Identity fraud is the UK's most common fraud type. According to Cifas, the UK's leading fraud prevention service, identity fraud involving victims under 21 increased by 8% in 2026, while overall identity fraud continues to rise year-on-year. When it happens, the speed of your response directly determines how much damage is done to your credit file, your finances, and your ability to borrow.
This guide provides a precise, hour-by-hour action plan for the first 24 hours after discovering that your identity has been used fraudulently. Every step is based on guidance from Action Fraud, Cifas, the ICO, and the three UK credit reference agencies.
Warning Signs That Your Identity Has Been Stolen
- Unexplained hard searches appearing on your credit file
- Welcome letters or statements for accounts you never opened
- A sudden, unexplained drop in your credit score
- Debt collection letters for debts you do not recognise
- Being declined for credit despite having a good score
- Addresses you have never lived at linked to your credit file
Hour 1: Contact Your Bank and Freeze Your Accounts
Your first call must be to your bank or card provider. Most UK banks have 24-hour fraud lines. Ask them to freeze your accounts immediately, reverse any fraudulent transactions, and issue new cards. Under the Payment Services Regulations 2017, you are not liable for unauthorised transactions provided you report them promptly and have not acted negligently. Keep a note of the time you called and the name of the person you spoke to.
If the fraud involves a credit card, contact the credit card provider separately. If it involves a loan or mortgage taken out in your name, contact that lender's fraud department directly. You are not liable for debts taken out fraudulently in your name, but you must report them formally to establish that fact.
Hour 2: Report to Action Fraud
Action Fraud is the UK's national reporting centre for fraud and cybercrime. Report identity theft online at actionfraud.police.uk or by calling 0300 123 2040. You will receive a crime reference number, which is essential for your records and for any subsequent disputes with lenders or credit agencies.
Action Fraud passes reports to the National Fraud Intelligence Bureau, which analyses patterns and coordinates with police forces. Reporting does not guarantee a police investigation, but it creates an official record that you were a victim and that the debts were not incurred by you.
Hour 3: Contact All Three Credit Reference Agencies
Contact Experian, Equifax, and TransUnion separately to report the fraud. Each agency holds different data and each must be notified independently. Ask them to place a Notice of Correction on your file explaining that you have been a victim of identity fraud. This notice is legally required to be read by any lender before making a credit decision, which prevents further fraudulent applications from being automatically approved.
Request your free statutory credit report from each agency at the same time. Review every entry carefully for accounts, hard searches, or addresses you do not recognise. Dispute any fraudulent entries immediately — the agency has 28 days to investigate and must remove entries that cannot be proven accurate.
Hour 4: Register with CIFAS Protective Registration
Cifas Protective Registration costs £30 for two years and places a warning flag on your credit file. When a lender sees this flag, they are legally required to carry out additional identity verification before approving any credit application in your name. This does not lower your credit score and does not affect legitimate applications — it simply requires the lender to do more checks.
Register at cifas.org.uk/pr. The registration typically takes effect within 24 hours. If you have already been a victim of fraud, Cifas may also place a "Victim of Impersonation" marker on your file, which performs a similar protective function for 13 months at no cost.
Within 24 Hours: Full Credit File Review
Once the immediate protective steps are complete, conduct a thorough review of your credit file at all three agencies. Look specifically for hard searches you did not authorise, accounts opened in your name, addresses linked to your file that you have never lived at, and any financial associations with people you do not know.
Change all passwords for financial accounts, email, and any service that holds your personal data. Enable two-factor authentication on every account that supports it. If you believe your mail has been stolen or redirected, contact Royal Mail Customer Care on 08457 740 740.
Ongoing: Monitor Your Credit File
Identity fraud often involves multiple fraudulent applications made over a period of weeks or months. Set up free credit monitoring through ClearScore or Credit Karma to receive instant alerts when new hard searches or accounts appear on your file. CheckMyFile monitors all three agencies simultaneously and offers a 7-day free trial.
Continue checking your file weekly for at least three months after the initial fraud is discovered. Report any new fraudulent entries immediately using the same process above.
| Action | Contact | Timeframe |
|---|---|---|
| Freeze accounts and report fraud | Your bank fraud line | Hour 1 |
| Report to Action Fraud | 0300 123 2040 or actionfraud.police.uk | Hour 2 |
| Notify all 3 credit agencies | Experian, Equifax, TransUnion | Hour 3 |
| Register CIFAS Protective Registration | cifas.org.uk/pr — £30 for 2 years | Hour 4 |
| Full credit file review and password changes | All 3 agencies + all financial accounts | Within 24 hours |