This blog post was initially written in French, L’usurpation d’identité comme risque systémique
I mentioned it (very briefly) the other day in my post L’écosystème du bruit et la fabrique de l’autorité, but I genuinely loved Naomi Klein’s book Doppelganger. It opens with a striking anecdote: during the 2020–2021 pandemic, she was repeatedly mistaken for Naomi Wolf, to the point of being blamed for statements made by “the other Naomi”. From there, she asks a set of unsettling questions about identity.
In We are not Alone! (At least, Most of us aren’t), co-written with Baptiste Coulmont, we wondered about the probability of having a strict namesake (same first name and last name). In Doppelganger, the confusion is “only” about the first name. I devoured the book. Klein starts from a sociological intuition and turns it into a narrative. The more everyday life is digitized, the more identity becomes an interface: traces, authentication procedures, and the idea that access itself functions as proof. She describes, very concretely, the anxiety of realizing that after a hack, someone who “seems to be you” is flooding your friends with messages. And she insists on the fragility of this construction: one compromised account, or a deepfake, can bring it down in an instant.
The pandemic as an accelerator
In 2018 or 2019, I had planned to write a post about the disappearance of cash—if I remember correctly because a café refused a payment in coins. But the long-run trend was already there. In most advanced economies, cash had been receding as an everyday means of payment, driven by contactless cards, the rise of online commerce, and the broader dematerialization of transactions.
The Banque de France (in the 2021 note La filière fiduciaire à l’heure de la crise de la Covid-19) documents this shift clearly: cash use for payments had been declining for almost a decade, while cashless instruments gained ground and e-commerce expanded. It also reports a simple indicator: the ratio of card payments to ATM cash withdrawals, which rises over the long run and then spikes in 2020 as withdrawals collapse.
The pandemic acted as a shock. First, an “opportunity shock” tied to lockdowns: fewer trips, fewer in-store purchases, and many shops closed, so fewer occasions to pay with cash. But it was also a shock in perceptions. Fear of contamination via surfaces pushed many consumers to avoid banknotes and coins, and many merchants actively encouraged contactless payments. Banks and card networks also raised contactless limits in several countries.
From a macro perspective, the BIS summarizes this episode in Covid-19 accelerated the digitalisation of payments, describing an unprecedented acceleration in payment digitalization: more digital payments, more online-initiated transfers, and a sharp increase in the share of contactless among card transactions. The most obvious measurable effect is the decline in withdrawals. In BIS statistics, the number of withdrawals falls sharply in 2020—and it falls more than their total value—suggesting withdrawals became less frequent but larger. In France, the Banque de France also describes an episode I had forgotten: an initial rush to ATMs at the announcement of lockdown, followed by a steep decline in withdrawals in the following weeks. The UK shows a similar dynamic in the Bank of England note Knocked down during lockdown: the return of cash, with a sharp fall in cash’s share of payments in 2020, followed by a partial rebound once restrictions were lifted.
But here is the key paradox: while cash receded in transactions, it strengthened as a store of value. The BIS notes that cash in circulation reached a decade high, especially through increased demand for large-denomination banknotes—consistent with cash being held more as a reserve than used as a payment instrument. The Banque de France explicitly speaks of a “cash paradox”: never used so little for paying, and yet never demanded so much, because it is also hoarded—especially in times of uncertainty.
Canada shows the same logic in Cash and COVID-19. Bank of Canada economists show that banknotes in circulation increased sharply at the start of the pandemic, with high denominations playing a large role—consistent with precautionary motives. When society doubts, it wants Plan Bs, and it prepares. Even in the UK, where transactional cash use had been falling rapidly before 2020, the Bank of England stresses two ideas at once: durable shifts toward digital payments, and the fact that cash remains vital for part of the population—and can serve as a fallback in case of incidents or technological failures.
So the pandemic did not “kill cash”. It mainly accelerated the learning of cashless habits and reinforced the role of the digital ecosystem as a layer of continuity. The paper by Raphael Auer, Giulio Cornelli, and Jon Frost, The Pandemic Cash and Retail Payment Behaviour, based on high-frequency international data, captures this dual movement well: card-not-present payments and payment-app downloads rise during strict lockdowns, while cash in circulation also rises—digitalization of transactions and hoarding, in parallel. The work of Tomasz Piotr Wisniewski, Michal Polasik, Radoslaw Kotkowski, and Andrea Moro (Switching from Cash to Cashless Payments during the COVID-19 Pandemic and Beyond) across 22 European countries adds a micro mechanism: fear of contamination via cash and the formation of new habits during restrictions are associated with a shift to cashless, and even with the intention to continue after the pandemic.
