Identity fraud and your credit file

Identity fraud is when somebody steals your personal details and pretends to be you, and it is a crime¹. Using just a few of your details, criminals can apply for bank accounts, credit cards, benefits and official documents in your name². The damage often lands on your credit file: accounts you never opened, searches you never authorised, and eventually debts chased in your name. Fraud offences recorded by the national reporting centre reached 354,622 in the year ending March 2025, up 1% on the previous year³.

The good news is that every part of this has a process. You can check your credit file for free, report what you find, ask for fraudulent entries to be removed, and put warnings or locks on your file that make it much harder for anyone to open accounts in your name. This page walks through each step, including who to report to in England, Wales, Northern Ireland and Scotland, and what protections do and do not cover.

What identity fraud is and how criminals use your details

Identity fraud or theft is when somebody steals your personal details and pretends to be you². It is a crime, and debt charities are clear about what it can lead to: the fraudster can take out credit in your name, such as a loan or credit card, take money from your bank account, apply for benefits in your name, buy goods in your name, or obtain documents such as a driving licence or passport in your name⁸. The Financial Ombudsman Service describes the typical pattern: a fraudster uses your identity to get goods or services, such as a loan in your name, then withdraws the money and leaves you to pay it back⁹.

Fraud against banks and lenders takes several forms that all touch the credit file. Application fraud occurs when fraudsters open an account using a stolen identity or false information². Banking and credit industry fraud covers fraud committed against a bank or financial institution using a false identity, credit or debit cards, cloned cards, cheque books or online accounts². In each case the account or application ends up recorded against your name at the credit reference agencies, which is why the first many people know of it is a refusal of credit or a letter chasing a debt.

The scale is large and growing in some categories. Fraud prevention service Cifas has reported spikes in identity fraud cases involving personal store cards, bank accounts, credit cards and motor insurance, and warned that people over 60 were particularly likely to be targeted¹⁰. UK Finance members saw almost 15,000 instances of impersonation scams between January and June 2020¹¹. Research by Walnut Unlimited commissioned by Experian found three in four UK adults have been targeted for identity fraud and one in four have been victims⁵.

Signs of identity fraud on your credit report

The warning signs split into two groups: things on your bank statements and post, and things on your credit file itself. Northern Ireland's consumer guidance lists unusual payments or direct debits appearing on your bank statements, important mail going missing, recycling bins and rubbish bags being tampered with, bills arriving for things you have not bought, and new credit cards appearing on your credit record². The Information Commissioner's Office (ICO) adds the simplest test of all: items you don't recognise appear on your bank or credit card statement¹².

On your credit report specifically, the things to look for are accounts you did not open, searches you did not authorise, and credit cards you never applied for. A CIFAS marker may be added to your credit file to warn lenders that your identity has been compromised, so if you see one and were never told about it, that is itself a sign someone has reported fraud in your name¹³.

The consequences go beyond the immediate loss. Northern Ireland's guidance on doorstep fraud notes that even where a bank or insurance policy covers the money, a victim can still face a damaged credit rating, continued correspondence over a long period to repair the damage, and the emotional distress and anxiety identity theft can cause¹⁴. That is why spotting it early, on your statements and your file, matters more than anything else you do afterwards.

Check your credit file for applications you didn't make

You can check your credit file for free, and it is the single most useful check for identity fraud¹⁵. The ICO's advice to victims is to request a copy of your credit file to check for any suspicious credit applications¹². Look for accounts, searches and addresses you do not recognise, and for anything dated after you first suspected your details had been taken.

Not every search on your file is a credit application. When you open a basic bank account, for example, the bank makes a soft search of your credit file for identity checking only, which does not affect your credit score¹⁶. Soft searches like that are normal and harmless. What matters is hard searches and new accounts you cannot explain, because those are what a lender sees when you next apply for credit. Our pages on hard and soft credit searches and what is on your credit report explain the difference in detail.

One caution while you do this: never be tempted to add false information to an application yourself. Citizens Advice warns that when you apply for a credit card you sign to say all the information is correct, and any false information you give may be seen as fraud¹⁶. If your file is wrong, the route is to report it and have it corrected, not to work around it.

If you find an account that is not yours, the next steps are to report the fraud, tell the lender, and ask the credit reference agencies to correct or remove the entry. Our guide to correcting wrong information on your credit report covers the dispute process, and how long information stays on your credit file covers what happens to entries once they are resolved.

