Identity theft in the UK: what to do and how CIFAS protective registration works

Having your identity stolen can feel overwhelming, but the steps are fairly clear. This guide follows the Information Commissioner's Office (ICO), the UK data protection regulator, for what to do, and Cifas, the UK fraud prevention service, for protective registration. One point matters from the start: the ICO says it cannot deal with cases of identity theft itself.

What identity theft is

The ICO says identity theft happens when your personal information, such as your name, date of birth, or current or previous addresses, is stolen and used by someone else to impersonate you. It can happen whether the victim is alive or deceased. If your identity is stolen, this can lead to identity fraud, and the ICO says you may lose money or find it difficult to get loans, credit cards or a mortgage.

Signs you may be a victim

The ICO lists these signs:

• Important documents, such as your passport or driving licence, have been lost or stolen.
• Mail from your bank or utility provider does not arrive.
• Items you do not recognise appear on your bank or credit card statement.
• You apply for state benefits but are told you are already claiming.
• You receive bills or receipts for goods or services you did not ask for.
• You are refused financial services, a credit card or a loan despite having a good credit rating.
• You receive letters from solicitors or debt collectors for debts that are not yours.
• Your credit rating goes down even though you have not missed payments.

One sign on its own does not prove anything. It is a reason to check.

What to do if you are a victim

The ICO says to act quickly, to limit the impact and prevent further losses:

1. Report all lost or stolen documents that carry personal information, such as passports, driving licences, credit cards and cheque books, to the organisation that issued them.
2. Tell your bank, building society and credit card company about any unusual transactions.
3. Request a copy of your credit file to check for suspicious credit applications.
4. Report the theft of documents and suspicious credit applications to the police, and ask for a crime reference number.
5. Contact Cifas to apply for protective registration.

If you lost money, the NCSC gives Report Fraud as the place to report: reportfraud.police.uk or 0300 123 2040 in England, Wales or Northern Ireland, and Police Scotland on 101 in Scotland. The ICO also lists the Financial Ombudsman Service, the Home Office identity theft victims' checklist, and Report NHS Fraud for England and Wales.

How Cifas protective registration works

Cifas says that when you request protective registration, it places a warning flag against your name and personal details in its National Fraud Database. Organisations that use Cifas data then pay special attention when your details are used to apply for their products or services, and carry out extra checks to make sure it is really you.

• Cost and length. £30 for two years, applied for online only. Cifas does not take applications by telephone.
• Who it is for. Individuals only, not organisations. Each person at an address who wants protection must apply separately, and you must live at the address you register. Cifas says it is for people whose identities are at heightened risk.
• Credit score. It does not affect your credit score.
• Limits. It is a fraud prevention measure, not insurance against losses. It does not cover transactions on products already running, and not every application will be checked, so keep checking your credit report. Genuine applications may take slightly longer while checks are carried out.
• Changes and renewal. You can update your details or ask for removal at any time. The registration lasts 24 months, with no email on expiry. To renew you reapply.
• Timing. Cifas says protective registration is most effective in the first few months after your personal data is lost, because fraudsters try to gain the maximum benefit before the fraud is detected.

The ICO describes the effect in similar terms: once you have registered, Cifas members carry out extra checks whenever anyone, including you, applies for a financial service such as a loan using your details.

Reducing the risk before anything happens

The ICO also gives advice for before a problem:

• Keep documents such as your driving licence, passport, bank statements and utility bills in a safe place, and shred old ones.
• Use a password manager to keep passwords in one place.
• Regularly check card and bank statements and monitor your credit report.
• When you move house, give your new address to your bank, card providers, mobile provider and utilities, and consider redirecting your post through Royal Mail.
• Share less. The less you give away about yourself, the lower the risk.
• Be wary of unexpected emails, calls or messages asking you to confirm personal information. If unsure, give nothing and contact the organisation using details you already hold. See our guide to spotting phishing.
• Before buying online, use a secure website that shows the company's contact details, look for a padlock and a clear privacy and returns policy, and check the address starts with https.

What these pages do not cover

The ICO and Cifas pages do not say how long a credit file or a Cifas registration takes to process, and do not explain what happens after you receive a crime reference number. For those details, go to the organisations named above.

Seeing what is visible about you

Remove Me offers a free analysis with no account. It searches publicly visible web results, known public data breaches (Have I Been Pwned) and a register of data brokers, then shows a report unlocked with a 6-digit code sent to your e-mail. It cannot tell you whether your identity has been stolen and does not yet send erasure requests on your behalf. Run my free scan.

Sources

• ICO, Identity theft
• Cifas, Protective Registration
• NCSC, Report a scam phone call

Related reading: what to do after a personal data breach.