Identity Theft UK: Warning Signs & What to Do

If your identity has been stolen, acting on the right signs fast matters more than panicking.

By Alex Bacsa · Published 2026-06-14 · Updated 2026-07-05 · 5 min read

How your details actually get stolen

Identity theft is when someone gets hold of enough of your personal information — your name, date of birth, address, or National Insurance number — to pretend to be you.

It usually starts one of a few ways: a data breach at a company you use, exposing your details; a phishing email or text that tricks you into typing them in yourself; post or discarded documents (old bank statements, bills, a lost passport or driving licence) giving away enough to pass basic checks; or details shared publicly on social media, like a full name, date of birth and address in one place.

Once someone has enough details, they don't need to hack anything else — they can use what they have to apply for credit, open accounts, or claim services in your name.

Why it's often invisible at first

Identity theft is rarely obvious straight away. The criminal usually arranges for statements, cards or confirmation letters to go to an address you don't control, so you have no reason to notice anything is wrong. Most victims find out weeks or months later — when they're refused credit unexpectedly, chased for a debt they don't recognise, or spot something odd on their credit file. That gap between the theft and you noticing is exactly what makes it worth checking proactively rather than waiting for a problem to appear.

Warning signs your identity may have been stolen

• Post you'd expect — bank statements, bills, renewal notices — suddenly stops arriving.
• You're refused credit, or your credit score drops, despite no missed payments or new borrowing.
• You see a credit search, account, or credit card on your file that you don't recognise.
• You receive bills, invoices, or debt-collection letters for something you never bought or agreed to.
• You're contacted about a benefit claim, phone contract, or loan you never applied for.

How the fraud actually plays out

First, a criminal gets hold of enough of your details through a breach, phishing message, stolen post, or oversharing online. Second, they use those details to apply for credit, open a new account, or claim a service in your name — often somewhere you've never dealt with, so there's no existing relationship to raise suspicion. Third, correspondence about it goes to an address or contact detail the criminal controls, not yours, so it can run for a while unnoticed.

Fourth, you typically find out only when something breaks the pattern: a credit application of your own is refused, a debt collector gets in touch, or you check your file and see something you don't recognise.

How to check whether your identity has been compromised

You have a statutory right to a free copy of the basic report each UK credit reference agency holds on you.

• Check your file with all three UK credit reference agencies — Experian, Equifax, and TransUnion — since lenders don't all report to the same one.
• Look specifically for credit searches, accounts, or agreements you don't recognise, not just a lower score.
• If you've lost a passport, driving licence, or other ID document, or been told you were involved in a data breach, treat that as a reason to check now rather than waiting for a problem to surface.
• Consider Cifas Protective Registration — for £30 over 24 months, it flags your details so Cifas member organisations run extra checks before approving credit or accounts in your name. It can make your own genuine applications take slightly longer, which is the trade-off for the extra check.

If you think you're already a victim

Contact any lender, bank, or organisation shown on your credit file that you didn't apply to, and dispute the account or search directly with them. Check your file with all three credit reference agencies if you haven't already, and consider Cifas Protective Registration so further attempts are harder. If a specific company's data breach looks like the cause, you can also raise it with the Information Commissioner's Office (ICO), which requires organisations to assess the risk, report likely-risk breaches to the ICO, and notify affected people without undue delay where the risk is high.

Keep a record of everything — dates, reference numbers, and copies of any letters — since you'll need these when disputing accounts or debts.

How to report identity theft (UK)

Report it to Report Fraud at reportfraud.police.uk or 0300 123 2040 if you are in England, Wales, or Northern Ireland. In Scotland, report to Police Scotland on 101. If a phishing email started it, forward it to report@phishing.gov.uk; if it arrived by text, forward it to 7726. The Citizens Advice consumer service in England and Wales (0808 223 1133) can also help you understand your rights and the next steps if accounts or debts have already been opened in your name.

Frequently asked questions

Reporting routes in this guide are checked against our verified canon of official UK sources — Action Fraud, the National Cyber Security Centre, and Citizens Advice — by an automated accuracy gate before publication. Fact-checked and updated by Alex Bacsa, Founder & Editor, on 2026-07-05. Read about how Beat the Scam writes guides.