How to Protect Yourself From Identity Theft

What Identity Theft Is and How It Happens

Identity theft occurs when someone uses your personal information without your consent, typically to obtain credit, services, or money. It affects hundreds of thousands of people in the UK annually and the consequences, including damage to credit rating, financial loss, and the time required to resolve it, can be severe and long-lasting.

Personal information reaches fraudsters through multiple routes. Data breaches at companies that hold your information (your bank, a retailer, a health service) expose personal data that is then sold on criminal forums. Phishing attacks trick people into voluntarily sharing information with fraudsters. Mail theft can provide access to bank statements, utility bills, and other documents containing personal information. Social media oversharing provides fragments of information that can be combined with data from other sources to build a usable profile. And some identity theft comes from people known to the victim, including family members.

What Fraudsters Do With Your Identity

With sufficient personal information (name, date of birth, address, and in some cases national insurance number or financial account details), a fraudster can open credit accounts in your name, take out loans, apply for new payment cards on existing accounts, redirect mail to a different address, apply for state benefits, and in some cases obtain a passport or driving licence. The victim often does not discover this until they are refused credit, begin receiving letters about accounts they did not open, or notice unexplained entries on their credit report.

Protecting Your Personal Information

Your name combined with your date of birth and current address is the core of your personal identity for most financial purposes. Protecting this combination is the foundation of identity theft prevention. Your date of birth should not appear on public social media profiles. Your address should not be casually shared or posted publicly. The combination of the two is more sensitive than either individually.

National insurance number, passport number, and driving licence number each provide additional identity verification capability and should be treated as sensitive information. Store physical documents containing these in a secure location at home, and digitise and store them securely in an encrypted format rather than in an email to yourself or a notes app.

Shred documents containing personal information before disposing of them. Bank statements, utility bills, and any correspondence containing your name, address, and account numbers should be shredded rather than put in the recycling. Identity theft from physical documents is less common than digital routes but remains a real risk.

Register with Royal Mail Redirection when you move home, and then after the redirection period ends, follow up with all organisations you have accounts with to ensure your address is updated. Mail going to your previous address is a persistent route for identity theft that many people overlook.

Check Your Credit File Regularly

Your credit file is the most reliable way to detect identity theft early. In the UK, the three main credit reference agencies are Experian, Equifax, and TransUnion (formerly Callcredit). You are entitled to see your statutory credit report from each of these for free. Checkmyfile.com provides a combined report for a small monthly fee (with a free trial period).

Look at your credit file at least once a year, and more frequently if you have reason for concern. Check for credit accounts, searches, or linked addresses you do not recognise. Unexplained searches or accounts are the key warning signs of identity theft in progress.

Additional Protective Measures

Registering with CIFAS protective registration (cifas.org.uk) places a marker on your credit file that tells lenders to take additional steps to verify identity before approving any credit in your name. It costs a small annual fee and is worth considering if you have been a victim of identity fraud or are at particular risk. The additional verification does mean that your own genuine credit applications will take longer to process.

Use unique, strong passwords for each financial account and enable two-factor authentication on your banking and email accounts. Your email account is particularly important: it is often used for password resets and accessing other accounts, making it the highest-value target for access.

If You Are a Victim

If you discover that your identity has been used fraudulently: report to Action Fraud (0300 123 2040) immediately. Contact your bank and any affected financial institution. Contact all three credit reference agencies to place a fraud alert or protective registration on your file. Report to the CIFAS National Fraud Database through your bank or directly.

Keep detailed records of everything: when you discovered the fraud, who you have reported to, the responses you have received, and the amounts involved. Recovery from identity theft requires systematic persistence in contacting institutions and agencies: the process is frustrating but the steps are well established and resolution is achievable. Cifas and Action Fraud can both provide guidance on next steps specific to your situation.