to it at that time |
| Address and delivery details | Did you live there, or was the product delivered elsewhere |
| Signature or confirmation | Which action was recorded and who could have performed it |
| Payout account | Whose account was it and did you receive the money |
| Identity document | Was a copy misused or were details changed |
| Time of application | Does this match your own records and the available evidence |
No single indication decides every case. An unknown IP address, for example, may call for further explanation, while a shared network does not automatically prove who made the application. Avoid technical conclusions that the available material does not support.
In an overview, mark what you recognise, what you dispute and what is still unclear. Add evidence where it is available. This allows the provider to respond in a targeted way and shows whether the rejection of your fraud report actually addresses the relevant counterarguments.
Police report and the Central Identity Fraud Reporting Point
If there are indications that someone has misused your identity, filing a police report is important. Describe the known facts, the agreement involved and the consequences. State which information is still being requested. You do not have to identify an unknown perpetrator yourself in order to report misuse.
The Central Identity Fraud Reporting Point (Centraal Meldpunt Identiteitsfraude) of the National Office for Identity Data (RvIG) offers advice and support. Where necessary, the CMI can work with the organisations involved on putting things right. That is a different task from a court ruling on the debt or an order addressed to BKR.
Keep the acknowledgements of receipt and the reference numbers of your reports. Send relevant confirmations to the lender, but also continue to respond substantively to its questions. A police report is an important document in the file; it does not in itself prove that every agreement you dispute is invalid.
Prevent further consequences during the investigation
Ask the provider which measures are possible while the accuracy is being investigated. Think of flagging the dispute, pausing debt collection where appropriate and assessing a request for restriction of processing. The GDPR sets conditions for restriction; it must be invoked and assessed specifically.
A request for restriction does not automatically mean that a lender will delete the data immediately or that no other party can see the entry anymore. Ask which measure has actually been taken, what it means in practice and when you will receive a new position.
If an urgent mortgage or housing obstacle arises, the interest at stake must be made concrete. Include a rejection and any relevant deadline. If necessary, have urgent proceedings assessed. Do not rely solely on a lengthy criminal investigation when there are immediate civil consequences.
What if a debt collection agency keeps writing?
Send the debt collection agency a short written dispute referring to your report to the lender. Ask which agreement the claim is based on and who the creditor is. Keep all letters, statements of costs and replies in the same file.
A collection letter is not the same as a court ruling. If you receive a summons or another formal procedural document, you must respond to it in accordance with the applicable procedure. An earlier fraud report to the bank does not mean that a lawsuit stops of its own accord.
Do not make an unclear payment arrangement solely to relieve the pressure. Such an arrangement may later lead to disputes about what you have acknowledged. If payment or a temporary arrangement is being considered for practical reasons, have the wording and consequences assessed and, where necessary, record your dispute explicitly.
Identity fraud by an acquaintance or former partner
Personal data or accounts can also be used without permission within a relationship. The assessment starts with the actual authority and the actions taken. Was there a power of attorney, a joint loan or merely access to a device? Those situations must be distinguished.
A conflict with a former partner does not automatically mean that every loan in your name is fraudulent. If you signed as a debtor yourself, an internal arrangement about payment may give rise to a different legal problem. On that subject, read BKR and a former partner.
If you acted under pressure or had little control over your finances, set this out carefully. Possible contractual defences and personal circumstances may be relevant. Share sensitive information selectively and have it determined which documents are actually needed for the claim in question.
What if the money was paid into your own account?
A payout into your account is an important fact, but it does not always answer the question of who applied for the loan or who subsequently had control of the money. Investigate access, account use and subsequent transactions. Give the provider a complete and verifiable explanation.
If you used the money yourself after you knew where it came from, that may change the legal assessment. The file must not leave out such facts. Even if you dispute the original application, separate questions may arise about money received and any repayment.
Do not transfer money to another account on the instructions of an unknown person to supposedly correct the error. Contact the genuine provider through an official channel and ask for written instructions. Otherwise, a second transfer may cause new losses.
The GDPR and inaccurate credit data
Personal data must be accurate and, where necessary, kept up to date. If a loan has wrongly been linked to you, correction or erasure may be appropriate. In addition, restriction of processing may be relevant during an investigation, subject to the applicable conditions.
An objection to a correct historical registration on the grounds of personal circumstances is a different route. In identity fraud cases, it is often first the accuracy of the link and of the agreement that is in dispute. Do not let the bank replace that question with a mere assessment of whether you are now financially stable.
The Supreme Court of the Netherlands has clarified the legal basis for CKI processing. A general reference to a registration obligation does not answer every specific request under the GDPR. Ask for a substantive response to the alleged error and the available evidence.
A fictitious example of a targeted investigation
A consumer discovers an unknown phone financing agreement. The contract states her correct name and date of birth, but an unknown email address and a delivery address where she never lived. She requests the full application and identification file and disputes that she made the purchase.
At first, the provider refers only to a copy of an identity document. The consumer then explains that a copy was lost earlier and adds relevant reports and address details. The question now is what additional checks the provider carried out and how the other discrepancies are explained.
This example does not prove that every discrepancy leads to removal. It shows how a concrete comparison moves the discussion further than a general denial. If the file ultimately confirms that someone else made the application, the linked registration and debt collection must also be corrected.
