Identity theft: protecting yourself and what to do if it happens

Identity theft is when somebody steals your personal details and pretends to be you¹. Using just a few of your details, criminals can apply for bank accounts, credit cards, benefits and official documents in your name¹. The Financial Ombudsman describes the typical pattern: a fraudster uses your identity to get goods or services, such as a loan in your name, then withdraws the money and leaves you to pay it back². Identity fraud, using those stolen details, is a crime³.

It can happen to anyone. Identity theft can take place whether a victim is alive or deceased⁴, and it is not always dramatic: much of it starts with a lost passport, a bin bag of old statements or a convincing fake email. The good news is that there are clear warning signs, a set of first steps that limit the damage, and a paid-for warning flag, Cifas Protective Registration, that makes it harder for a fraudster to open accounts in your name.

What identity theft is and what fraudsters do with your details

Identity fraud or theft is when somebody steals your personal details and pretends to be you¹. In practice it means your personal details, such as your name, address and date of birth, are used without your knowledge to commit fraud⁸. The details themselves are often worth surprisingly little on their own; it is what a fraudster can build from them that matters. With a name, an address and a date of birth, a criminal can start to look like you to a lender, a bank or a government department.

Fraudsters can use stolen identity details to open a bank account, obtain credit cards, loans and state benefits, order goods in your name, take over your existing accounts, take out a mobile phone contract, and obtain genuine documents such as passports and driving licences in your name⁴. One recognised category, application fraud, occurs when fraudsters open an account using a stolen identity or false information⁹. Account takeover is a related pattern where the criminal does not open new accounts at all but gets into the ones you already have, often after tricking you into handing over security details.

The Financial Ombudsman, which handles disputes between consumers and financial firms, describes identity theft as a fraudster using your identity to get goods or services, such as a loan in your name, then withdrawing money from that loan and leaving you to pay it back². That is the core harm: the fraudster gets the money or the goods, and your name is left attached to the debt. Using the stolen details in this way is identity fraud, and it is a crime³.

Identity theft can take place whether a victim is alive or deceased⁴. That means the estate of someone who has died can also be targeted, and families handling a person's affairs sometimes discover credit applications made in that person's name after their death. The steps for dealing with it are the same: report it, ask for a crime reference number, and check the credit file.

How criminals get hold of your personal information

Identity thieves can steal your personal information in a number of ways, including buying details from the dark web, a hidden and unregulated part of the internet, following a data breach, or by going through your post to find bank and credit card statements, pre-approved credit offers or tax information⁴. Take Five, the national anti-fraud campaign, lists the same routes from the other side: criminals go through your mail for old bank statements, set up a mail redirection for your address without you knowing, or use social media to build a profile of you¹⁰.

The methods fall into a few broad groups:

• Your post and rubbish. Bank statements, pre-approved credit offers and tax information can be enough to start an application in your name⁴. A redirection set up on your address without your knowledge diverts your mail to a fraudster instead¹⁰.
• Data breaches and the dark web. Details taken from organisations that have been hacked are bought and sold on the dark web, a hidden and unregulated part of the internet⁴. You can find out what this means for you in when an organisation loses your data below.
• Social media and oversharing. Criminals use what you post to build a profile of you, piecing together your date of birth, address history and answers to security questions¹⁰.
• Impersonation. Fraudsters phone, text or email pretending to be your bank, a retailer or an official body to extract personal information. Never give out personal information: it can be used to steal your identity and access accounts¹¹. The dedicated pages on phishing and on how to check your bank is really contacting you cover these tactics in detail.

Some routes need very little skill. Going through bins and tampering with recycling bags is listed among the warning signs of identity theft¹, which suggests how often paper still does the damage. Others are highly organised: the National Crime Agency treats fraud as a serious organised crime threat, with identity theft feeding into wider criminal operations¹². Whichever route is used, the fraudster's aim is the same: to gather enough genuine detail about you to pass a lender's or a bank's checks.

Warning signs that someone is using your identity

The official warning signs of identity theft are easy to miss individually, which is why guidance suggests checking for several together¹:

• Unusual payments or direct debits appearing on your bank statements
• Important mail going missing
• Recycling bins and rubbish bags being tampered with
• Bills arriving for things that you have not bought
• New credit cards appearing on your credit record¹

Losing important documents is itself a warning sign: if your passport or driving licence has been lost or stolen, someone may be in a position to use your identity¹³. The same applies if you receive a letter or email about a loan or card that you did not apply for, which is often the first you hear of an account opened in your name¹⁰.

