Identity Theft in the UK: What to Do and Who to Contact

If you’re a victim of identity theft in the UK, contact your bank and any company where fraud has happened first, then report it to Report Fraud (formerly Action Fraud) in England, Wales and Northern Ireland, or Police Scotland. After that, check your credit reports with Experian, Equifax and TransUnion, consider Cifas Protective Registration, and report any lost or stolen passport or driving licence through GOV.UK.

Most of the recovery work is routine, and you can do it yourself without paying anyone. This guide sets out the order to do things in, the UK organizations that matter, and how to deal with the part people often forget: what a stolen identity leaves behind online. If you’re in the US, our general guide on what to do if your identity is stolen covers the FTC and US credit bureaus instead.

Signs someone is using your identity

Identity theft in the UK usually shows up as something small and odd. Common warning signs include:

• Payments or direct debits on your bank statement that you don’t recognize.
• Letters, emails or calls about credit cards, loans, phone contracts or catalog accounts you never applied for.
• Searches or accounts on your credit report that aren’t yours.
• Post that stops arriving, which can mean someone has redirected your mail.
• Being turned down for credit when you’d expect to be accepted.
• Letters from HMRC, the DWP or a council about claims or income you know nothing about.
• Password reset messages you didn’t ask for, or being locked out of your email or social media.

One odd event can be a genuine mistake. Two or more, or any sign that a new account has been opened in your name, is worth treating as identity theft until you know otherwise.

Step 1: Contact your bank and the affected companies

Stopping further losses comes first. Call your bank or card provider using the number on the back of your card or on its official website, never a number from a text, email or caller. Many UK banks can also be reached by dialling 159, a service set up so you can get through to your bank safely if you think you’re being targeted.

1. Tell them you think you’re a victim of identity fraud and ask them to block or freeze the affected cards and accounts.
2. Go through recent transactions with them and dispute anything you didn’t make.
3. Contact any other company involved, such as a lender, mobile network or retailer where an account was opened in your name, and ask for its fraud team.
4. Ask each one to confirm in writing that the account or debt isn’t yours and has been closed.

Keep a simple log: who you spoke to, when, and what they agreed to do. If a bank or lender won’t put things right after you’ve complained, you can usually take the complaint to the Financial Ombudsman Service, which is free to use.

Step 2: Report it to Report Fraud or Police Scotland

Where you report depends on where you live:

Where you live	Who to report to
England, Wales or Northern Ireland	Report Fraud, the national reporting service for fraud and cybercrime, online at reportfraud.police.uk or by phone on 0300 123 2040
Scotland	Police Scotland, by calling 101
Anywhere, if a crime is happening now or you’re in danger	999

When you report, you’ll usually get a crime reference number. Keep it with your log, because banks, lenders and credit reference agencies often ask for it. Our guide on how to report to Report Fraud covers what to have ready and what happens after you submit a report. Type the address yourself rather than clicking a search ad.

Be realistic about what a report achieves. It records the crime and helps police spot patterns, but many reports don’t lead to an individual investigation. The practical value for you is the reference number and the record that you acted quickly.

Step 3: Check your credit reports with all three agencies

The UK has three main credit reference agencies: Experian, Equifax and TransUnion. Lenders don’t all use the same one, so an account opened in your name might show up on one report and not the others. Check all three.

• You have a right to see your credit report free of charge. Each agency offers a free way to view it, either directly or through a partner service. You don’t need to pay for a subscription to check it.
• Read every line. Look for accounts, addresses, linked people (financial associates) and credit searches you don’t recognize.
• Raise a dispute with the agency for anything that isn’t yours. The agency will usually check with the lender, so give it your crime reference number and any letters from the company confirming the fraud.
• Add a notice of correction if something stays on your file that you want lenders to see explained. It’s a short statement that sits on your report.

The UK doesn’t have the US-style credit freeze, so checking your reports and adding the protections below matters more.

Step 4: Consider Cifas Protective Registration

Cifas is a UK fraud prevention service used by many banks, lenders and other organizations. Its Protective Registration service places a marker against your name and address on the Cifas database. When an organization that uses Cifas gets an application in your name, it should see the marker and carry out extra checks to make sure it’s really you.

A few things to know before you sign up:

• It’s a paid service that lasts for a fixed period. Check the current terms on the Cifas website before you apply.
• Your own applications may take longer, because lenders will need to verify that you are you.
• It only works with organizations that check Cifas. It’s a strong extra layer, not a guarantee.
• Apply directly through Cifas. Be wary of any third party that charges to register you.

Protective Registration makes most sense if your details are clearly in a fraudster’s hands, for example after a stolen passport, a burglary where documents were taken, or repeated fraudulent applications.

Step 5: Deal with stolen documents and redirected post

Passport

If your passport is lost or stolen, report it through GOV.UK as soon as you can. Once reported, it’s cancelled and can’t be used again, even if you find it later. You then apply for a replacement in the usual way.

Driving licence

Report a lost or stolen driving licence to the DVLA through GOV.UK and apply for a replacement. Be careful with texts and emails claiming to be from the DVLA during this time; our guide to DVLA scams shows what to watch for.

