How do I tell whether someone has stolen my identity?

Identity theft is not one event. Someone assembles enough of you — name, date of birth, address, a document number — to open something in your name, and the first you know is a letter, a refusal, or a debt collector. The window in which it is easy to fix is the one immediately after that letter.

Safety

Step by step

1. Learn the warning signs.Post stopping unexpectedly, which can mean a redirection was set up. A letter or email confirming an application you did not make. A refused credit application with no obvious reason. A debt letter or collection call for something unknown. A new account or a change of address you did not authorise. Statements missing.
2. Check all three credit reference agencies.Experian, Equifax and TransUnion. Lenders report to some and not others, so one file is not enough. You have a statutory right to your credit file, and each agency offers a free route to it — use that rather than a paid subscription unless you want ongoing monitoring.
3. Read the file for three things.Accounts you do not recognise. Hard searches from lenders you never applied to. Addresses linked to you that you have never lived at. Any of the three is a signal.
4. Check whether your details are in a breach.Search your email addresses on a reputable breach service. It tells you which of your accounts have leaked credentials and therefore which to secure first.
5. Check your own accounts for changes.Bank and card statements line by line for small unfamiliar amounts, which are often used to test a card before larger use. Email forwarding rules and changed recovery details. Mobile account changes, which can indicate a SIM swap.
6. Dispute anything that is not yours, in writing, immediately.Tell the credit reference agency and the lender directly that the account or search is fraudulent. The agency can add a notice while it is investigated. Keep copies of everything.
7. Report it to Action Fraud and to your bank.Or Police Scotland on 101 in Scotland. Get a reference number — lenders and agencies ask for it when removing fraudulent entries.
8. Consider a protective registration.Cifas offers Protective Registration, which flags your details so that organisations carry out extra checks on applications made in your name. There is a fee and it makes your own applications slower. It is worth it if your documents have been compromised.
9. Secure the access routes.Change email and banking passwords, turn on two-factor authentication, and check your postal address for redirections you did not set up. Royal Mail can tell you whether a redirection exists on your address.

Tips

• Identity theft after a house move is common, because post goes to the old address for months. Set up a redirection yourself and update the address on financial accounts first.
• A single unexplained hard search is worth a phone call to that lender. It is often the first evidence of an application in your name, before any account exists.
• If your passport or driving licence has been lost or copied, report it to the issuing body as well — a compromised identity document is worth more than a card number.

Common mistakes

• Checking only one credit file — The three agencies hold different data, and a fraudulent account can sit on one and not the others.
• Paying a debt that is not yours to make it stop — It can be treated as acknowledgement. Dispute it in writing instead and ask the creditor for proof of the agreement.
• Waiting to see whether anything else happens — The damage compounds. Each additional account makes the unwinding longer and the credit file harder to correct.

Questions people ask