Identity Fraud UK: What to Do, How to Report, Protect Credit

If you think your identity has been stolen, contact your bank first, then report it to Report Fraud (0300 123 2040) in England, Wales or Northern Ireland, or to Police Scotland on 101 in Scotland. Next, check your credit files at Equifax, Experian and TransUnion for accounts you do not recognise, cancel any lost or stolen passport or driving licence, and consider extra protection such as Cifas Protective Registration. This page sets out each step in order, your rights over your credit files, and how the law treats identity crime.

Signs your identity has been used

Identity fraud is when someone uses your personal details to open accounts, borrow money or get documents in your name. Police Scotland describes it as personal information being stolen and used to "open bank accounts, take out credit cards and loans or apply for government benefits and documents in your name such as passports and driving licences."

nidirect lists warning signs including bank statements or a new cheque book that do not arrive when expected, bills for things you did not buy, and new credit cards appearing on your credit record. Letters about debts you do not recognise are also worth checking.

What to do, in order

1. Contact your bank

nidirect's advice is to speak to your bank or building society straight away if you think your card, online bank account or cheque book has been stolen or hacked. The bank can block cards, stop payments and flag your accounts.

If you were tricked into sending money by bank transfer, ask about reimbursement too. See APP fraud reimbursement for the rules banks must follow.

2. Report it to the police

Report Fraud is run by City of London Police and replaced Action Fraud as the national service for reporting fraud and cyber crime from 4 December 2025. You can report at reportfraud.police.uk or by calling 0300 123 2040; the phone number stayed the same. Older websites and leaflets may still say Action Fraud.

Report Fraud covers England, Wales and Northern Ireland. Its site says that if you live in Scotland or the crime happened there, you should contact Police Scotland on 101. When you report, you receive a crime reference number, which is worth keeping for dealing with lenders and agencies.

3. Check your credit files

The ICO says the three main consumer credit reference agencies in the UK are Equifax, Experian and TransUnion. Lenders may use any of them, so a fraudulent account may show on one file and not the others. Check all three.

Look for accounts, credit searches and addresses you do not recognise. nidirect's advice is that if you see information you do not recognise, contact the credit reference agency.

4. Dispute fraudulent entries

Contact the lender that opened the account in your name and tell it the account is fraudulent, giving your crime reference number. Then raise a dispute with the credit reference agency whose file shows the entry, which is the route the ICO describes.

You also have a statutory right to have wrong entries corrected, set out in the next section. If a lender accepts an account was fraudulent but refuses to remove the entry, the ICO says it may be able to look into a complaint about the fairness and relevance of that entry. The ICO adds that it cannot investigate the fraud itself.

5. Cancel lost or stolen documents

GOV.UK says you must cancel a lost or stolen passport as soon as possible, because this reduces the risk of anyone else using your passport or your identity. The online cancellation service needs a phone number.

A lost or stolen driving licence issued by the DVLA can be replaced online, and GOV.UK says a new licence costs £20. If your licence was issued in Northern Ireland, check nidirect for the Northern Ireland process.

6. Consider Cifas Protective Registration

Cifas is a not-for-profit fraud prevention organisation. Its Protective Registration service places a warning flag against your name and details in its National Fraud Database, telling organisations that use Cifas data to take extra care when your details are used in an application.

According to Cifas, it costs £30 for two years, you can apply only through its online form, and each person at an address must apply separately. Cifas says it does not affect your credit score, is not insurance against fraud losses, and not every application will be checked against it. It is a private service; we found no government page directing victims to it.

7. Deal with stolen post

If you think your post has been intercepted or stolen, nidirect's advice is to contact Royal Mail.

Your rights over your credit files

For an individual, the route to see what an agency holds is the data protection right of access, and it is free. The Consumer Credit Act route is narrower.

The ICO says you can ask any credit reference agency for the information it holds about your financial standing, that this is free, and that you can ask verbally or in writing. That is your data protection right of access; see our subject access request guide for how it works.

Section 158 of the Consumer Credit Act 1974 requires an agency, on a written request and "a fee of £2", to give a copy of the file, but since 2007 section 158(4A) limits that right to partnerships of two or three people and other unincorporated bodies. Individuals use the free right of access instead, and the ICO says you do not need to pay a fee for a statutory report. Some older pages, including nidirect, still say a statutory credit report costs £2.