The pandemic did more than shift payments from notes and coins to cards and apps. It accelerated a broader transformation in which access replaces objects. Paying becomes authentication. Retrieving documents becomes logging in. Proving becomes a password or a biometric scan. Central banks, in their own way, are already pointing to the same issue when they insist on resilience and fallback options.
In an economy where continuity depends increasingly on digital systems, the issue is no longer only fraud or privacy. It is also access. And if access counts as proof, then anything that weakens access—including personal data leaks and identity theft—stops being a purely individual accident and becomes a collective risk.
If access has become the condition of administrative and economic existence, the relevant question is not only outages or spectacular cyberattacks. It is also the much more banal raw material that makes these attacks possible: personal data. These are the pieces of information that let an attacker authenticate, reset credentials, convince a customer-service agent, or pass a KYC check (Know Your Customer). In short, they help cross the intermediate steps that transform a person into a “legitimate user”. As long as such data remain scattered, risk looks local. When they concentrate, intersect, and circulate, they become a parallel infrastructure—scalable and exploitable. And that is where we move from the general context of digitalization to the concrete mechanics of leaks and identity theft.
Concrete examples and plausible scenarios
We use the phrase “identity theft”, but “theft” is a misleading metaphor. This is not the theft of Bianca Castafiore’s jewels. Nothing material is taken from you. No object is grabbed. What is taken is the ability to open doors. And in a world where access counts as proof, those doors can be many.
In France, this week’s FICOBA episode (La Tribune) is a useful illustration. The Ministry of Finance reported unlawful access identified by the DGFiP to the national file of bank accounts (see the press release). Le Monde reports, based on DGFiP and AFP information (in “Data from 1.2 million bank accounts were accessed illegally since late January”), that 1.2 million accounts may have been consulted. It also stresses a key point: this file does not give balances and does not allow transfers—but it links identities to banks and accounts. In other words, it is not a heist. It is an upgrade in scam quality, and a massive reduction in targeting costs.
The same logic appears with France Travail, but through a different mechanism. The CNIL fined the operator €5 million for security failures (see the press release). The decision published on Légifrance indicates a breach notification in March 2024, later completed—illustrating how long these cases can unfold. Specialized press emphasized the scale, mentioning 36.8 million people affected and highly sensitive data, including social security numbers (see for example L’Usine Digitale). Here, the leak is not only a financial-fraud risk: it is a leak of “social proofs” that enable procedures, service openings, and bypasses.
We move one step further with Viamedis and Almerys. The CNIL spoke of more than 33 million people affected and explicitly reminds readers that data from one leak can be combined with older leaks. That is a crucial threshold: risk is no longer merely additive. It becomes combinatorial.
One last example: the IDMerit leak this week matters because it involves an actor rarely visible to the general public. Next Ink reports (via a Cybernews investigation) that a KYC provider allegedly left a MongoDB database openly accessible, reportedly around 1 TB in size. A KYC process can include an image of an ID document, sometimes a selfie or short video, proof of address (a utility-bill PDF), automated checks (document databases, consistency checks, fraud detection), and sometimes “enhanced” controls for higher-risk cases. Many companies do not do this in-house: they rely on KYC providers (like IDMerit). In other words, this is a leak at a company that serves as an entry point to many other services—potentially exposing the very data used to prove who you are. This is the “identity as a service” economy. And when such providers sit underneath many firms, a local failure can quickly become systemic.
Beyond corporate stories that can feel distant, individual stories help make the cost visible. In Canada, Global News reports the case of a man in British Columbia who discovers a line of credit was opened in his name—even though he is not a customer of the bank mentioned—and spends months trying to repair his file. In France, Le Parisien tells the story of a man waiting for years to be reimbursed for a €60,000 consumer loan taken out by a fraudster. The harm is not only money. It is the Kafkaesque ordeal of becoming “yourself” again inside administrative systems.
Broadly speaking, there are a few main families of outcomes (or rather consequences) of identity theft:
- Credit in your name. Not a fraudulent transaction on an existing account, but the creation of a new debt relationship—slower to detect and harder to undo, especially once credit files are affected. This is the case described by Global News, typical in North America where consumer credit is central.
- Account takeover and loss of access. When documents, accounts, and procedures sit behind authentication, identity theft can turn into a lockout: email changes, phone-number swaps, compromised recovery channels.