Royal Mail redirection fraud

Some fraudsters set up a mail redirection so your bank statements and new cards go to an address they control. If your post suddenly stops, or you receive a letter about a redirection you didn’t request, contact Royal Mail straight away using the details on its official website, and tell your bank. Fake Royal Mail texts are common too, so our guide to Royal Mail scams is worth a look.

National Insurance and tax

If you get HMRC letters about employment or income that isn’t yours, contact HMRC using the details on GOV.UK. Don’t use contact details from an unexpected message: HMRC scams often target people who already have a tax worry.

Step 6: Secure your email, phone and online accounts

Your email account is the key to most of your other accounts, because password resets go there. If a fraudster controls it, they can reset your banking, shopping and social media passwords.

• Change your email password first, from a device you trust, then your bank, mobile network and social accounts.
• Use a different, long password for every account. A password manager makes this realistic.
• Turn on two-step verification wherever it’s offered, preferably with an authenticator app.
• Check your email settings for forwarding rules or recovery addresses you didn’t add.
• Ask your mobile network what protections it offers against someone moving your number to a new SIM.

Forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726, which are the UK’s free reporting routes for phishing.

A worked example

This is an illustrative scenario, not a real client.

A nurse in Bristol stops receiving post for two weeks, then gets a welcome letter for a credit card she never applied for, sent to her address just before the post stopped. She calls her bank using the number on her card and confirms nothing has left her current account. She then calls the card company’s fraud team, which closes the new account.

She contacts Royal Mail and learns a redirection was set up in her name to an address in another city. Royal Mail cancels it. She reports everything to Report Fraud online and writes down her crime reference number. That evening she checks her reports with Experian, Equifax and TransUnion and finds a second application, for a phone contract, on only one of them. She disputes it with that agency and the mobile network, quoting her reference number.

Because her details are clearly being used, she applies for Cifas Protective Registration directly through Cifas, changes her email password and turns on two-step verification. A few weeks later both accounts have gone from her credit files, and she keeps checking them every few months.

The reputation side of identity theft

Most identity theft advice stops at money and credit. But a stolen identity can also leave marks where people look you up, and those can linger after the financial side is fixed.

• Fake social media profiles using your name and photos, sometimes used to scam your friends. Report them to the platform as impersonation. Our guide to online impersonation covers each step.
• Posts or messages sent from hacked accounts, such as scam links. Delete them once you’re back in and tell your contacts what happened.
• Company registrations or listings in your name that you didn’t create. Contact the organization that holds the record and explain it was fraudulent.
• Personal details that make you easier to target, such as your address on public directories. Opting out of the edited electoral register, covered in our open register opt-out guide, is one small step.

Search your name in a private browser window and note anything that came from the fraud. If you find fake profiles or damaging pages you can’t remove yourself, our personal reputation management service can help clean up what people see when they search for you.

Common mistakes to avoid

• Only checking one credit report. Lenders use different agencies, so check all three.
• Using contact details from the suspicious message. Look up numbers and websites yourself.
• Paying a debt that isn’t yours to make the letters stop. Dispute it in writing with your crime reference number.
• Keeping no records. Disputes are far easier with a dated log of calls and letters.
• Paying a third party to do free things, such as reporting to Report Fraud or viewing your credit report.
• Stopping after the first fix. Keep checking your reports and statements for a few months, because fraudsters sometimes try again.

Preventing it from happening again

A few habits make a repeat much less likely: shred documents with personal details, keep your passport and driving licence somewhere secure, use unique passwords and two-step verification, check your credit reports regularly, and be cautious about what you share on social media, such as your date of birth and pet’s name. Our guide on ways to prevent identity theft goes into each one. If you move house, set up your own mail redirection so post doesn’t sit at your old address.

If the experience has left you anxious, Victim Support offers free, confidential help to people affected by crime, including fraud.

Frequently asked questions

Where do I report identity theft in the UK?

In England, Wales and Northern Ireland, report it to Report Fraud. In Scotland, report it to Police Scotland on 101. Call 999 if a crime is happening now. Also contact your bank and any company where an account was opened in your name.

Can I freeze my credit in the UK?

Not in the way you can in the US. The closest options are Cifas Protective Registration, which prompts organizations that use Cifas to carry out extra checks, and regularly checking your reports with Experian, Equifax and TransUnion so you can dispute fraud quickly.

Is Cifas Protective Registration worth it?

It’s most useful when your details are clearly in a fraudster’s hands, for example after a stolen passport or repeated fraudulent applications. It’s a paid service and can slow down your own applications, so weigh the extra checks against the inconvenience.

Will identity fraud damage my credit score?

Fraudulent accounts and searches can affect your credit file until they’re removed. Once a lender confirms an account was fraudulent, the credit reference agencies should correct your report. Disputing quickly and keeping your crime reference number handy speeds this up.

Will my bank refund money taken by an identity thief?

If money was taken without your authorization, banks generally must refund it unless there’s evidence you acted fraudulently or with gross negligence. Report it as quickly as possible. If your bank refuses and you disagree, you can complain to the Financial Ombudsman Service.