Report Fraud replaced Action Fraud: how to report identity fraud

Action Fraud, the UK's national reporting centre for fraud and cybercrime, has now been replaced by Report Fraud¹⁷. The change happened in December 2025, when Report Fraud, the new national reporting service for cyber crime and fraud, took over⁴. Report Fraud is run by the City of London Police⁴, and in England, Wales and Northern Ireland it is the national reporting centre for fraud¹⁸. If you see older references to Action Fraud, they now mean this service.

For England, Wales and Northern Ireland, you report identity fraud to Report Fraud, online at reportfraud.police.uk or by calling 0300 123 2040, with the phone line typically open Monday to Friday⁵. Debt charity guidance for England and Wales sets out the same route: contact the reporting service and use its online reporting tool¹. Phishing emails you receive can also be passed on: they go to the National Fraud Intelligence Bureau (NFIB), which analyses reports¹⁵.

Two boundaries on what Report Fraud covers are worth knowing. HMRC's tax fraud reporting service states that other types of fraud, such as identity theft, are reported to Report Fraud rather than to HMRC, and that benefit fraud is reported separately¹⁷. And if your complaint is about a financial firm's handling of a fraud, rather than the fraud itself, the ICO refers complaints about fraud and scams to Report Fraud, while the Financial Ombudsman Service handles complaints about firms²⁰.

Reporting in Scotland: call Police Scotland on 101

Scotland has its own route. If you live in Scotland or the fraud happened there, contact Police Scotland on 101⁶. The ICO gives the same advice for people who live in Scotland¹², and the National Crime Agency confirms that in Scotland you report to Police Scotland by calling 101¹⁹. Welsh consumer guidance from Anglesey's trading standards team also directs people to contact Police Scotland by calling 101 if they think they have been a victim of fraud⁶.

There is a second point of contact in Scotland. Scam reporting guidance notes that in Scotland you report a scam to Police Scotland on 101, or to Advice Direct Scotland on 0808 164 6000¹⁵. The Pensions Regulator gives the same pair of numbers for pension scams: if you live in Scotland, call Police Scotland on 101 or Advice Direct Scotland on 0808 164 6000¹⁵.

The territorial split is consistent across official sources: Report Fraud covers fraud in England, Wales and Northern Ireland, and Police Scotland covers Scotland⁶. If you are unsure which applies, the test is where you live and where the fraud happened. Our page on credit files in Scotland covers how the Scottish registers differ from the rest of the UK.

What happens after you report: reference numbers and updates

When you report to Report Fraud, you will be given a reference number and advice on what to do next⁵. You will then get an update on your report within 28 working days⁷. That timescale is the one to plan around: it is not instant, and chasing before then rarely changes anything.

There is one important exception for identity fraud specifically. If you report identity fraud, Report Fraud will create an information report instead of a crime report, and will not provide a crime reference number. It will still assess your case and send you updates⁷. This is not a dismissal: it reflects how identity fraud cases are processed, and the assessment and intelligence work still happens. Reports are analysed and fed into intelligence work; the Pensions Regulator, for example, describes how every report related to pension fraud is analysed by one of its analysts embedded in the City of London Police and fed directly into active intelligence work⁴.

If money has been taken, there is a separate deadline to watch. Where a bank refuses a refund, one ground it can use is that you told them about the fraud 13 months or more after the payment was taken⁷. Reporting early protects that position. The Payment Systems Regulator's advice to scam victims is to contact your bank or payment services provider immediately, contact the police on 101, report the scam to the national reporting service, and keep records of all contact and correspondence between you and the scammer²¹.

If you are unhappy with how a bank or lender has handled the fraud, you can complain to the Financial Ombudsman Service, which can look at fraud and scam complaints²⁰. The FSCS also sets out what to do if you are a victim of fraud, including contacting Report Fraud on 0300 123 2040²².

Cifas markers and Notice of Correction: warnings on your file

Once identity fraud is confirmed, there are two things that can be put on your credit file to warn lenders. The first is a Cifas marker. A Cifas marker is a note put on your file by the bank if it believes you were a victim of identity fraud, and it warns other lenders¹⁵. MoneyHelper describes the same thing: a CIFAS marker may be added to your credit file to warn lenders that your identity has been compromised¹³. You can also apply for one yourself: the ICO advises contacting Cifas, the UK's fraud prevention service, to apply for protective registration¹². Our page on Cifas markers and Protective Registration covers how this works and what it means for your future applications.

