Identity theft happens when someone uses your personal details, such as your name, date of birth, address or ID numbers, to pretend to be you, often to borrow money, buy goods or take over your accounts. Using those details to get money or goods is called identity fraud. Finding out it has happened to you is upsetting, and the paperwork can feel endless. The good news is that recovery follows a clear order, and most of it is free. This guide walks you through what to do today, this week and over the coming months, in the UK and the US. It is written for individuals, families, carers helping an older relative, and very small businesses. For organisations, see the Identity Fraud Prevention Guide.
Key takeaways
- Act on money first. Call your bank or card provider straight away, using the number on your card or statement.
- Report it, even if you lost nothing. A crime reference or FTC report helps you prove to lenders that a debt is not yours.
- Take back your email. Your email account is the key to resetting everything else, so secure it before the rest.
- Put warnings on your credit file. Cifas Protective Registration in the UK, or a credit freeze and fraud alert in the US, make new credit in your name harder.
- Keep a written log. Note every call, name, date and reference number. You will need them.
Signs your identity has been stolen
Often the first sign is a letter, not an alert. Action Fraud notes that the first you know of identity fraud may be bills or invoices for things you have not ordered. The FTC lists similar warning signs. Look out for:
- Bills, invoices or debt collector letters for things you never bought or debts that are not yours.
- Bills that stop arriving. Someone may have changed your address on the account.
- Payments or withdrawals you did not make on your bank or card statements.
- Accounts or credit searches you do not recognise on your credit report.
- Being locked out of email, social media or shopping accounts, or seeing security settings you did not change.
- Your phone suddenly losing signal for no clear reason, which can mean someone has moved your number to their SIM card. See the SIM Swap Fraud Guide.
Today: stop the damage
- Call your bank and card providers. Citizens Advice says to contact your bank right away if your account details or PIN might have been stolen. Use the number on the back of your card, not a number from a message. Ask them to block cards, stop payments and check for other fraud.
- Call the police if needed. Citizens Advice says to call 999 if you feel threatened, and 101 straight away if you sent money to a scammer in the last 24 hours.
- Secure your email. Change the password, turn on two-step verification, and sign out of all devices. The NCSC warns that criminals often add forwarding rules or filters to your email so they get copies of password reset messages. Check those settings and remove anything you did not create. Check the recovery phone number and backup email are yours. See the Securing Your Email Account Guide.
- Change other passwords. Change any password that may have been seen, and any account where you used the same one. A password manager makes this much easier. See the Password Managers Explained for Everyone Guide.
- If you let someone onto your computer remotely, Citizens Advice recommends resetting your passwords, telling your bank, updating your antivirus, and considering having an IT professional check the machine.
- Cancel lost or stolen documents. In the UK, GOV.UK says you must cancel a lost or stolen passport as soon as possible, using its online lost or stolen passport service. Report a lost or stolen driving licence to the DVLA, and in the US report lost ID documents to the agency that issued them.
This week: report it and get a reference number
Reporting creates an official record. Lenders, banks and credit agencies will often ask for it before removing fraudulent accounts or debts.
| Where you live | Report to | What you get |
|---|---|---|
| England, Wales, Northern Ireland | Report Fraud, online or 0300 123 2040 | A crime reference number |
| Scotland | Police Scotland on 101 | A police reference |
| United States | IdentityTheft.gov (FTC) | An identity theft report and a free personal recovery plan, with pre-filled letters for credit bureaus, businesses and debt collectors |
Action Fraud's advice is that even if your identity was stolen but you lost no money, you should still report it to the relevant organisations. In the US, the FTC's IdentityTheft.gov service lets you update your plan and track progress. Spanish speakers can use RobodeIdentidad.gov, and help in other languages is available on 877-438-4338 (press 3).
Then contact each organisation where fraud happened. Ask for the account to be closed or marked as fraud, ask for written confirmation, and ask for any debt to be removed. Do this in writing where you can and keep copies.
This month: protect your credit file
Your credit file is the record lenders check before giving credit. Putting a warning on it is one of the strongest steps you can take.
In the UK
- Check your credit reports. Action Fraud advises signing up with a credit reference agency and reporting any activity you do not recognise. The main UK agencies are Experian, Equifax and TransUnion, and each holds slightly different information, so check all three. Ask each to mark or remove anything fraudulent.
- Register with Cifas. Cifas Protective Registration costs £30 and lasts two years. It places a warning flag against your details in the National Fraud Database, so member organisations carry out extra checks when someone applies for credit in your name. Genuine applications by you may take a little longer. It does not affect your credit score, is not insurance, and Cifas says not every application will be checked. You apply online only, each person at an address applies separately, and there is no reminder when it expires.
