How to Correct a Mistaken Linked Address or Alias on Your Credit File

Credit Reference Agencies (CRAs) in the United Kingdom hold information about most adults, including credit history, address details, and public records. As part of managing this data, CRAs create derived records known as "linked addresses" and "aliases" to track individuals as they move house or change their names. These links are not supplied by lenders — they are generated by the CRAs themselves.

Sometimes these links are wrong. An address you have never lived at may appear on your credit file, or a name you have never used may be recorded as an alias. When this happens, UK data protection law provides a framework for having inaccurate information investigated and, where appropriate, corrected.

This article explains how linked addresses and aliases work, what the relevant legal rights are, and how the dispute and correction process operates. It does not provide financial advice.

• Three Agencies: The UK has three main consumer Credit Reference Agencies: Equifax, Experian, and TransUnion. Each holds its own version of your credit file, and each creates its own address links and alias records independently.
• The Fix: If you find an incorrect linked address or alias on your credit file, the core steps in the process are as follows. You request your statutory credit report from each CRA (this is free of charge). You identify which CRA holds the incorrect information. You contact that CRA to dispute the entry. The CRA investigates and, if it determines the link is erroneous, removes or corrects it. If the CRA does not resolve the issue, you may escalate a complaint to the Information Commissioner's Office (ICO).
• Timeframes: Under the UK General Data Protection Regulation (UK GDPR), CRAs must respond to data access requests within one month. Dispute resolution timeframes vary by CRA: TransUnion states disputes are usually resolved within 28 days, while Experian states results are provided within 30 days, though this can take up to 45 days.

Credit Reference Agencies and the Data They Hold

The three main CRAs operating in the UK — Equifax, Experian, and TransUnion — are authorised and regulated by the Financial Conduct Authority (FCA) for certain credit-related activities, and overseen by the Information Commissioner's Office (ICO) for data protection compliance. They collect and hold personal data about consumers, including credit account information supplied by lenders, public records, and address history. Much of the data on a credit file is supplied by third parties such as lenders, but certain records — including address links and aliases — are created by the CRAs themselves.

Linked Addresses

Address links are created by CRAs when they detect that a person appears to have moved house. The CRA stores a connection between the old address and the new address so that credit history can follow the individual across addresses. These links are derived data, meaning they are generated by the CRA's systems rather than directly reported by a lender or other organisation. CRAs record the source of each address link and should be able to identify when and why a particular link was created.

Aliases

An alias is created when a CRA believes a person has changed their name. The CRA records the previous name alongside the current one. The purpose is to ensure that credit information follows the individual even after a name change. If an alias recorded on a credit file is incorrect — meaning the individual has never used or been known by that name — it can be disputed.

However, if the alias name was legitimately used at some point (for example, a maiden name, or a name used on a previous credit application), in most cases it will remain on the credit file indefinitely. Only aliases that are genuinely incorrect can be disputed for removal.

Financial Associations

Financial associations, sometimes called financial links, are a related but distinct type of record. These are created when a CRA believes two or more people are financially connected, typically through a joint account or joint credit agreement. Financial associations remain on credit files for as long as the CRA considers the individuals to be financially linked.

Although this article focuses on address links and aliases, it is worth understanding that financial associations operate under a similar framework and can also be disputed if they are inaccurate. Requesting a financial disassociation is only possible when all joint accounts have been closed. According to published consumer guidance, joint mortgages may be treated as an exception to this requirement, though the statutory basis for this exception is unclear.

How Mis-traces Happen

A "mis-trace" occurs when an organisation searching for an individual mistakenly identifies someone with the same or a similar name. CRAs operate separate tracing facilities used by lenders and debt collectors. When trace results are provided, lenders are expected to make tentative approaches and carry out further checks before acting. However, if a mis-trace is not caught, it can lead to an incorrect address link being created on a credit file, associating the individual with an address they have never lived at.

Legal Rights

Several pieces of legislation underpin an individual's right to access and correct credit file information in the UK.

1. UK GDPR Article 16 (Right to Rectification) gives individuals the right to have inaccurate personal data rectified. Individuals may also have incomplete data completed. CRAs must take reasonable steps to satisfy themselves as to whether data is accurate and rectify it if necessary. This right applies directly to credit file information.
2. Section 159 of the Consumer Credit Act 1974 gives individuals the right to require a CRA to remove or amend an entry that the individual considers incorrect and that is likely to prejudice them. The individual must give notice to the agency. This mechanism for correction remains in force alongside UK GDPR rights.
3. Section 158 of the Consumer Credit Act 1974 gives individuals the right to request a copy of their credit file. The original legislation specified a fee of £2 for this service. However, the UK GDPR now mandates free access to personal data, and CRAs provide statutory credit reports at no charge.

Regulatory Oversight

The Information Commissioner's Office (ICO) oversees compliance with data protection legislation, including the UK GDPR and the Data Protection Act 2018. If a CRA fails to correct inaccurate information after being contacted, individuals can complain to the ICO. The ICO does not decide financial disputes but can investigate whether a CRA has complied with its data protection obligations.

The FCA authorises and regulates CRAs for certain credit-related activities and previously maintained specific rules for CRAs regarding correction of entries under CONC 9 (the Consumer Credit Sourcebook, Chapter 9). However, the FCA deleted CONC 9 in 2015, determining that those requirements no longer served a useful purpose. Data protection legislation now governs the correction process.

Key Timeframes

The following timeframes are drawn from official CRA documentation and UK GDPR requirements.

