Identity theft in the UK: how to protect yourself — and what to do if it happens

Identity theft is when your personal details — name, date of birth, current or previous addresses — are stolen; identity fraud is when someone uses them, Report Fraud explains. A fraudster can then open bank accounts, take out credit cards, loans and phone contracts, claim benefits or take over your accounts. Often the first sign is a bill for something you didn't order, or a debt collector's letter.

It is the most common fraud Cifas members report: more than 242,000 identity fraud cases were recorded to the National Fraud Database in 2025, 54% of the total (Fraudscape 2026, March 2026), and nearly 130,000 in the first half of 2026 alone, up 9%.

Free steps that make identity theft harder

• Shred anything with your name, address or financial details, and keep your passport, driving licence and statements somewhere safe. Report Fraud says identities are often stolen from people's rubbish.
• Never give your full password, PIN or login details to anyone who contacts you; your bank will never ask for your PIN. If a call worries you, wait five minutes and call your bank from a different phone.
• Use a different password for every account. The ICO suggests a password manager.
• Only give your National Insurance number to organisations that need it, such as HMRC, your employer or the DWP. It stays the same for life.
• When you move, give your bank and other providers your new address, have Royal Mail redirect your post for at least a year, and check your credit file two to three months later.
• Check your statements, and tell your bank if one doesn't arrive.

There's no credit freeze in the UK — use these instead

The UK has no free statutory credit freeze. The official options are these:

Look for 'statutory report' on each agency's website; the ICO says there's no fee. TransUnion says you can request it as often as you like without leaving a footprint lenders can see, and the three agencies can hold different information, so check all of them. Cifas says Protective Registration isn't insurance and doesn't cover card transactions; each person applies separately, online, and it is most effective in the first months after your details are lost.

Warning signs of identity theft

• Post from your bank or utility company stops arriving, or your passport or driving licence goes missing.
• Payments you don't recognise on a statement, or bills and debt collectors' letters for things you never ordered.
• Credit or searches on your credit report that you don't recognise, or a falling credit rating although you haven't missed a payment.
• Being refused credit despite a good rating, or told you're already claiming benefits.
• Sign-in codes you didn't ask for, or a phone that suddenly can't make calls or send texts — signs of a SIM swap, which Cifas says rose 402% in the first half of 2026 compared with a year earlier.

If your identity is stolen: what to do

1. Call your bank on the number on your card, or on 159, and ask it to hold pending transactions and explain its claims process.
2. Change your passwords and PINs, including for email and social media.
3. Report lost or stolen documents to whoever issued them. Cancel a passport on GOV.UK as soon as possible (Passport Adviceline: 0300 222 0000). If your driving licence was stolen, tell the police and replace it through the DVLA; Northern Ireland has its own service.
4. Report it to Report Fraud online or on 0300 123 2040 if you live in England, Wales or Northern Ireland. You'll get a crime reference number and can ask to be referred to Victim Support. In Scotland, call Police Scotland on 101.
5. Get your statutory credit reports and report applications you don't recognise to the agency; the lender investigates and removes them, which can take several weeks. The agencies' Victim of Fraud teams share information, so telling one should be enough, the ICO says.
6. If credit was taken out in your name, tell the lender straight away and report it to the police.
7. If someone got into your HMRC online account, report it through the account's security console or HMRC's online form. HMRC aims to contact you within 10 working days.
8. Consider Protective Registration or a Notice of Correction. If an organisation has already flagged the fraud, 'Victim of Impersonation' may appear on your file; Cifas says this prompts lenders to make extra checks for 13 months.

If a bank or lender won't put things right

Complain to the firm first: for fraud complaints it must get back to you within 15 days and send a full response within 35. After that, the Financial Ombudsman Service — free, online or on 0800 023 4567 — can look at how a bank or lender handled identity theft, such as a loan taken out in your name or a wrongly placed fraud marker. You normally have six months from the final response. If a lender admits an account was fraudulent but won't remove it from your file, you can complain to the ICO. Beware anyone offering to recover your money for a fee: Stop! Think Fraud says genuine agencies never charge.

Can security software help?

Partly. Experian lists hacking and phishing emails that install malware among the ways details are stolen, and Citizens Advice says to update your anti-virus software if a scammer has had access to your computer. A security suite covers that online side, but it can't stop someone going through your bin or clear a fraudulent account from your credit file — the steps above do that. Nor do you need paid credit monitoring: the ICO notes that you never have to subscribe to see your file.

There's no freeze switch in the UK, but your statutory credit reports are free. Check them, call your bank fast, and get a crime reference number.