How do I protect my credit file after fraud or a data breach?

After identity fraud, the credit file is where the damage persists. Money can be reimbursed; a fraudulent default sits on a file for years and turns up when you apply for a mortgage. The tools available are modest but real, and they are worth setting up properly once rather than repeatedly firefighting.

Safety

Step by step

1. Get all three files and keep them.Experian, Equifax and TransUnion, each with a statutory or free route. Download them rather than viewing them, so you have a dated record of the state of the file at the start.
2. Dispute every entry that is not yours.Raise it with both the agency and the lender that reported it. The agency will mark the entry as disputed while it is investigated, which stops it being relied on in the meantime.
3. Add a notice of correction where an entry cannot simply be removed.A short statement, added to your file, that a human underwriter reads. It is the right tool where a fraudulent application has left a footprint that is factually correct but misleading.
4. Consider Cifas Protective Registration.It places a marker with the national fraud prevention service so members carry out additional identity checks on applications using your details. There is an annual fee, set by Cifas, and it renews rather than lasting indefinitely.
5. Weigh what it costs you.Your own applications take longer and may need extra verification, and instant credit at a checkout may simply fail. If you are mid-mortgage or about to take out finance, plan around it.
6. Check for linked addresses and financial associations.An address you never lived at, or a financial association with someone you have separated from, both drag your file around. Both can be corrected — ask the agency for a disassociation.
7. Watch for the follow-on applications.Fraudulent applications come in waves. Check the files again after a month and again after three, particularly the hard searches section.
8. Set an annual check.Once a year, look at all three files. It takes twenty minutes and is the only way most identity fraud is found early.

Tips

• If a fraudulent account has been opened with a lender, ask them for a copy of the application. You are entitled to the data held about you, and the application often shows the address and phone number used, which is useful to the police.
• Credit monitoring subscriptions mostly repackage what you can get free. Pay for one only if you want the alerting, not the data.
• Protective registration is not a credit freeze. The UK does not have the American-style freeze; the marker prompts extra checks rather than blocking lending outright.

Common mistakes

• Assuming a credit reference agency can remove a lender's entry unilaterally — The agency reports what the lender supplies. Fixing it usually means getting the lender to correct the record, which is why disputes go to both.
• Cancelling protective registration and forgetting to renew or re-add it — It expires. If the exposure is ongoing, put the renewal date in the calendar.

Questions people ask