Identity fraud penalty in the Netherlands: what sentence can you expect

Identity fraud in the Netherlands is punishable under article 231b of the Dutch Criminal Code, which carries a maximum of five years imprisonment or a fine of the fifth category. Where biometric data is misused, article 231a applies and the maximum rises to six years. Those are ceilings, not tariffs: in practice the sentence depends on the damage, the number of victims, the degree of organisation and the record of the accused, and a first offender with limited damage is far more likely to receive community service or a suspended sentence than a custodial one.

Article 231b of the Criminal Code: what is actually punishable

Article 231b makes it an offence to use, intentionally and unlawfully, identifying personal data of another person that is not biometric, with the intent to conceal one own identity or to conceal or misuse the identity of that other person, in circumstances in which harm may arise from that use. Every element of that description does work, and a prosecution fails if one of them is missing.

The data must be identifying: a name, a date of birth, a citizen service number, a copy of a passport or identity card, a bank account number combined with other details. The use must be intentional and unlawful, so an administrative mistake or the use of data with the consent of the person concerned falls outside the provision. There must be an intent to conceal or misuse an identity. And the use must be capable of causing harm; actual harm is not required, but a purely theoretical possibility is not enough either.

The maximum penalty is five years imprisonment or a fine of the fifth category. The amounts attached to the fine categories are set in article 23 of the Criminal Code and are adjusted periodically by ministerial order, so any figure quoted in an older article is likely to be out of date; the category, not the amount, is the fixed element. A court may also impose both a custodial sentence and a fine, and may add a compensation order in favour of the victim.

One misunderstanding is worth clearing up at the outset. Adopting a false name is not in itself a criminal offence in the Netherlands. Someone who introduces himself under an invented name commits no offence under article 231b. It becomes criminal when the identifying data of a real other person is used, with the intent described above, in a way that may cause harm.

Biometric data and article 231a

Article 231a deals with biometric identity fraud and carries a higher maximum of six years imprisonment or a fine of the fifth category. It covers the falsification of biometric features or of the data derived from them, the use of such falsified data as if genuine, and the use of the genuine biometric data of another person in order to direct suspicion of an offence towards that person or away from oneself. Where the conduct serves to prepare or facilitate a terrorist offence, the maximum is increased by a third.

The reason for the higher maximum is practical rather than moral. A stolen password can be changed and a compromised bank account can be closed, but a fingerprint or a facial profile cannot be reissued, and the wrongful attribution of biometric traces to an innocent person is exceptionally difficult to undo.

The offences that usually accompany identity fraud

Identity fraud rarely stands alone in an indictment. Producing or altering a document so that it appears genuine is forgery under article 225 of the Criminal Code, which carries a maximum of six years. Obtaining money, goods or a service by adopting a false name or a false capacity, or by a web of deceit, is fraud under article 326, with a maximum of four years. False travel documents and the use of a travel document issued to someone else are dealt with in article 231. Gaining access to a computer system without authorisation is computer trespass under article 138ab, and channelling the proceeds is money laundering under articles 420bis to 420quater, which sit in the Criminal Code and not, as is sometimes written, in the anti-money laundering act.

This matters for the sentence. Where several offences are tried together, the rules on concurrence in article 57 of the Criminal Code allow the court to impose up to the highest applicable maximum increased by one third. A file that begins as a single misuse of a copied identity document can therefore end well above the five year ceiling of article 231b once forgery and fraud are added. Our overview of fraud and financial crime in the Netherlands sets out how these offences interlock.

How the sentence is determined in practice

There is no statutory tariff for identity fraud. Dutch courts sentence within the statutory maximum on the basis of the facts, guided by the orientation points published by the consultative body of the criminal divisions for common offence types and by the sentences imposed in comparable cases. The prosecution service works with its own internal guidelines when formulating a demand, but the court is not bound by either.

The factors that carry the most weight are the extent of the financial damage, the number of people whose data was used, the period over which the conduct continued, the degree of organisation and the role of the accused within it, and whether the accused has previous convictions for similar offences. On the other side, an early admission, genuine efforts to compensate the victims, a long period since the offence and personal circumstances that make imprisonment disproportionate all pull the sentence down.

The available sanctions are broader than prison. A community service order can run to a maximum of two hundred and forty hours and is frequently imposed for first offences, whether alone or alongside a short suspended sentence. A suspended sentence under article 14a of the Criminal Code comes with a probation period and can be combined with conditions such as treatment or a reporting obligation. In exceptional cases the court can convict without imposing any penalty at all under article 9a. Where the offence produced a financial gain, the prosecution can bring separate confiscation proceedings to recover the proceeds, which run alongside the criminal case rather than within it.

What the court may not hold against you

A widespread piece of misinformation deserves to be corrected here, because acting on it can be damaging. A suspect in the Netherlands is not obliged to answer questions. That right follows from article 29 of the Code of Criminal Procedure, and the caution given before every interview says so. Exercising it is not evidence of guilt, and a court may not impose a heavier sentence because the accused denied the charge or remained silent. What the court may do is weigh a confession, together with remorse and compensation, as a mitigating circumstance. Those are not the same thing, and the difference is the whole of the defence strategy in a weak evidential file.

