Identity Theft: First Steps to Take When It Happens to You

You check your bank app on a Tuesday morning and something’s wrong. There’s a £480 payment to a retailer you’ve never heard of, and a credit card you definitely didn’t apply for has just appeared on your file. Your stomach drops. We’ve spoken to enough people who’ve been through this to know that moment of panic well — and our team’s view is simple: swift, structured action is what separates a manageable incident from a months-long nightmare. Here’s exactly what to do, in the order we’d do it.

Recognise the Signs: Is It Really Identity Theft?

Identity theft rarely announces itself. It usually surfaces as small oddities that don’t add up, and it often traces back to a data breach — a leaked password, a compromised retailer, a phishing email that captured your details months earlier. The signs below are the ones we see most often in the UK.

Unusual bank transactions or new accounts you didn’t open

Check statements line by line, not just the balance. Fraudsters often test with small amounts first — a £2 subscription here, a £15 top-up there — before going bigger. A hard search on your credit file from a lender you’ve never approached is another red flag: it usually means someone has applied for credit in your name.

Letters from HMRC or DVLA about changes you didn’t make

Unexpected post from HMRC about a tax code change, a refund you didn’t claim, or a self-assessment notice can indicate someone is using your details. The same goes for DVLA letters about a vehicle or licence change you never requested. Keep every letter — they become evidence later.

Credit report alerts from Experian, Equifax, or TransUnion

Experian, Equifax, and TransUnion are the UK’s main credit reference agencies, and each offers alert services. If you get a notification about a new account, an address change, or a sharp drop in your score, treat it seriously and check your full report rather than dismissing it as a glitch.

Immediate Actions: The First 24 Hours

Speed matters more than perfection here. The faster you act, the less financial damage a fraudster can do. We’d work through these three steps in parallel rather than one at a time.

Call your bank and cancel compromised cards

Ring the fraud line printed on the back of your card (not a number from an email or text). Ask them to freeze the account, cancel affected cards, and flag any transactions you don’t recognise. Under UK rules, you’re generally not liable for unauthorised transactions made after you report them — but the clock starts when you call, so call today.

Apply for a Cifas Protective Registration

Cifas Protective Registration alerts organisations to check for identity fraud when someone applies for credit using your details. It costs a small fee and lasts two years, and it’s one of the most effective single steps you can take. Lenders will still consider applications, but they’ll apply extra verification checks — which is exactly what you want while your details are in circulation.

Report to Action Fraud and get a crime reference number

Action Fraud is the UK’s national reporting centre for fraud and cybercrime. Report online or by phone, and keep the crime reference number you’re given — banks, insurers, and credit agencies will ask for it. If you’re in Scotland, report to Police Scotland instead, as Action Fraud’s remit covers England, Wales, and Northern Ireland.

Secure Your Digital Identity: Passwords and Authentication

If a breach exposed your credentials, every account sharing that password is now at risk. This is where we see people undo their own recovery — they fix the bank but leave the email account wide open, and the attacker simply resets everything again.

Update passwords on email, banking, and social media

Start with your email account, because it’s the master key for password resets everywhere else. Then work through banking, social media, and any shopping accounts holding saved card details. Use long, unique passwords — three random words plus a number beats a clever but reused one.

Turn on two-factor authentication (2FA) everywhere

Enable 2FA on every account that offers it, and choose an authenticator app or hardware key over SMS where possible. SIM-swap fraud is a real threat in the UK, and app-based codes are harder to intercept than texts.

Consider a password manager and passkeys for stronger security

A password manager generates and stores unique credentials so you never have to reuse one. Looking ahead, passkeys are a passwordless authentication method gaining traction in the UK — banks and major platforms are rolling them out, and they’re phishing-resistant by design. Setting them up now puts you ahead of the curve.

Longer-Term Recovery: Repairing Your Credit and Records

Once the immediate fire is out, the work shifts to cleaning up the damage. Fraudulent entries don’t disappear on their own — you have to dispute them, and you have to keep watching.

File disputes with Experian, Equifax, and TransUnion

Contact each of the three agencies and dispute every entry you don’t recognise. Provide your crime reference number and any correspondence from your bank. Each agency has its own process and timeline, so file with all three — a fraudulent account may only appear on one or two of your reports.

Set up ongoing credit monitoring alerts

Sign up for alerts from the agencies and check your report monthly for at least a year. Fraudsters sometimes go quiet for months before trying again, and monitoring is how you catch round two early.

Keep records of all correspondence and reports

Save every email, letter, reference number, and call log in one folder. We can’t overstate how much this helps if a lender disputes your claim or if the case goes further. A simple timeline document works wonders.

Preventing Future Identity Theft: Our Team’s Advice

Most identity theft is opportunistic, which means most of it is preventable with a few consistent habits. These are the ones we recommend to everyone, not just victims.

Shred sensitive documents and opt out of junk mail

Shred bank statements, utility bills, and anything with your name and address before binning it. You can also opt out of unsolicited credit offers through services like the Mailing Preference Service, which reduces the paper trail fraudsters love.

Spot phishing emails and smishing texts

Remember the golden rule: HMRC never asks for personal information via email or text. Nor does your bank ask you to move money to a “safe account.” Treat urgent messages with links, mismatched sender addresses, and pressure to act fast as hostile until proven otherwise — and report suspicious texts by forwarding them to 7726.

Use unique passwords and a password manager

One breach should never unlock your whole digital life. Unique passwords for every account, stored in a manager and backed by 2FA, close off the chain reaction that turns a single leak into full-blown identity theft.

• Check your bank statements and credit report monthly
• Never reuse passwords across accounts
• Enable 2FA or passkeys wherever offered
• Shred documents before disposal
• Verify unexpected HMRC or DVLA contact independently

Identity theft is stressful, but it isn’t unbeatable. Acting within the first 24 hours, locking down your digital identity, and staying vigilant with your credit file dramatically reduce the impact. If you’ve been through this yourself, we’d genuinely like to hear what worked — share your experience in the comments and help someone else facing the same morning we described at the top.

FAQ

How quickly should I report identity theft in the UK?

As soon as you suspect it. Call your bank first, then apply for Cifas Protective Registration and report to Action Fraud the same day. The faster you act, the less financial exposure you carry.

Does Cifas Protective Registration stop me getting credit?

No, but it slows things down. Lenders will apply extra identity checks before approving applications — a deliberate trade-off that makes fraud much harder while you recover.

Will I get my money back after identity fraud?

In most cases, yes. Under UK payment rules you’re generally not liable for unauthorised transactions reported promptly to your bank. Disputed credit entries are handled separately through the credit reference agencies.

Are passkeys safer than passwords?

For most people, yes. Passkeys are phishing-resistant because there’s no password to steal or reuse, and they’re increasingly supported by UK banks and major platforms as a passwordless alternative.

Can identity theft affect my credit score long-term?

It can if fraudulent entries go undisputed. File disputes with Experian, Equifax, and TransUnion promptly and keep monitoring — most victims see their file return to normal once the fraudulent accounts are removed.