Section 159 is the correction right. If you think an entry is wrong and you are likely to be prejudiced if it is not corrected, you can give the agency notice requiring it to remove or amend the entry. The agency has 28 days to tell you what it has done.

Unless the entry has been removed, you then have a further 28 days to require the agency to add a notice of correction of up to 200 words, written by you, to your file. If the agency does not confirm in time, or thinks the notice is incorrect, defamatory, frivolous or otherwise unsuitable, you or the agency can apply to the relevant authority under section 159(5), which for an individual is the Information Commission (section 159(8)). For an individual, the section 159 right applies to information obtained through a UK GDPR access request.

If your details were exposed in a company's data breach, you may also have rights against that company. See data breach compensation and our UK GDPR guide.

Is identity theft a crime?

The law in the UK does not have a single offence called identity theft. The conduct is prosecuted through other offences, and which ones apply depends on where in the UK it happened.

Using someone else's details to open an account or obtain credit will usually be fraud by false representation. The Fraud Act 2006 extends to England, Wales and Northern Ireland only (section 15). Scotland prosecutes fraud under its own law, and the Fraud Act offences do not apply there.

The Identity Documents Act 2010 extends to the whole UK. It covers having false, improperly obtained or another person's identity documents, such as a passport or driving licence. For more on charges and sentencing, see fraud offences.

Support for victims

Victim Support offers free, confidential support after crime. Its Supportline is 08 08 16 89 111 and is free and open 24 hours a day, every day. Victim Support covers England and Wales; Scotland and Northern Ireland have their own separate victim support organisations.

In England and Wales, the Code of Practice for Victims of Crime sets the minimum standards that organisations such as the police must give victims of crime. It applies in England and Wales only; Scotland and Northern Ireland have their own arrangements.

Identity fraud often comes with debts you never ran up. If letters or demands arrive, do not ignore them; tell the creditor in writing the debt is not yours and give your crime reference number. Our debt collection guide explains your rights with collectors. More privacy guides are on the UK data privacy hub.

Frequently Asked Questions

What should I do first if my identity is stolen?

Contact your bank or building society straight away if any card, account or cheque book may be compromised. Then report the fraud to Report Fraud on 0300 123 2040 or at reportfraud.police.uk in England, Wales and Northern Ireland, or to Police Scotland on 101.

Is Action Fraud still running?

No. Report Fraud, run by City of London Police, replaced Action Fraud from 4 December 2025. The phone number, 0300 123 2040, stayed the same, and old Action Fraud web traffic is being redirected to Report Fraud.

How do I check if someone has used my identity for credit?

Check your credit files at all three main agencies: Equifax, Experian and TransUnion. Look for accounts, searches and addresses you do not recognise, and contact the agency about anything you do not recognise.

Is it free to see my credit file?

The ICO says requesting your information from a credit reference agency is free under data protection law. The £2 statutory file under section 158 of the Consumer Credit Act 1974 applies only to small partnerships and unincorporated bodies, not individuals.

How do I get a fraudulent account removed from my credit file?

Tell the lender the account is fraudulent and give your crime reference number, then raise a dispute with the credit reference agency. Under section 159 of the Consumer Credit Act 1974 you can require the agency to remove or amend a wrong entry, and it has 28 days to respond.

How much is Cifas Protective Registration?

Cifas says it costs £30 for two years. You apply online only, each adult at an address applies separately, and it does not affect your credit score.

Is identity theft a criminal offence in the UK?

There is no offence with that name, but the conduct is usually charged as fraud under the Fraud Act 2006 in England, Wales and Northern Ireland, with a maximum of 10 years on indictment, or under the Identity Documents Act 2010 across the UK. Scotland uses its own law for fraud.

What do I do if my passport has been stolen?

GOV.UK says you must cancel a lost or stolen passport as soon as possible to reduce the risk of anyone using it or your identity. You can cancel it online.

Can I get help as a victim of identity fraud?

Yes. Victim Support offers free, confidential help on 08 08 16 89 111, 24 hours a day. In England and Wales the Victims Code sets minimum standards for how you should be treated.