Because a fraudster will usually give a different address for the account they open, you may not see the bills or statements for it at all. That is why the two checks that matter most are your bank statements, for transactions you do not recognise¹⁰, and your credit file, for accounts and applications you did not make¹. A Cifas marker, a note put on your file by a bank if it believes you were a victim of identity fraud, is another sign that something has happened; it warns other lenders, and you may be able to see it on your credit file¹⁴. If you are an innocent victim of fraud, Cifas members must also send you a letter telling you that there is a Cifas warning against your name¹⁵.

How identity fraud affects your credit record

Identity fraud can affect your ability to get credit, such as loans and mortgages¹⁶. The mechanism is simple: when a fraudster takes out credit in your name and does not repay it, the missed payments land on your credit file, because the lender believes the debt is yours. Lenders use information held about you by credit reference agencies when deciding whether to lend, so entries you do not recognise can stand between you and a mortgage, a loan or a credit card¹⁵.

The damage is not only financial. Victims of identity theft through doorstep fraud have described a damaged credit rating, continued correspondence over a long period to repair the damage, and the emotional distress and anxiety identity theft can cause, even where a bank or insurance policy covers the loss¹⁷. Correcting the record means disputing each entry with the lender and the credit reference agencies, which takes time and persistence.

If a fraudulent debt goes unpaid long enough, it can escalate to a county court judgment, which is recorded against your name and seriously harms your credit rating. You can get a free copy of your credit report from a credit reference agency to see if you have a CCJ against you¹⁸. Checking your credit score can be done for free with credit reference agencies, though some charge for fuller services, so check whether you have to pay before you use one¹⁹.

A statutory credit report by post costs £2.00¹, and guides describe getting a copy of your personal credit file from a credit reference agency as costing as little as £2⁷. Free options also exist for checking your file for credit taken out in your name fraudulently¹⁴. The credit scores section explains how credit reference agencies work, how to read your file and how to correct wrong entries.

What to do straight away if your identity is stolen

The first hours matter. If your identity has been stolen, contact your bank, credit card company and the local police on the non-emergency phone number, 101, as soon as possible⁴. Speak to your bank or building society straight away if you think your credit or debit card, online bank account or cheque book have been stolen or hacked¹. If you lose a card, driving licence or passport, report it as lost immediately to the organisation that issued it¹⁰.

In order, the steps are:

1. Contact your bank and card providers. Identity fraud involving plastic cards, online banking or cheques should be reported directly to the financial institution concerned⁷. If you receive a letter or email about a loan or card you did not apply for, call your bank immediately¹⁰.
2. Report lost or stolen documents. Report details of lost or stolen documents, such as passports, driving licences, credit cards and cheque books, to the organisation that issued them²¹.
3. Report the theft to the police and ask for a crime reference number. Report the theft of personal documents and suspicious credit applications to the police and ask for a crime reference number¹³. You will need it when disputing entries with lenders and credit reference agencies.
4. If your mobile phone has been stolen, contact your network provider. This stops criminals being able to use your number and impersonate you, since your number is often the route to resetting passwords on your accounts²².
5. Check your credit file for accounts and applications you do not recognise¹.
6. Consider Cifas Protective Registration, a paid-for warning flag against your details⁸.

If you are worried for your safety, contact the police for information and support²¹. If money has been taken from your account rather than credit opened in your name, the rules on refunds are different: see what to do about a transaction you do not recognise and authorised and unauthorised payments. If you have paid a fraudster directly, first steps for victims sets out what to do.

Reporting identity fraud: Report Fraud, Police Scotland and your bank

Where you report fraud depends on where you live or where the fraud happened. In England, Wales and Northern Ireland, report it to Report Fraud; if you live in Scotland or the fraud happened there, contact Police Scotland on 101²³. Report Fraud replaced the old Action Fraud service: you can report at reportfraud.police.uk or by calling 0300 123 2040²⁴. In Scotland, you can also report a scam to Advice Direct Scotland on 0808 164 6000¹⁴.

The Bank of England confirms the same split: if you are in Scotland, report fraud to Police Scotland on 101²⁶. Report the theft of personal documents and suspicious credit applications to the police and ask for a crime reference number¹³; that number is what lenders and credit reference agencies will ask for when you dispute fraudulent entries.

Alongside the police report, report to the financial firms involved. Identity fraud involving plastic cards, online banking or cheques should be reported directly to the financial institution concerned⁷, and your bank or building society should be your first call if your card, online banking or cheque book have been stolen or hacked¹. If NHS services have been targeted, there is a separate route to report NHS fraud in England and Wales⁶.

If you later disagree with how your bank has handled a fraud claim, you can complain to the firm and then to the Financial Ombudsman, which can look at complaints involving unauthorised payments and identity theft². The pages on complaining to your bank and taking a refused refund to the ombudsman explain the process. The Information Commissioner's Office cannot deal with cases of identity theft itself⁶, though it has a role when an organisation has mishandled your data, covered below.

