The scammer has my date of birth, address and a photo of my driving licence. What can they actually do with it, and how long do I stay on alert?

#1Grace H(Joined Mar 2025 · 31 posts)June 15, 2026, 8:32 pm

The caravan business (my other thread, still fighting the bank) has a part I have not posted about because it embarrasses me more than the money does.

Before I paid the deposit, the "seller" asked for a photo of my driving licence and my date of birth "for the ownership transfer paperwork". It seemed like the responsible thing, a proper seller doing proper paperwork, so I sent it. Front of the licence, clear photo, my full name, address, DOB, licence number, the lot. Plus my email and my mobile obviously, from all the messaging.

Bank's dealing with the money side, badly. What nobody has told me is what happens to the REST of it. I keep reading "your identity may be at risk" and it is so vague it's useless. At risk of what? Can they take out a loan with a photo of a licence? Open a phone contract? Empty my current account? I have changed my passwords and I have a credit freeze on now, which I only did because this site said to, but I have no idea whether I am supposed to keep that for a month or forever.

And the thing I actually lie awake about. Is there a date after which I can stop watching? Because right now I check my bank app about nine times a day and I would like to know when that gets to end.

#2tomd52(Joined Jun 2025 · 19 posts)June 15, 2026, 10:04 pm

Not an expert, but I can tell you what a licence photo did for my brother in law. Two years after his was in a rental agency "data incident", a car was hired in his name in a city he's never been to and the fines turned up at our address. Sorted out in the end but it took months of letters. So no, it isn't nothing, and the timing was longer than anyone expected.

#3Priya V(Joined Apr 2026 · 14 posts)June 16, 2026, 8:47 am

Grace, the part that would worry me most from your list is the mobile number plus the DOB plus the address, not the licence on its own. Those three together are most of what a phone company asks when someone rings up claiming to be you and wanting the number moved. That is the SIM swap thing from Walt's thread. Worth asking your network today whether they can put a port-out PIN or a password on your account so a caller can't move your number without it. Took me five minutes.

#4David MercerModerator(Joined Jan 2025 · 214 posts)June 18, 2026, 9:58 am

Grace H said:

Is there a date after which I can stop watching?

Grace, the short version first, then the long one. What they have is enough to try to become you on paper, and not enough to walk into your current account. And the watching does end, but it ends because you replace it with a couple of permanent setups, not because a date arrives.

What that bundle is actually good for, in rough order of how often it gets used. First, selling. A name, address, DOB and licence image with a confirmed live mobile and email is a complete record, and records like that are traded on, which is why Tom's brother in law got hit two years later by somebody who had nothing to do with the original incident. Second, applications in your name: credit cards, loans, phone contracts, hire agreements, and the licence photo is the document that gets uploaded to pass an identity check. That is exactly what a credit freeze blocks, because the lender can't pull your report, so the application stalls. Third, the one Priya named: convincing a company that already knows you, your mobile network or a utility, that the caller is you. The port-out PIN is the right fix and it is a genuinely good five minutes. What they can't do with any of it is log into your bank, which needs your credentials and your second factor, and you've changed the first and (I'd check) should have the second turned on.

How long. I lost most of my savings a few years ago and handed over roughly the same set of details you did, in a panic, over several calls. The freeze I put on that month is still on. Not because anything ever happened, but because keeping it on costs me nothing: in the US it is free by law at all three bureaus, it has no effect on your score, and when I needed a new card last year I lifted it for a day online and it locked itself again. Where you are decides the exact mechanism, and there are equivalents to a freeze or a protective flag in most countries, so that is worth a look with the credit agencies where you live rather than taking my US wording as gospel. The point is the same everywhere: it is not a temporary measure, it is a setting.

The other permanent setup is the phone. Port-out PIN, and two-factor on the accounts that matter moved off text messages onto an authenticator app or a security key where the service allows it, because a text code is only as safe as your mobile number. Two-factor authentication explained ranks the options.

On the licence itself, tell the issuing authority it has been compromised. What they can do about it depends on where you are, and I'd rather you asked them than trusted me on their procedures, but a note on the record has helped people I've talked to when a hire or a fine surfaced later, because the date of the report predates the misuse.

Now the nine-times-a-day thing, because that's really the question. In my experience the misuse, when it happens, mostly shows up in the first year, and the data keeps circulating for years after that at a much lower rate. So you do not watch harder, you watch smarter: a freeze, the PIN, real two-factor, and one check of your credit report every few months, which in most countries you can get free. Once those are in place, the checking of the bank app is the vigilance running on its own rather than doing a job. Mine faded over about six months once I trusted the setup, and the trusting was the slow part, not the setup.

One more, and it's the one I'd underline. You've now got two things that make you a target for the second round: a documented loss, and a full set of details. Expect a call or a letter from somebody who knows about the caravan, sounds official, and can help you get the deposit back. The site's page on recovery scams, the second wave is what I'd read before that call comes, not after.

#5Walt F(Joined Jan 2026 · 17 posts)June 19, 2026, 5:41 pm

The port-out PIN is the thing I wish I'd known before my number got moved. Also, Grace, when you speak to the network, ask them to note that any SIM change has to be done in person with ID. Some will, some won't, but ask.

Quick correction of something I believed for ages: a fraud alert and a freeze are not the same. The alert just asks lenders to check harder and it runs out; the freeze actually blocks the report. I'd assumed the alert was the strong one. It isn't.

#6Grace H(Joined Mar 2025 · 31 posts)July 2, 2026, 9:15 pm

Two weeks on. Port-out PIN set, took one call. Two-factor moved off texts on the bank and the email, which was fiddlier than I expected because the email was the one everything else resets through, so I did that first. Freeze staying on, permanently, decision made, and I feel better for it being a decision rather than a thing I might forget to undo.

Reported the licence to the issuer. They took the details and gave me a reference and that was that, which David warned me about, so it didn't feel like a brush off.

Bank app is down to twice a day. Still not the same person I was in March, but David's line about watching smarter instead of harder has stuck, because the nine-times-a-day thing was never actually going to catch anything the freeze wouldn't.

No recovery agent yet. I've decided to be almost looking forward to it.