Identity Theft Guide UK (Protect Yourself, What to Do 2026)

How Identity Theft Happens

Identity thieves obtain your personal data through a variety of methods. Phishing emails and texts — fake messages pretending to be from your bank, HMRC, or a delivery company that trick you into entering your login details or downloading malware. Data breaches — hackers break into company databases (retailers, hotels, social media platforms) and steal customer data. If you have reused passwords, one breach can compromise multiple accounts. Stolen documents — physical theft of your passport, driving licence, bank statements, or post. Dumpster diving for documents with personal information is still common. Social media oversharing — posting your full date of birth, address, holiday plans, or even your mother's maiden name gives fraudsters the pieces they need to answer security questions. Shoulder surfing — someone watches you enter your PIN at a cash machine or checkout. Fake websites and phone calls — convincing clones of legitimate sites or calls from "your bank" asking to verify your details. Card cloning and skimming — devices fitted to ATMs or payment terminals capture your card data. Once thieves have enough information, they can impersonate you across a wide range of financial and government services.

Signs Your Identity Has Been Stolen

Identity theft often goes unnoticed for weeks or months. Key warning signs include: unexpected bank transactions or withdrawals you do not recognise; credit cards or loans you did not apply for appearing on your credit report; mail stopping or going missing — a sign the thief has changed your address; letters from debt collectors about debts you do not recognise; denied credit applications despite having a good credit history; HMRC letters about employment or benefits you did not claim; your bank account is frozen or unusual activity is flagged; unexpected bills for goods or services you did not buy; your passport or driving licence renewal is refused because someone already changed the details. Check your credit file regularly with all three credit reference agencies — Experian, Equifax, and TransUnion. You can check for free via services like ClearScore, Credit Karma, or MSE Credit Club. Any unfamiliar accounts or searches may indicate identity fraud. The earlier you spot the signs, the easier it is to recover.

Protecting Your Identity — Cifas and Credit Monitoring

Taking proactive steps can significantly reduce your risk of identity theft. Cifas Protective Registration is a dedicated fraud prevention service that places a warning flag on your credit file. If anyone tries to open credit in your name, the lender will see the flag and carry out extra checks. It costs £25 for a 2-year registration and is the single most effective step you can take. Register to vote at your current address — electoral roll checks are a standard part of credit checks, and an incorrect entry can be a red flag. Use strong, unique passwords for every account and enable two-factor authentication (2FA) everywhere possible. A password manager makes this practical. Shred documents containing personal information before throwing them away. Check your credit file at least quarterly — all three agencies offer free reports. Be cautious with personal information online — do not post your full date of birth, address, or holiday plans publicly. Monitor your post — set up Royal Mail's Mail Redirection service if you move, and report missing post immediately. Keep your devices updated and use antivirus software. The Scammed? What to Do guide → has more on immediate protective steps.

What to Do If You're a Victim of Identity Theft

If you discover you are a victim of identity theft, follow these steps. Report to Action Fraud at actionfraud.police.uk or call 0300 123 2040. Get a crime reference number (NFRC) — you will need this to dispute fraudulent accounts. Contact Cifas and apply for Protective Registration if you have not already done so. Contact all three credit reference agencies — Experian, Equifax, and TransUnion — and request a notice of correction or credit freeze on your file. Ask them to flag any new applications for extra verification. Contact your bank and card providers — cancel any compromised cards, close fraudulent accounts, and request new ones. Contact the companies where fraudulent accounts were opened — tell them the accounts are fraudulent, provide your Action Fraud crime reference number, and ask them to close the accounts and remove them from your credit file. Change all passwords on your email, banking, and other key accounts. Contact HMRC if you suspect benefit fraud or employment fraud. Apply for a new passport or driving licence if the originals were stolen. Keep a detailed log of every call, email, and letter.

Recovering from Identity Theft

Full recovery from identity theft can take months or even years. Cleaning your credit file is the most time-consuming part. Write to each credit reference agency with your Action Fraud crime reference number and a list of fraudulent accounts. Under the Data Protection Act 2018, you have the right to have incorrect data corrected or removed. If a lender refuses to remove a fraudulent account, escalate via their complaints process and then to the Financial Ombudsman Service. Order new physical documents — if your passport, driving licence, or bank cards were compromised, apply for replacements. The DVLA and HM Passport Office have specific procedures for fraud victims. Monitor your accounts and credit file for at least 12 months — identity thieves often wait before striking again. Set up account alerts with your bank so you are notified of any transaction over a small threshold. Consider using a credit monitoring service — some services send alerts whenever your credit file changes. Cifas Protective Registration should remain in place for the full 2 years. Recovery is a marathon, not a sprint — stay organised and keep all documentation. See Scammed? What to Do → for emotional support options.

Identity Theft and Banking Fraud

Banks in the UK have a duty of care to protect your accounts. If identity thieves gain access to your bank account, report immediately under the CRM Code (APP scam code). Your bank should reimburse you for unauthorised transactions provided you were not grossly negligent. Unauthorised transactions — if someone takes money from your account without your permission, the bank must refund you under the Payment Services Regulations 2017 unless they can prove you acted fraudulently or with gross negligence. Authorised push payments (APP) — if you were tricked into sending money, the CRM Code applies and your bank should reimburse you in most cases. New account fraud — if a thief opens an account in your name, the bank is liable for any debt incurred. Banks use sophisticated fraud detection systems that flag unusual activity — respond promptly to any fraud alerts from your bank. If your bank refuses to refund you, complain to the Financial Ombudsman Service. Many banks now offer biometric security (fingerprint, facial recognition) which is harder for thieves to bypass.

FAQs

How do I know if someone has stolen my identity?

Check your credit file with Experian, Equifax, and TransUnion. Look for accounts you did not open, credit searches you did not authorise, or changes to your personal information. Missing post, unexpected debt collection letters, and denied credit are also indicators.

What is Cifas Protective Registration and how much does it cost?

Cifas Protective Registration adds a warning flag to your credit file that requires extra identity checks before credit is issued. It costs £25 for a 2-year registration. It is the most effective single step against identity theft in the UK.

Can identity theft affect my credit score?

Yes, severely. Fraudulent accounts, missed payments on accounts you did not open, and credit searches all damage your credit score. You can have fraudulent accounts removed by disputing them with the credit reference agencies using your Action Fraud crime reference number.

Does my bank refund me if my identity is stolen?

Yes — unauthorised transactions must be refunded under the Payment Services Regulations 2017 unless the bank can prove gross negligence. APP fraud (where you authorised the transfer) falls under the CRM Code. Always report to your bank immediately.

How can I prevent identity theft?

Use Cifas Protective Registration, check your credit file quarterly, use strong unique passwords with 2FA, shred documents, register to vote at your correct address, and be cautious about sharing personal information on social media. Never reuse passwords across important accounts.