Someone is using my identity: what should I do?

An unfamiliar debt needs checking. Start a paper trail today.

The answer in 2 lines. Contact the bank, lender or service provider concerned through a verified channel and dispute anything you did not authorise. Preserve letters, statements and messages. Follow the ICO’s identity theft guidance to identify warning signs and protective steps. Check your credit files for unfamiliar applications or accounts, report suspected fraud through Report Fraud, and secure your email. If a physical identity document has disappeared, tell its issuer promptly.

Put these actions in motion

Preserve evidence: keep demands, account references, envelopes and screenshots. Make a timeline of what you discovered.
Dispute the account: contact the provider using independently verified details, explain that you did not apply and request a written investigation response.
Check and report: use the ICO’s credit-file guidance to request reports, and Report Fraud to select the appropriate reporting route.

Stop: danger

An unexpected caller offers to fix everything: end the call and contact the organisation independently. Do not supply security codes.
Your email is also compromised: start the official NCSC recovery steps before using that mailbox for sensitive correspondence.

What counts as a warning sign?

A bill for an unknown contract, an unfamiliar credit application or missing financial post can indicate identity misuse. An error is also possible: check rather than assuming every unexpected letter proves fraud.

The ICO checklist explains the signs. Compare them with your own records, check bank statements and contact the organisation behind an unfamiliar entry. Keep your explanation consistent: identify the account or transaction, say what you did not authorise, and describe how you found out. You do not need to know how the information was stolen before taking protective action.

Check credit files without buying a subscription

Read the ICO’s credit guidance, particularly the sections on accessing your file and inaccurate information. Use its agency links and look for a statutory report. The request is free; paid monitoring is optional.

Agencies can hold different information, so a clear report from one does not establish that every file is clear. Check unfamiliar accounts, applications and addresses. Dispute an incorrect entry with the agency and the organisation that supplied it, keeping copies. Ask for the investigation outcome and any correction in writing. A credit report is useful evidence, but does not show every possible misuse of your identity.

What not to do

Paying an unfamiliar debt simply to stop the letters: dispute it and seek advice.
Ignoring formal court documents while waiting for a fraud investigation.
Sending identity copies to an address supplied by an unexpected caller.
Assuming a police report automatically closes accounts or corrects credit records.

Missing documents and exposed information

For a lost or stolen British passport, use GOV.UK’s cancellation service. Select ‘Start now’ and answer the questions; a photograph or copy can help identify the passport. For another country’s passport, contact its issuing authority.

If a data breach may be involved, follow the ICO’s breach guidance. Ask the organisation what information was affected and what protective steps it recommends. Keep its reply. Sharing a document copy and losing the physical document are different situations; explain accurately which happened.

If the dispute is not resolved

For a bank or lender, make a formal complaint first. Follow the Financial Ombudsman Service’s identity theft complaints guide to check escalation requirements and access its complaint process. Explain what the provider did, what remains wrong and the outcome you want.

For inaccurate personal information, follow the correction and complaint sections in the ICO credit guide. The data regulator does not decide whether a disputed account was opened fraudulently. Keep the financial dispute and data-correction requests clearly described.

Good to know

Keep a contact log: organisation, date, person or team, reference, promised action and reply.
Protect email with a unique password and follow the NCSC instructions to enable two-step verification through security settings.
This guide covers England. The reporting service also covers Wales and Northern Ireland; its page directs Scottish cases to Police Scotland.

Illustrative example: Nadia in Birmingham receives a demand for a mobile contract she never opened. She verifies the provider’s contact details independently, disputes the account in writing and saves the reply. She checks her statutory credit reports, challenges an unfamiliar entry and reports the suspected fraud. She keeps following up until she receives written outcomes.

A made-up story, for illustration.

Bobby

Sources, verification, confidence

Verified on 6 November 2026, for England. Confidence: high for protective actions, statutory credit-report access and passport cancellation; medium for individual dispute outcomes and provider procedures. The ICO flags its credit guidance as under review: check the current instructions when making a request.