Cifas Protective Registration: a two-year warning flag for a fee

Cifas is the UK's Fraud Prevention Service, a fraud prevention service used by financial companies and public authorities to share information about fraudulent activity; it is not a credit reference agency¹⁵. Its Protective Registration places a warning flag against your name and other personal details on its National Fraud Database²¹. The flag tells any creditor using Cifas information to carry out extra checks when your details are used to apply for credit or goods⁸.

How it works in practice:

• You apply to Cifas for protective registration, and a flag is placed alongside your name and personal details in its secure National Fraud Database⁴.
• Members carry out extra checks whenever anyone, including you, applies for a financial service such as a loan using your details⁶.
• There is a fee to use the service²¹, described in some guides as a small charge⁷.
• The flag lasts 2 years⁶.
• The information is used only to prevent fraud, not to make lending decisions¹⁵.

Protective Registration does not affect your credit score, but because of the extra checks it can make your credit applications take a little longer⁸. That trade-off is the point: a genuine applicant waits slightly longer, while a fraudster applying in your name runs into checks they cannot pass. A fraud warning can also be placed against your address, so that applications using your address are flagged²⁷.

If you have been a victim of fraud, consider contacting Cifas and signing up for Protective Registration¹⁶. You can find out whether a marker already exists: if there has been any fraud against you, there may be a marker against your name to protect you, and you may be able to see it on your credit file¹⁵. If you are an innocent victim of fraud, Cifas members must send you a letter telling you there is a Cifas warning against your name¹⁵.

Ways to protect your identity day to day

Most identity theft prevention is unglamorous and effective. The official advice is to regularly check your credit card and bank statements for suspicious activity and monitor your credit report¹³. Take Five sets out the day-to-day habits¹⁰:

• Check your bank statements regularly for transactions you do not recognise
• If you lose a card, driving licence or passport, report it as lost immediately to the organisation that issued it
• Check your privacy settings online and think about what personal or financial information you are sharing
• Destroy unwanted documents that have your personal or financial information on them
• Be wary of who has access to your mail

Store documents carrying personal information, such as your driving licence, passport, bank statements, utility bills or credit card transaction receipts, in a safe and secure place⁶. When buying online, use a secure website which displays the company's contact details⁶. Never give out personal information in response to an unexpected contact: it can be used to steal your identity and access accounts¹¹, and your bank or the police will never ask for your PIN or password or ask you to transfer funds for fraud reasons²⁸.

If you move house, ask Royal Mail to redirect your post for at least a year⁴, so statements and pre-approved offers do not sit in an empty letterbox or reach new occupants. To check that your personal details are secure, get a copy of your credit file two to three months after moving⁷.

Age UK adds that scammers now use technology to make approaches more convincing, including artificial intelligence, so an apparently genuine call, text or video is not proof of identity²⁴. The pages on how to spot a scam, checking your bank is really contacting you and one-time passcodes cover the tactics in detail. If you are helping someone else who has been targeted, see supporting a victim.

When an organisation loses your data

When an organisation holding your information loses it, and your information is no longer protected, it is known in law as a personal data breach³¹. A breach can happen if your information is lost, accidentally destroyed, changed without permission, damaged, or accessed, disclosed to or kept by someone it should not have been, and it can happen accidentally, deliberately, through recklessness or during a cyber-attack³¹.

You have some rights to information. If a breach is likely to put you at risk, the organisation must inform you directly and as soon as reasonably possible³¹. It is for the organisation itself to assess whether it needs to tell you about a breach³¹. Organisations that need to report a breach to the Information Commissioner's Office (ICO) should do so without unnecessary delay and no later than 72 hours after becoming aware of it, though they do not need to report breaches that are unlikely to cause harm to people, and they must keep a record of all breaches, including what happened, the impact and what they did about it³¹.

If your data has been exposed, the recommended self-protection steps are to report lost or stolen documents such as passports, driving licences, credit cards and cheque books to the organisations that issued them, check your bank statements and credit report, watch out for phishing, use strong passwords and multifactor authentication, and apply for Cifas protective registration²¹. If you are concerned for your safety, contact the police for information and support²¹.

If you believe an organisation has mishandled your information, you can complain to it first and then to the ICO, which oversees data protection complaints³². You can also claim compensation directly from an organisation if you have suffered damage as a result of it breaking data protection law³². The ICO cannot deal with cases of identity theft themselves⁶, so the fraud is reported to the police and your bank, while the data handling complaint goes to the ICO.