Discovering that someone has used your identity can leave you facing unfamiliar debts, rejected credit applications or missing money. Identity theft victim rights in the UK provide ways to challenge transactions and records you never authorised. The key is knowing who can fix what: police record the crime, lenders investigate disputed borrowing, and credit reference agencies help correct inaccurate files.
Act quickly, but remember that a crime reference number alone will not clear your name. Recovery often involves several processes at once.
What rights do victims of identity fraud have?
If a fraudster takes out a loan in your name without your agreement, you generally should not be held responsible. A lender must investigate whether you consented; your name appearing on an application does not, by itself, establish that you did.
Different rules apply when money is taken from an existing bank account. Unauthorised transactions normally attract strong refund protections, although circumstances matter if a bank alleges customer fraud or gross negligence. Being tricked into sending money yourself is a different scam with separate reimbursement rules.
You also have rights concerning inaccurate personal data, including fraudulent entries on a credit file. None of these protections guarantees instant resolution.
Secure your accounts before the damage spreads
Start with your email account, which may control password resets elsewhere. Change its password using a trusted device, enable multi-factor authentication, and check recovery addresses, forwarding rules and recent sign-ins. Then secure banking and mobile-provider accounts.
Contact your bank through its official app or website, never through a number in a suspicious message. Ask for compromised cards or credentials to be blocked and flag any payments you did not authorise.
If documents or a phone were stolen, inform the relevant providers. Ask your mobile provider about unauthorised SIM changes. Keep screenshots, letters, transaction dates and reference numbers in one folder.
Report the fraud to the right authority
In England, Wales and Northern Ireland, the national police reporting service is Report Fraud, which replaced Action Fraud in December 2025. In Scotland, report fraud to Police Scotland, including through 101 where appropriate. Call 999 if there is immediate danger.
Describe affected organisations, suspicious applications and financial losses. Save the report reference and share it with lenders when requested. Reporting may help an investigation, but it does not automatically cancel a loan, remove a default or guarantee reimbursement.
Challenge loans and debts you never agreed to
For a fraudulent credit dispute, contact the lender and say clearly that you did not apply for, sign or authorise the agreement. Ask its fraud team to investigate, pause collection while reviewing the dispute and explain the evidence used to approve the application.
Imagine discovering a £4,000 loan after a debt collector writes to your home. Rather than paying an instalment just to stop the letters, dispute the account in writing with the original lender. Tell the collector the debt is contested. Include when you discovered the loan and your police report reference, if available. Request written confirmation of the outcome.
Never ignore court papers or legal deadlines. A disputed debt may still require a timely response. For related guidance, see our explanation of how to respond to debt collection letters.
Repair the impact on your credit records
Fraudulent applications, searches, missed payments and defaults can affect borrowing decisions. Request credit information from the three main UK credit reference agencies: Experian, Equifax and TransUnion. Statutory credit reports are free.
Check unfamiliar accounts, addresses, financial associations and recent searches. Contact both the company supplying incorrect information and the credit agency displaying it. Specify which entry is wrong, why it involves identity fraud and what correction you need.
UK data-protection rules give you a right to request rectification of inaccurate personal information. Organisations generally must respond within one month, subject to permitted extensions and exceptions. The lender may need to investigate first; ask for the dispute to be recorded while it does.
Recheck all three agencies after confirmation rather than assuming a correction has reached every file. Our guide to checking your credit report explains the entries worth reviewing.
Can you recover money taken from your bank?
Tell your bank immediately about an unauthorised payment. UK payment-services rules generally require qualifying unauthorised transactions to be refunded promptly, usually by the end of the next business day after notification, subject to legal exceptions. The bank may investigate, but use of your card or credentials alone does not prove you authorised a transaction.
If you instructed a transfer because a criminal deceived you, explain that accurately. Known as authorised push payment fraud, this can fall under different reimbursement rules depending on the payment method, date, eligibility and circumstances. Do not label an authorised transfer unauthorised: the distinction affects your rights.
Escalate a refusal and protect your identity
Ask for a final written decision if a financial provider rejects your complaint. The Financial Ombudsman Service can consider many identity theft, borrowing and bank-fraud disputes. Payment-service complaints generally have a 15-business-day response period, with extensions possible; many other complaints allow eight weeks. After a final response, you usually have six months to refer the case.
If inaccurate personal data remains unresolved, you can complain to the Information Commissioner’s Office after giving the organisation a chance to respond. The ICO does not decide whether a particular debt is owed.
Consider Cifas Protective Registration if your details remain exposed. This adds a fraud-warning flag for participating organisations, prompting additional identity checks. It is not a universal credit freeze and may slow legitimate applications. Also review our guide to spotting phishing messages to reduce the risk of another takeover.
Frequently asked questions
Am I liable if someone opens credit in my name?
Generally not if you never consented to the borrowing. Tell the lender it is identity fraud, seek an investigation and challenge related credit-file entries. Do not disregard formal legal notices.
Will reporting identity theft remove a fraudulent default?
No. A police report provides supporting evidence, but you must ask the lender and credit agency to investigate and correct the record.
Can identity theft ruin my credit score permanently?
Not necessarily. Incorrect fraudulent entries can be challenged and corrected. Continue checking all agencies to make sure changes appear wherever the information was reported.
Should I pay for identity protection after fraud?
Paid services are optional. First secure accounts, obtain free credit reports and raise disputes. Consider monitoring or protective registration based on your circumstances.
Moving forward after identity theft
Your stolen identity rights work best when you separate the tasks: secure access, report the crime, dispute unauthorised borrowing, correct inaccurate records and escalate unresolved complaints. Keep correspondence together and seek written confirmation of each correction. The aim is to stop the fraud now without letting its consequences follow you into future credit applications.