In the US
- Freeze your credit with each of the three bureaus, Experian, TransUnion and Equifax. The FTC says freezes are free to place and lift and block new accounts being opened in your name.
- Place a fraud alert. An initial fraud alert is free, lasts one year, and asks businesses to contact you before opening a new account. Contact one bureau and it must tell the other two. You can use it alongside a freeze.
- Get your free reports weekly from AnnualCreditReport.com (or 1-877-322-8228) and dispute anything that is not yours.
For a side-by-side explanation, see the Credit Freezes and Fraud Alerts Guide.
| Option | Where | Cost | How long | What it does |
|---|---|---|---|---|
| Cifas Protective Registration | UK | £30 | 2 years | Warning flag, extra checks on applications |
| Credit freeze | US | Free | Until you lift it | Blocks new credit in your name |
| Initial fraud alert | US | Free | 1 year | Businesses must check with you first |
| Credit report checks | UK and US | Free options available | Ongoing | Spot new accounts and searches |
The months after: stay watchful
- Keep checking statements and credit reports. Cifas advises carrying on checking your credit report regularly even after registering.
- Expect follow-up scams. People who have been defrauded are often contacted again, sometimes by criminals posing as police, banks or "recovery" services offering to get money back for a fee. A genuine bank or police officer will never ask you to move money or give your PIN. See the How to Spot a Phishing Email Guide.
- Use stronger sign-in. Turn on two-step verification or passkeys for email, banking and shopping. See the Two-Factor Authentication for Everyone Guide.
- Think about paid services carefully. The FTC notes that credit monitoring and identity recovery services exist, sometimes free through your bank or employer, but that you can often do the recovery yourself at little or no cost. Identity theft insurance generally does not repay money stolen from you.
- Find out how it happened. If a company has told you your data was in a breach, follow the What to Do After a Data Breach Guide.
Helping someone else recover
Older relatives and people under stress may need a hand. Sit with them while they call the bank, help them keep the log, and check their email settings together. Citizens Advice notes that if you need to manage someone's bank account for them, they may need to sign a "third party mandate" with the bank. Never take over their passwords without their agreement.
Where to get help
United Kingdom
- Report Fraud: online or 0300 123 2040 (England, Wales, Northern Ireland). Scotland: Police Scotland on 101.
- Citizens Advice: free advice on scams, getting money back and dealing with lenders.
- Cifas: Protective Registration for people at risk of identity fraud.
- NCSC: guidance on recovering hacked accounts. Forward suspicious texts to 7726.
- HM Passport Office: cancel a lost or stolen passport through GOV.UK.
United States
- IdentityTheft.gov: report and get a recovery plan from the FTC.
- AnnualCreditReport.com: free credit reports.
- FBI IC3: report internet crime.
Common failure patterns
- Not reporting because no money was lost. Without a reference number, removing fraudulent debts later is much harder.
- Fixing the bank but not the email. If criminals still control your email or a forwarding rule, they can reset your accounts again.
- Calling numbers from the scam message. Always use the number on your card or the organisation's official website.
- Checking only one credit agency. Fraud can show on one file but not another.
- Letting protection lapse. Cifas registration does not send a reminder before it expires after two years.
- Paying a "recovery" company that contacted you. Unexpected offers to recover money are a common second scam.
Practitioner checklist
- Call your bank and card providers using the number on your card.
- Secure your email: new password, two-step verification, sign out everywhere, check forwarding rules and recovery details.
- Change any other password that may be exposed or reused.
- Cancel lost or stolen passports, licences and cards.
- Report to Report Fraud (UK), Police Scotland on 101, or IdentityTheft.gov (US) and note the reference.
- Contact each company where fraud happened and ask for written confirmation.
- Check all credit reports and dispute anything that is not yours.
- Add Cifas Protective Registration (UK) or a credit freeze and fraud alert (US).
- Keep a log of every call, letter, name and reference number.
- Keep checking statements and credit reports for the next year.
Standards and references
- FTC: What to know about identity theft
- Action Fraud: Identity fraud and identity theft
- Report Fraud: Report cyber crime and fraud
- Cifas: Protective Registration
- NCSC: Recovering a hacked account
- Citizens Advice: What to do if you've been scammed
- GOV.UK: Report a lost or stolen passport
- FTC: Free credit reports
Related NHI Mgmt Group resources: What to Do After a Data Breach Guide · Credit Freezes and Fraud Alerts Guide · SIM Swap Fraud Guide · Identity Fraud Prevention Guide