The second is a Notice of Correction. This is a maximum 200-word statement warning lenders of the identity theft, placed on your credit file held with Experian, Equifax and TransUnion¹⁰. It is your own words, attached to your file, so anyone reading it knows to take extra care before lending in your name. Our page on the Notice of Correction explains how to add one.

Both warnings have a practical effect on applications. The Financial Ombudsman Service, which handles disputes about fraud markers, notes that a marker can slow down applications, because lenders check them manually rather than automatically declining or accepting²³. The trade-off is speed against security. Where a debt is not in the person's name, StepChange's guidance on debts not in your name sets out the position¹.

Experian CreditLock: what it blocks and what it doesn't

Experian offers a lock on your credit report called CreditLock. Locking your report stops most applications for credit that go through Experian, including loans, credit cards, mortgages, store cards, current accounts and mobile phone contracts⁵. If someone tries to open one of these in your name while your report is locked, the application is blocked, and Experian will let you know about any blocked applications, which can help you spot signs of fraud⁵.

To use it, you need an upgraded Experian account with an Identity Plus or CreditExpert subscription⁵. To lock your report, go to the 'Report' tab, which shows whether your report is locked or unlocked, and use the 'Unlock/Lock' switch to change it to 'Lock'⁵. Experian sends a monthly reminder if your report is locked⁵.

Locking does not affect your credit score: Experian states you can lock and unlock your report whenever you like and it won't affect your score⁵. Our page on can you freeze your file? covers the wider question of freezing, and credit monitoring services covers what paid services include.

The limits matter as much as the coverage. Experian states that locking your credit report with CreditLock won't block:

• updates to your report and score
• changes to your current credit limits
• credit quotations and eligibility checks
• new applications for insurance, although it may block applications to pay in instalments
• searches from utility companies, employers and landlords⁵

And the fundamental limit: Experian can't block applications that go through other credit reference agencies⁵. A fraudster applying for credit with a lender that checks Equifax or TransUnion is unaffected by an Experian lock. Our page on the UK credit reference agencies explains which agency is which.

Where a credit lock does not protect you

A credit lock is a barrier against new credit applications, not against every kind of fraud. The clearest gap is with money you hand over yourself. Scam guidance notes that in many purchases your money is not protected unless you pay by credit card or Direct Debit¹⁵. If a criminal persuades you to transfer money, a lock on your credit file does nothing, because no credit application is involved.

The same applies to fraud on existing accounts. CreditLock does not block changes to your current credit limits, and it does not stop someone taking money from a bank account they have already got access to⁵. That is why the first advice from every official source is the same: speak to your bank or building society straight away if you think your credit or debit card, online bank account or cheque book have been stolen or hacked². The Payment Systems Regulator tells scam victims to contact their bank immediately so it can protect the account²¹, and NS&I gives the same advice: contact your bank immediately if you think you have fallen for a scam, and report it to the national reporting service²⁴.

Research for Parliament notes that fraud victims are most likely to report fraud to their bank or account provider, rather than the national reporting service or police²⁵. That is understandable, but the two reports do different jobs: the bank protects your money, the national report feeds the intelligence picture. Doing both is what the official guidance consistently sets out²¹.

Keeping your details safe to prevent identity fraud

Prevention is mostly habit rather than gadgetry. The ICO's advice is to regularly check your credit card and bank statements for suspicious activity and monitor your credit report¹². If your details have been exposed in a data breach, its steps are: report lost or stolen documents, such as passports, driving licences, credit cards and cheque books, to the issuer; check bank statements and your credit report; watch out for phishing; use strong passwords and multifactor authentication; and apply for Cifas protective registration²⁶.

A few specific habits follow from the official guidance:

• When buying online, use a secure website which displays the company's contact details¹².
• Do not include information that might put you at risk of fraud, for example bank details or National Insurance numbers, in places like your Universal Credit journal²⁷.
• Report the theft of personal documents and suspicious credit applications to the police and ask for a crime reference number¹².
• Keep your HMRC login details safe; HMRC's own guidance exists for exactly this reason, and its references to the reporting service have been updated because the service is now called Report Fraud¹⁷.

If you are worried about a specific kind of fraudster, the scams and fraud guide covers the main types, and how to check your credit report for free covers the regular monitoring the ICO recommends. If you have already been affected, free, impartial help is available from MoneyHelper and debt charities such as StepChange and National Debtline, whose guidance on dealing with fraud is referenced throughout this page⁸.