- Industrialized social engineering. A leak like FICOBA or a KYC leak increases the credibility of fake interlocutors—fake “advisors”, fake “officials”—because they already know true details. This is what the Ministry of Finance stressed.
- Leak combination. Often the most banal—and the most dangerous—scenario: multiple fragments become an exploitable identity dossier, as the CNIL explains. And we rarely know where or when our identity will be used.
What protections?
We can see the risk. But is it already covered? Regulations vary by country, and protections exist—but they do not protect the same things. They protect payments better than credit, for example. They protect the transaction better than the administrative repair. And they protect “in the moment” better than long-run consequences.
On the European Union side, PSD2 provides a clear safeguard for payments: the payer’s liability for an unauthorized payment is limited to €50 except in cases of fraud or gross negligence, and the principle is reimbursement. This does not solve everything—notably because “gross negligence” remains debated, and because identity theft used to open credit is not the same as an unauthorized payment.
In Canada, the Financial Consumer Agency of Canada also recalls a $50 liability cap for unauthorized credit-card transactions, except in cases of gross negligence. And when fraud appears in a credit file, the victim is typically the one who must contact Equifax and TransUnion and request a fraud alert.
On the leaks themselves, Europe has a more structured transparency constraint. Article 33 of the GDPR requires notification to the supervisory authority (when there is a risk to rights and freedoms) within 72 hours after becoming aware of the breach. In Canada, PIPEDA requires notification and reporting when there is a “real risk of significant harm”, and explicitly mentions identity theft and negative impacts on credit files among possible harms.
The major novelty of the last two years in Europe is the shift toward operational resilience, with DORA entering into application on January 17, 2025. Financial services rely on digital systems and third-party providers. So continuity, incident management, testing, and supervision of critical suppliers have to be regulated. Reuters reports that European regulators have designated some technology providers as “critical” under this approach.
Another Reuters piece notes that central banks are revisiting offline modes for certain payment functions, precisely to reduce dependence on networks—mentioning offline card-payment projects in the Nordics and Estonia as continuity solutions in case the internet is cut. The European Central Bank, in its communications on the digital euro, also highlights an offline functionality aimed at allowing payments even if the internet is temporarily unavailable.
In short, this protects better than before—except perhaps regarding the central question of who bears the cost of repair: time, credit refusals, administrative procedures, and proving that you really are you.
The collective systemic risk
Systemic risk does not come only from a hacked bank. It comes from an economy in which the same types of data and access mechanisms are used everywhere—creating correlated shocks.
The first channel is correlation in fraud attempts. A large leak fuels a wave of better and more numerous scams, at the same time, on the same segments. Even if individual losses are reimbursed, the system absorbs a massive operational cost: investigations, controls, refusals, friction. The IMF has stressed that cyber risks are becoming a macro-financial concern precisely because they can generate extreme losses and large-scale disruptions.
The second channel is technological concentration. When many financial actors depend on the same providers, an incident at one supplier can become a common shock. This is exactly the kind of dependency DORA aims to address, and that the designation of critical providers makes more visible, as noted by Reuters.
The third channel is payment continuity and trust. Trust is a collective asset. If people expect repeated interruptions or recurring identity abuse, behavior changes: they keep cash, they multiply redundancies, they avoid certain channels. Discussions about offline payments, offline cards, or an offline-ready digital euro are also discussions about trust (see the other Reuters article).
The fourth channel is exclusion through loss of access. In a highly digitized world, losing your access—even temporarily—can become a form of social vulnerability, especially if cash and paper no longer play the role of fallback options.
But as always with cyber risk, we only see the tip of the iceberg. ENISA, the European Union Agency for Cybersecurity, says it analyzes hundreds of incidents “publicly reported”. That precision matters: the public only sees part of the picture (one hopes regulators see more). For its part, IBM has emphasized that some categories of breaches take a very long time to be identified and contained—time frames counted in hundreds of days. Between incentives to minimize, detection delays, and information asymmetries, statistical observation is mechanically biased.
My goal here is not to predict a mechanical banking collapse driven by waves of personal bankruptcies. The point is to show that personal data have become an infrastructure. And like any infrastructure, they call for redundancies, responsibility rules, and continuity policies. A highly digitized economy can be very efficient. It also becomes an economy in which security and resilience stop being purely individual concerns and become collective goods. And if this is not designed collectively, others will design it for us.
OpenEdition suggests that you cite this post as follows:
Arthur Charpentier (February 21, 2026). Identity Theft as Systemic Risk. Freakonometrics. Retrieved March 4, 2026 from https://doi.org/10.58079/15qt6