Postident Loan Scam: How to Spot and Avoid Credit Fraud

Imagine receiving a professional-looking letter from your bank or a request from a potential buyer on an online marketplace. It asks for a routine identity verification—a “security check” to ensure everything is in order. You follow the instructions, visit a post office or complete a digital check, and travel about your day, believing you have simply fulfilled a bureaucratic requirement.

In reality, you may have just signed off on a massive loan you never requested. A sophisticated wave of Postident Kreditbetrug (Postident loan fraud) is currently targeting consumers, turning a trusted security protocol into a tool for identity theft. In some cases, victims discover too late that criminals have taken out loans in their name exceeding 20,000 euros, leaving the victims legally responsible for debts they never saw a cent of.

The danger lies in the perceived legitimacy of the process. By tricking users into completing a legitimate identity verification, scammers bypass the most significant hurdle in financial fraud: the “Understand Your Customer” (KYC) requirements that banks use to prevent fraud. Once the victim confirms their identity via the official channels, the loan is approved and the funds are instantly transferred to accounts controlled by the criminals.

The Mechanics of the Trap: Two Primary Scenarios

Criminals are not using fake verification systems; they are using the real one to validate fake applications. According to warnings from the Verbraucherzentrale, the fraud typically unfolds in one of two ways.

The first scenario involves deceptive mail. Victims receive letters that mirror the branding and tone of their own bank. These letters claim that a data confirmation is required to maintain account security or to update personal records. The letter directs the recipient to use the Postident process to “verify” their details. Unbeknownst to the victim, the “verification” is actually the final step in a loan application submitted by a scammer using the victim’s stolen personal data.

The second scenario targets the peer-to-peer economy. When selling an item on a platform like eBay Kleinanzeigen or similar marketplaces, a “buyer” may insist on a high level of security to guarantee the transaction. They pressure the seller to undergo an identity check—claiming it protects both parties—and provide the necessary coupons or links. The seller, thinking they are securing a sale, inadvertently legitimizes a credit contract in their own name.

The attackers use the Postident procedure to set up loan agreements in the name of their victims. (Symbol image: IMAGO / photothek)

Understanding Postident and the Legal Loophole

To understand why this works, one must understand the role of the Postident process. Operated by Deutsche Post, Postident is a legally recognized method for verifying a person’s identity. It’s most commonly used when opening a bank account or signing a mobile phone contract from home.

This process exists primarily to satisfy the Geldwäschegesetz (GwG), or the Money Laundering Act. This law mandates that financial institutions verify the identity of their clients to prevent money laundering and terrorist financing. As Postident is a gold standard for verification, banks trust it implicitly. When a person presents their ID at a post office or via a verified video chat, the bank assumes the person is intentionally applying for the product associated with that verification ID.

The scam exploits the gap between the verification of identity and the intent of the applicant. Postident confirms who the person is, but it does not necessarily confirm what they are signing up for if the victim is misled about the purpose of the check.

Real vs. Fraudulent Requests

Comparing Legitimate and Fraudulent Postident Requests

Feature	Legitimate Request	Fraudulent Request
Initiation	You applied for a product/service.	Unsolicited letter or buyer request.
Urgency	Standard business processing time.	High pressure or threats of account closure.
Clarity	Clear link to your specific application.	Vague “security check” or “confirmation.”
Method	Official company portal/app.	Unexpected links, coupons, or codes.

Red Flags and Defensive Measures

The most effective defense against this type of identity theft is a healthy dose of skepticism regarding unsolicited requests. In the world of finance, a “routine security check” that requires a full legal identity verification is highly unusual if you have not recently initiated a change to your account.

Warning signs include:

• Unsolicited Coupons: Being sent a Postident coupon or transaction number via email or mail that you did not request.
• Artificial Urgency: Language that suggests your account will be frozen or a deal will fall through if you do not act “immediately.”
• Vague Purposes: Requests to “confirm data” or “provide a security guarantee” without a specific, documented application process.
• Third-Party Pressure: Buyers in private sales who insist on identity verification as a prerequisite for payment.

If you receive a suspicious request, the first step is to stop the process immediately. Do not visit the post office and do not enter a video chat. Instead, contact your bank using a known, official phone number—not any number provided in the suspicious letter—to verify if there is an actual requirement for your identity to be confirmed.

Recovery: What to Do if You’ve Been Targeted

If you realize you have inadvertently legitimized a loan for a scammer, time is of the essence. The goal is to create a legal paper trail that proves the contract was obtained through deception.

1. Immediate Notification: Contact the financial institution that issued the loan immediately. Inform them that the identity verification was obtained through fraud and that you did not authorize the loan.
2. Police Report: File a formal criminal complaint (Anzeige) with the police. This represents a critical step for any future legal disputes regarding the debt.
3. Credit Monitoring: Check your credit score (such as SCHUFA in Germany) to observe if other unauthorized accounts or loans have been opened in your name.
4. Legal Counsel: Consult a lawyer specializing in banking or consumer law to contest the validity of the contract based on the lack of intent (Willenserklärung).

Disclaimer: This article is for informational purposes only and does not constitute legal or financial advice. For specific legal issues, please consult a qualified professional.

As financial institutions move toward more digitized KYC processes, the battle between security and social engineering continues. The next critical checkpoint for consumers will be the wider adoption of the eID (electronic ID) function on national ID cards, which aims to make verification more secure and transparent. Until then, the responsibility remains with the user to ensure that every “security check” is one they actually requested.

Have you encountered suspicious requests for identity verification? Share your experience in the comments to help others stay vigilant.