Identity Theft UK: How It Happens, Warning Signs, and What to Do
Identity theft occurs when someone uses your personal information (name, date of birth, address, National Insurance number) to commit fraud in your name. In the UK, CIFAS registered 232,959 identity fraud cases in 2023, making it the most common form of fraud in the country. This guide explains how it happens, the warning signs to watch for, and exactly what to do if you become a victim.
Act quickly if you suspect identity theft
The longer identity fraud goes undetected, the more accounts can be opened in your name and the harder it is to unravel. If you see any warning signs, act immediately: do not wait to see if it resolves itself.
How Criminals Steal Your Identity
Data breaches
When companies you use are hacked, your name, email, passwords, and sometimes financial data leak online. Criminals buy these lists and use them to access accounts.
Phishing emails
Criminals send fake emails from HMRC, your bank, or Royal Mail to steal your login credentials or get you to enter financial details on a fake website.
Mail theft
Bank statements, credit card offers, and DVLA documents contain enough personal information to open accounts in your name. Criminals also redirect post using Royal Mail's redirection service.
Social media oversharing
Date of birth, hometown, school, and pet names published on social media are commonly used as security question answers, or to socially engineer your contacts.
SIM swapping
Criminals convince your mobile network to transfer your phone number to a SIM they control. This lets them bypass SMS two-factor authentication on your bank and email accounts.
Warning Signs of Identity Theft
What to Do If You Are a Victim
- 1Report to Report Fraud immediately: call 0300 123 2040 or report online at reportfraud.police.uk. Get a crime reference number.
- 2Contact your bank and any lender involved: report the fraud, close compromised accounts, and open new ones with new details.
- 3Add a CIFAS protective registration: CIFAS is the UK's fraud prevention service. A protective registration adds a warning flag to your credit file so lenders take extra steps to verify applications in your name. Costs £25 and lasts 2 years.
- 4Contact the three UK credit reference agencies (Experian, Equifax, TransUnion): place a fraud alert on your file and check for accounts you did not open.
- 5Check your credit file for fraudulent accounts: dispute any you find directly with the credit reference agency. They are required to investigate within 28 days.
- 6Change passwords on all accounts, starting with email and banking: enable two-factor authentication everywhere.
- 7Report to the DVLA if driving licence details were stolen, and to HMRC if National Insurance or tax details were involved.
How to Protect Yourself
Get your personalised security checklist. Free.
Cyber Nova AI gives you a prioritised checklist based on your specific situation, covering the steps that most effectively prevent identity theft and account takeover.
Start for free →Related guides
Frequently asked questions
How do I know if my identity has been stolen?
Common signs include: receiving credit cards or loan documents you did not apply for, unexplained entries on your credit report, being refused credit for no apparent reason, bills or statements for accounts you do not recognise, missing post (criminals redirect post to intercept documents), and unfamiliar transactions on your bank accounts.
How long does it take to recover from identity theft?
Recovery from identity theft can take months or years, depending on what the criminal did with your identity. Simple account takeovers (a fraudster using your credit card number) can be resolved in days with your bank. Full identity fraud (where someone takes out loans and credit in your name) can take 12–18 months to fully resolve and requires working with CIFAS (the UK's fraud prevention service), the credit reference agencies, and potentially the courts.
Should I pay for identity theft protection services?
Many identity theft protection services (credit monitoring, dark web scanning) are available free from UK credit reference agencies (Experian, Equifax, TransUnion) and services like Have I Been Pwned. Paid services offer broader monitoring and recovery support, useful if you have already been a victim or handle high-value transactions. Weigh the cost (£8–£25/month) against the free alternatives before subscribing.