Personnummer Protection in Sweden: How to Keep Your Identity Number Safe

The personnummer is the single most important number in Swedish society. This 10-digit personal identity number (formatted YYMMDD-XXXX) is used for virtually everything: opening bank accounts, signing up for healthcare, filing taxes, getting a phone subscription, renting an apartment, and even joining a gym. It is your identity distilled into numbers.

Unlike a password, you cannot change your personnummer. If it falls into the wrong hands, the consequences can follow you for years. And in Sweden, personnummer has a peculiar vulnerability: it is far more accessible than most people realize.

Who Has Your Personnummer

In Sweden, personnummer is not classified as secret information. It appears on official documents, and many databases that contain it are publicly or semi-publicly accessible. Employers, landlords, banks, insurance companies, telecom providers, and even some online services have your personnummer on file.

This does not mean you should share it carelessly. While the number itself is not secret, the combination of your personnummer with other personal data is what enables fraud.

What Scammers Can Do with Your Personnummer

1. Take Out Loans in Your Name

With your personnummer, name, and address, scammers can apply for quick loans (snabblån) online. Many lending services have minimal verification, especially for smaller amounts. You discover the fraud only when collection notices arrive or when you check your credit report.

2. Open Bank Accounts

Some digital banks and financial services allow account opening with personnummer and BankID verification. If scammers also gain access to your BankID (through phishing), they can open accounts in your name for money laundering.

3. Sign Up for Subscriptions and Contracts

Phone subscriptions, streaming services, and retail credit accounts can be opened with a personnummer. Scammers run up charges and disappear, leaving you with the debt.

4. File False Tax Returns

With enough personal information including your personnummer, scammers can attempt to manipulate your tax filing with Skatteverket, redirecting refunds or creating fraudulent deductions.

5. Impersonate You to Other Services

Your personnummer combined with basic personal details allows scammers to impersonate you when calling customer service, changing account details, or requesting password resets.

How Personnummer Theft Happens

Method	Description
Data breaches	Your personnummer leaked from a compromised company database
Social engineering	Scammer calls pretending to be your bank and asks for verification
Phishing	Fake emails or SMS asking you to "confirm" your personnummer
Public records	Swedish principle of offentlighetsprincipen means some records are accessible
Stolen mail	Physical mail containing documents with your personnummer
Shoulder surfing	Someone observing you enter your personnummer at a counter or screen
Dark web markets	Stolen personnummer sold in bulk from data breaches

How to Protect Your Personnummer

Minimize Sharing

1. Question every request for your personnummer — Do they actually need it? Many services accept other identifiers
2. Never share your personnummer over phone or email unless you initiated the contact and verified the recipient
3. Be cautious on forms — If a website asks for your personnummer, verify it is legitimate and necessary
4. Use alternative identification when possible — Some services accept a samordningsnummer or other ID

Monitor Your Credit

1. Check your credit report regularly at UC (Upplysningscentralen) and Bisnode
2. Set up credit monitoring alerts — Both UC and Bisnode offer notification services
3. Place a credit lock (kreditspärr) if you are not planning to apply for credit — This prevents new credit inquiries

Secure Your Documents

1. Store documents containing your personnummer securely — Locked drawer or encrypted digital storage
2. Shred physical documents before discarding them
3. Use digital mailbox (Kivra or similar) to reduce physical mail theft risk
4. Never photograph your ID card and send it through unsecured channels

Digital Hygiene

1. Use strong, unique passwords for services linked to your personnummer
2. Enable two-factor authentication everywhere possible
3. Be skeptical of calls and messages asking you to "verify" your identity
4. Keep your BankID secure — It is directly linked to your personnummer

What to Do If Your Personnummer Is Compromised

1. Place a credit lock immediately — Contact UC (uc.se) and Bisnode
2. File a police report at polisen.se
3. Contact your bank and request enhanced security measures
4. Monitor your tax account at Skatteverket for unauthorized changes
5. Check Mina sidor at Försäkringskassan for unauthorized benefit claims
6. Review your postal address registration at Skatteverket — Scammers may redirect your mail
7. Contact all services where your personnummer is used and alert them to potential fraud

Sharing Your Personnummer Safely

There are legitimate reasons you might need to share your personnummer — with a new employer, a landlord for a background check, an insurance company, or a legal advisor. When you do, never send it as plain text in an email, SMS, or iMessage.

Use LOCK.PUB to create a password-protected link that contains your personnummer or ID documents. Set it to expire after the recipient has accessed it. This way, the information is not sitting in someone's inbox indefinitely, and only the person with the password can view it.

The Bottom Line

Your personnummer is permanent and irreplaceable. Unlike a compromised password, you cannot simply reset it. The key to protection is a combination of minimizing unnecessary sharing, actively monitoring your credit, and using secure channels when sharing is genuinely required.

Sweden's open-records tradition means perfect personnummer secrecy is not realistic. But making it harder for scammers to combine your personnummer with other personal data dramatically reduces your risk. Stay vigilant, lock your credit when you are not using it, and when you must share identity documents, use a secure tool like LOCK.PUB instead of leaving them exposed in chat logs and email threads.