The second right that is regularly waived by accident is the right to a lawyer. A suspect is entitled to consult a lawyer before the first police interview and to have a lawyer present during the interview, and for a suspect who is detained that assistance is arranged and, in serious cases, paid for by the state. Asking for a lawyer does not make anyone look guilty; answering questions about bank transfers or a copied identity document without one is how avoidable statements end up in the file. Our note on the summons and the hearing in a Dutch criminal case explains what happens after the investigation closes.

Juveniles, borrowed identity documents and juvenile criminal law

Lending an identity document is an offence, and consent from the holder or from a parent does not change that. The person who hands over the document and the person who uses it can both be prosecuted, most often under article 231 of the Criminal Code, and the practical consequence is frequently more painful than the sentence: a document reported as misused can be entered in the travel document alert register, which blocks the issue of a new passport until the entry is resolved.

Suspects under eighteen are sentenced under juvenile criminal law. Juvenile detention is capped at twelve months for a child under sixteen at the time of the offence and at twenty four months for a sixteen or seventeen year old, and the emphasis lies on measures aimed at preventing repetition rather than on retribution. For young adults up to the age of twenty three the court may still apply juvenile criminal law where the personality of the accused or the circumstances of the offence give reason to, and conversely juvenile law can be set aside for a sixteen or seventeen year old in the most serious cases.

If you are the victim of identity fraud

Report the matter to the police first, because without a report there is no investigation and no criminal file. Take the evidence with you: the letters or invoices you received, the account statements, the correspondence with the bank, screenshots of the account or profile opened in your name. Notify your bank immediately, and where a document has been lost or stolen report that as well so that it can be registered.

Alongside the police report, the central reporting point for identity fraud and identity errors, which is part of the government service responsible for identity data, helps victims to trace which registers hold incorrect data and to have it corrected. That administrative clean-up is usually the longest part of the process, because a wrong entry propagates through registers, credit files and debt collection systems.

Two routes exist to recover money. In the criminal case you can join as an injured party and claim compensation from the accused; if the claim is awarded the court will normally also impose a compensation order, and where the convicted person does not pay within a set period the state advances the awarded sum to a private victim. The alternative, or the fallback if there is no prosecution, is a civil claim in tort, which requires only proof on the balance of probabilities rather than the stricter criminal standard. What being a victim does not do is make you liable for the loans, subscriptions or fines taken out in your name: an agreement concluded by someone else in your name without authority does not bind you, and the burden of showing that you did consent lies with the party claiming payment.

Under data protection law you can also require organisations that hold data recorded about you by the fraudster to correct or erase it, and a complaint can be lodged with the Dutch data protection authority where an organisation refuses. Our guide on fraud in the Netherlands sets out the recovery steps in detail.

Time limits

The right to prosecute expires under article 70 of the Criminal Code. For offences carrying a maximum of more than three years but less than eight, which covers both article 231b and article 231a, the limitation period is twelve years from the day after the offence was committed. The period is interrupted by any act of prosecution of which the suspect is aware, and it starts again from that moment.

The civil claim runs on a different clock. A claim in damages against the fraudster is subject to the five year limitation period that begins on the day after the victim became aware of both the damage and the person responsible, with an outer limit of twenty years from the event. Because identity fraud is often discovered late, the starting point of that period is frequently the real point of dispute, and a written demand that unambiguously reserves the right to performance interrupts it.

Reducing the risk of becoming a victim

Most identity fraud starts with a copy of an identity document. Never hand over an uncropped copy when an organisation is not legally entitled to one: outside the situations where the law requires identification, such as starting employment or opening a bank account, a landlord, a gym or a webshop has no right to your citizen service number or to the document number. Where a copy is genuinely required, use the government identity document app or mark the copy with the date, the recipient and the purpose, and black out the citizen service number and the photograph.

The rest is unglamorous but effective. Keep your passport and identity card in a fixed place and report a loss immediately. Use a unique password for each account and enable two factor authentication where it is offered. Treat every message that asks for personal data, a payment or a code as suspect until you have verified it through a channel you looked up yourself, because impersonation of banks, delivery companies and the tax authorities is the standard entry point. Check your bank statements and any credit registration regularly, since fraud committed in your name usually surfaces first as an unexplained transaction or an unfamiliar collection letter. Our article on online fraud and phishing explains how the evidence for these cases is built.

What to do if you are suspected of identity fraud

Do not give a statement before you have spoken to a lawyer, and do not assume that a small file will stay small: identity fraud is usually investigated alongside forgery, fraud and money laundering, and the charge that determines the sentence is often not the one the police mention first. Ask what you are suspected of and on what dates, and keep any documentation that shows consent, a legitimate reason for holding the data, or that the account or transaction was not yours.

Where the evidence is strong, the strategy shifts from denial to damage control: compensating the victims, cooperating on the confiscation of any proceeds and demonstrating that the underlying problem, whether that is debt, addiction or pressure from others, is being addressed. Those steps genuinely influence the sentence, and they work best when they are taken before the hearing rather than announced at it.

Frequently asked questions about identity fraud penalties

How Law and More can help

Our criminal lawyers act for suspects and for victims in identity fraud cases, from the first police interview through to the hearing, and for victims in joining criminal proceedings as an injured party and in the civil recovery that follows. We also advise organisations on what they may do with copies of identity documents and on their obligations after a data breach. If you have been summoned, questioned, or have discovered that your data is being used by someone else, contact our criminal law team so that the position can be assessed before decisions are made that are difficult to reverse.