See how we helped Liz

"It's not just a website... there are people there on call who can help answer your queries."

Liz W, London

If you're a victim of identity theft

If you're a victim of identity theft

Related services

If you have been a victim of identity theft, you will not have to pay for any money you have lost, unless it can be shown that you have acted fraudulently or without reasonable care, for example, by keeping your PIN written down with your card. However, you must act quickly.

Contact your bank and police

You should contact your bank and make sure that they are aware that you have been the victim of identity theft and that no payment is to be made in relation to any fraudulent contract. If you have found out about the identity theft because a payment has already been made from your bank account, then you should contact your bank and request that the money be refunded. Please note that your bank may request that you report the matter to the police.

Even if your bank does not request that you report the identity theft to the police, you may want to do so anyway.

Contact the defrauded company

If you are receiving unexplained bills or requests for money, you will want to contact the company that has been defrauded and explain to them that you have been the victim of identity theft. You should do this in writing and should also request that they send you further details regarding the transaction so that you can pursue the matter further, if necessary.

If you receive a satisfactory response

If the organisation you have contacted confirms that it will cancel any contract that has been fraudulently created in your name, and that no payment will be taken from you, you will want to contact your bank and/or police and pass on this information. You will then want to request your credit files to find out whether there is any bad data on your file due to the identity theft.

If you receive an unsatisfactory response

If you have not already reported the matter to your bank and/or police, you should definitely do so now. You should also:

1. Send a follow-up letter to the defrauded organisation using any evidence that they have provided to you when you requested further details of the alleged transactions.

2. Seek legal advice.

3. Request your credit files.

Request your credit files

After contacting the necessary organisations, you will want to request your credit files to check if there is any bad data on your credit file as a result of the identity theft. You will be able to find out more information on this process and what follow-up steps to take by reading How to improve your credit rating.

Since there are 3 credit reference agencies in the UK, and they don't communicate with each other, it is possible they may hold differing data about you. If you need to correct inaccurate data concerning yourself, it is necessary to write to all of them asking for a copy of your credit file. The Statutory Credit Report is posted out to you by each agency within 7 working days of receipt of your request.

Interpreting credit reports

Once you have received your Statutory Credit Reports (SCR) you will need to review them. The credit reference agency will not change any information they hold about you if it is correct. However if any information is incorrect, there are procedures that you can use to correct it. See our article on How to improve your credit rating for details. The credit reference agencies will send you notes with your SCRs to help you understand the reports. Your SCRs are compiled by credit reference agencies using information from 2 main sources:

  • The public record: e.g. electoral roll information, court judgments, individual voluntary arrangements and bankruptcies.
  • Information provided by lenders and financial institutions: e.g. credit accounts, credit applications and financial associations.

If you find the credit account section of the report has loans, credit cards or credit accounts in the name of someone you believe has used your name fraudulently, you have probably been the victim of identity theft. You should take immediate steps to correct your record.

If you have not been a victim of identity theft, you may still find that there is incorrect information on your record, or details of people you have no connection to. Or you may wish to lodge an explanation of the reasons for certain entries so lenders can take it into account when making their lending decisions. Incorrect information in these SCRs can be corrected by the service of a notice of disassociation, a notice of correction or a notice of dispute. See our article on How to improve your credit rating for details. Once served with a suitable notice, each agency has up to 28 days to respond appropriately.

Additional proof

If your identity has been stolen and misused by a criminal, you sometimes have to prove to a lender that you are the innocent victim of identity theft. To do this you need to re-establish your identity and prove you are who you say you are. This process is not straightforward if, for example, the thief has been using your passport or driving licence details, and neither of these documents has been reported as being stolen. The use of circumstantial or alibi evidence may be required to show that your identity has been misused.

Future protection with CIFAS registration

The Credit Industry Fraud Avoidance System (CIFAS) is a UK fraud prevention service. If, after your identity has been stolen, you ask for a Protective Registration from CIFAS, a warning will be recorded on the CIFAS database for your protection. Thereafter, whenever you seek credit, the lender or insurance provider will see the message "CIFAS-DO NOT REJECT-REFER FOR VALIDATION" and will make further enquiries.

CIFAS Protective Registration is available for a small fee. As a result of the entry, the lender or insurance provider will verify further the identity of an applicant, and in some cases request further proof of identification. A CIFAS Protective Registration may mean that you and members of your household experience delays while your credentials are fully checked out. But you may feel that it is worth these delays for the additional protection CIFAS Protective Registration gives you against repeated identity theft.