How to structure your first letter
Start with the date on which you discovered the registration and the contract number. Then state which agreement and payment obligation you dispute. Mention the specific details that are not yours or do not match your situation, without filling in facts you do not know.
Next, ask for an investigation and for the relevant personal data and file documents. State separately what you want regarding the registration: correction of an incorrect link, assessment of restriction during the investigation and written confirmation of the correction. Also ask which debt collection parties will be informed.
Close with a list of enclosures and a request for a substantive response. If you are making a GDPR request, say so clearly. Keep the proof of sending and of receipt. A first letter can be supplemented later; the key point is that your dispute and requests are clear from the outset.
Time limits and assessing a rejection
Under the GDPR, the response period is in principle one month, which may, under certain conditions, be extended by a maximum of two months with reasons given. An internal fraud investigation does not automatically release the provider from every obligation to communicate. Ask what is still being investigated and when you will receive a reply.
For the special application procedure under Article 35 of the Dutch GDPR Implementation Act (UAVG), the time limit is in principle six weeks after receipt of the reply. Other routes, such as a defence against the debt, Kifid (the Dutch Financial Services Complaints Tribunal) or interim relief proceedings, have their own conditions. Have the time limits monitored separately and do not assume that a police report automatically suspends them.
A rejection must be read with an eye to its reasoning. According to the provider, which data connect you to the agreement? Has it addressed your counter-evidence? Was only the registration assessed, or the agreement as well? A follow-up letter or proceedings should address those specific gaps.
Damage and correction after an acknowledged error
If the error is acknowledged, ask for written confirmation that the incorrect claim and data will be corrected. Then check a new BKR report and ask about any notifications to recipients of the incorrect data. A verbal promise is not enough to know whether the correction has been carried out.
Keep records of demonstrable additional costs and rejections caused by the error. A damages claim requires a separate assessment of the legal basis, the damage and the causal link. Not every inconvenience automatically leads to a fixed amount of compensation.
Check any settlement offered for a full and final discharge. If the registration is corrected but the damage has not yet been investigated, it must be clear whether you retain that claim. A quick practical solution must not unintentionally settle more than you realise.
If the debt is being collected in the meantime
Also send a substantive dispute to any debt collection party involved and state that you dispute the formation of the loan because of possible identity misuse. Ask which agreement and identification data the claim is based on. Keep all reminders and respond separately to procedural documents; a complaint to the lender does not automatically halt court proceedings.
Be careful with a proposal to pay a small amount in the meantime. What that means depends on the circumstances and the arrangements made. Seek legal advice if at the same time you deny having concluded the agreement. You want to avoid any uncertainty about your position. Whenever a response is necessary, state consistently which facts you acknowledge, which you do not know and which you expressly dispute.
Disputing an unknown loan
Request the application, the agreement, the identification data and the payout route. Make it clear that you dispute having taken out the loan, if that is your position. Agreeing a payment arrangement may have different consequences from merely requesting information; have the wording assessed.
Keep the police report, messages about identity misuse and evidence of your own place of residence or payment behaviour, insofar as relevant. A police report supports the file but does not automatically decide the civil credit relationship. Ask for correction of demonstrably inaccurate data and a substantive investigation into your involvement.
Also read about compensation for an incorrect BKR registration and bank fraud.
Frequently asked questions about BKR and identity fraud
Does BKR remove the registration as soon as I file a police report?
Not automatically. The lender must investigate the underlying data and the dispute. Include the police report or confirmation, but also explicitly ask for correction and a reasoned position on the agreement.
Does a copy of my identity document prove that I took out the loan
Not in itself. A copy may have been used without permission. The full application, verification, signing and payout are relevant. Respond specifically to the data on which the provider relies.
Do I need to know who the perpetrator is before I can get help?
No. Describe the known facts and state that the identity of the perpetrator is unknown, if that is the case. The police, the CMI and the lender each have their own role. You do not have to carry out the criminal investigation yourself.
Can I ignore collection letters because the debt is not mine?
That would be unwise. Dispute the claim in writing and respond in time to formal procedural documents. An earlier report does not automatically prevent proceedings. Keep all correspondence and seek help quickly if you receive a summons.
What if several unknown loans are visible?
Make an overview for each loan with the provider, contract number and details. Report and dispute each file separately, while keeping any connected indications together. A correction by one provider does not automatically remove registrations by other providers.
Can Arslan Advocaten help with the debt and the registration at the same time?
Arslan Advocaten can assess the contractual dispute, the personal data and the appropriate next route. Send us your current BKR report, reminders, any contract documents received and any report confirmations. The approach, urgency and costs are discussed in advance.
Further reading on this topic
- When is CIS registration permitted?
- Compensation for an unjustified registration
- Removing a registration: legal routes that work
Sources and legal basis
- Central Identity Fraud Reporting Point of the RvIG.
- RvIG reporting form for, among other things, unknown loans and credit cards.
- Mijn Kredietregistratie (My Credit Registration) of Stichting BKR.
- Supreme Court of the Netherlands, 3 December 2021, on the legal basis for CKI processing.
- Supreme Court of the Netherlands, 15 September 2023, on GDPR proceedings.
Sources checked on 16 September 2026. A disputed agreement, identity misuse and data correction each require a separate assessment of the facts and the applicable legal rules.
