Identity theft does not always announce itself with a stolen card or a dramatic phone call. Often it surfaces weeks later as a bill, a letter or a refused application. This article draws on guidance from the Information Commissioner’s Office (ICO), the UK’s data protection regulator, and Cifas, the UK fraud prevention service, to explain the warning signs, what to do first and what Protective Registration actually offers.
What identity theft is
The ICO defines identity theft as what happens when your personal information, such as your name, date of birth, or current or previous addresses, is stolen and used by someone else to impersonate you. Cifas describes the resulting identity fraud as a fraudster pretending to be you and using your details to buy a product or take out a loan in your name.
Warning signs
The ICO lists signs that could point to identity theft:
- Important documents such as a passport or driving licence go missing.
- Mail from banks or other financial institutions stops arriving unexpectedly.
- Unrecognised transactions appear on your statements.
- State benefit claims are made in your name.
- Unsolicited bills or receipts arrive.
- You are refused credit despite a good financial record.
- Debt collectors chase you for debts you did not incur.
- Your credit rating falls without any missed payments.
Cifas notes that victims typically discover the fraud when unexpected bills arrive or their credit rating suffers, so checking your statements and credit file regularly is one of the few ways to catch it early.
First steps if you are a victim
The ICO’s advice for victims is to act quickly on several fronts:
- Report lost or stolen documents to the organisations that issued them.
- Tell your bank about any suspicious transactions.
- Request your credit file to see what has been done in your name.
- File a police report and obtain a crime reference number.
- Contact Cifas about Protective Registration.
Cifas adds further steps: contact the organisation where the fraud occurred, report to Report Fraud on 0300 123 2040, seek free and confidential support from the charity Victim Support, and question suspicious mail, contacting Royal Mail if you suspect mail theft. It also lists Crimestoppers (0800 555 111) for reporting the perpetrators. Reporting arrangements differ by nation: Report Fraud is the national service for England, Wales and Northern Ireland, while in Scotland reports go to Police Scotland on 101, according to the National Cyber Security Centre.
The ICO is candid about its own limits: it says it cannot deal with cases of identity theft, but it points victims to bodies such as Cifas, Action Fraud and the Financial Ombudsman Service.
What Cifas Protective Registration does
Protective Registration places a warning flag against your name and other personal details in the National Fraud Database. Organisations that use Cifas data are alerted to carry out extra identity checks when someone applies for a product or service using your details, which is intended to reduce the chance of a fraudster succeeding.
- Cost and length: £30 for a two-year period, unless removed earlier.
- Who it is for: individuals whose identities are at heightened risk of fraud. Each household member must apply separately and must live at the registration address, with exceptions for owned UK properties where the applicant lives abroad.
- Effect on you: it does not affect your credit score, but genuine applications may take longer because of the extra checks.
- Limits: it does not cover existing credit or debit card use or ongoing products, and it is not insurance against fraud losses.
- How to apply: online only, since Cifas does not accept applications by telephone, and the payment card must be in your name.
Victim of Impersonation marker versus Protective Registration
These are different things. A Victim of Impersonation marker is created by organisations after fraud has occurred, to protect you. According to Cifas it stays in place for 13 months from the date it is submitted and triggers alerts to other organisations that validation is required. Protective Registration is a separate service that you choose to enrol in, and Cifas recommends it for continued protection beyond the 13-month marker period.
Reducing the chance it happens
The ICO’s prevention advice includes storing sensitive documents securely, using password managers for website logins, destroying old documents that contain personal details, monitoring bank and credit statements regularly, updating your address with banks, providers and Royal Mail when you move, limiting the personal information you share publicly, verifying unexpected contact independently and shopping only on secure websites. None of these steps is dramatic, but they are the habits that make it harder for a stranger to assemble enough of your details to pass as you.
The bottom line
Identity theft often shows up indirectly, through bills, missing mail or credit problems. If it happens, tell the organisations involved and your bank, request your credit file, report to Report Fraud in England, Wales and Northern Ireland or to Police Scotland in Scotland, and consider Cifas Protective Registration, which costs £30 for two years and adds extra checks but is not insurance. Regular checks of your statements and credit file remain the best early warning.