• CRAs must respond to a data access request (a request for your statutory credit report) within one month of receiving the request. In certain circumstances, this can be extended by up to two additional months, but the CRA must inform the individual within the first month if an extension is needed.
• TransUnion states that disputes are usually acknowledged within 24 hours and usually resolved within 28 days. The dispute will show as active on the credit report until there is an outcome or 28 days have passed.
• Experian states that dispute results are provided within 30 days, though the process can take up to 45 days. Results can be checked from the individual's Experian account or via the Dispute Centre.
• CRAs state that disputes are usually resolved within these timeframes, though individual cases may vary.
• In cases where the incorrect information relates to data originally supplied by a lender, that lender typically has around 28 days to investigate the dispute. This timeframe is drawn from consumer body guidance rather than primary legislation.

Data Retention

Credit information is typically retained on file for six years for live lending decision purposes. This includes account information and address history. However, this six-year period is industry standard practice rather than a specific statutory requirement. CRAs state that they keep address links and aliases for as long as they are considered relevant for credit referencing purposes, and the language used varies between agencies.

"I didn't create these links — why are they on my file?"

Address links and aliases are derived data created by the CRAs' own systems, not by lenders or by the individual. They are generated automatically when the CRA's records suggest a person has moved or changed their name. This means they can appear on a credit file without the individual having taken any action.

"I need to contact the lender, not the CRA."

This depends on the type of information. For address links and aliases — which are created by CRAs — the dispute should be directed to the CRA. However, if the incorrect information relates to account data supplied by a lender (for example, an address recorded against a credit account), the CRA cannot amend data supplied by a lender without that lender's permission. In those situations, contacting the original lender may also be necessary. Lenders have their own facilities to make changes to credit file information directly.

"Does the CRA have to make my data perfectly accurate?"

CRAs are not required to ensure absolute accuracy of data. Under data protection law, they must take "reasonable steps" to ensure accuracy. If data received from third parties is inaccurate, a CRA is not considered to be in breach of its obligations provided it took reasonable steps to ensure accuracy and includes the individual's view of the inaccuracy when notified. This principle was confirmed in the 2013 Court of Appeal case of Smeaton v Equifax, which established that CRAs have no co-extensive common law duty of care beyond their statutory obligations.

"Will all three CRAs have the same information?"

Not necessarily. Each CRA operates independently. An incorrect address link may appear on one CRA's records but not the others. This is why checking the statutory credit report from all three agencies is relevant when identifying errors.

"My alias is my maiden name — can I have it removed?"

If an individual has previously been known by or has applied for credit using an alias name, that alias will, in most cases, remain on the credit file indefinitely and cannot be removed. Only aliases that are genuinely incorrect — meaning the individual has never used or been known by that name — can be disputed for removal.

Mis-trace Situations

When an address link has been created because of a mis-trace — where an organisation searching for someone has mistakenly identified the wrong person — the CRA should be able to identify this by reviewing the source of the link. CRAs record the origin of each address link. In these situations, the CRA can "break" the inaccurate link once they determine the connection is erroneous.

The "Reasonable Steps" Standard

The legal standard for CRA data accuracy is not perfection. Under the Data Protection Act 2018 and as confirmed by case law, CRAs must take reasonable steps to ensure accuracy. When they are notified that an individual considers data to be inaccurate, they are expected to investigate and, where appropriate, include the individual's view alongside the disputed entry.

Notice of Correction

If data on a credit file is accurate but the individual wishes to explain the circumstances, or if a dispute remains unresolved, a Notice of Correction can be added to the credit file. A Notice of Correction is a statement of up to 200 words that provides context. It must be factual and must not be defamatory, libellous, frivolous, or scandalous. A Notice of Correction does not change any credit score, but it may mean that applications involving the relevant entry are referred for manual review rather than being processed automatically.

CONC 9 and Lender Notification

Prior to 2015, FCA rules under CONC 9 required CRAs to notify lenders who had searched an individual's file within the previous six months whenever data on that file was corrected. The FCA deleted this requirement in 2015 (under policy statement PS15/23), concluding that it no longer served a useful purpose, as lenders would conduct fresh searches upon re-application. Whether the UK GDPR creates any separate obligation for CRAs to notify previous recipients of corrections in the credit file context is not clearly established.

Financial Disassociation and the Mortgage Exception

When requesting financial disassociation — the removal of a financial link with another person — all joint accounts must be closed. However, according to published consumer guidance, a joint mortgage that remains open may be treated as an exception, meaning disassociation can still proceed while a joint mortgage exists. The statutory basis for this exception is unclear, and guidance on this point comes from secondary consumer sources rather than primary legislation.

The process for correcting an incorrect linked address or alias follows a structured sequence, though the experience may differ depending on which CRA holds the incorrect data and the nature of the error.

Individuals can request a free statutory credit report from each of the three CRAs to review what information is held. Requests can be made verbally or in writing. CRAs may require proof of identity before releasing information, and they must respond within one month. In certain circumstances, they may take up to an additional two months but must inform the individual within the first month if this extension is needed.

Once an incorrect address link or alias is identified, the individual contacts the CRA that holds the incorrect entry. The CRA records the source of address links and can investigate when and why a particular link was created. If the CRA determines that the link is erroneous, it can break the address link or remove the incorrect alias.

If the incorrect information relates to account data originally supplied by a lender, the individual may need to contact that lender directly, as CRAs cannot amend lender-supplied data without the lender's agreement.

If the CRA does not resolve the issue after investigation, the individual may make a complaint to the Information Commissioner's Office. The ICO does not adjudicate financial disputes but can investigate whether the CRA has met its obligations under data protection law.

At any stage, if the individual wishes to explain the circumstances around a disputed entry — or if a dispute remains unresolved — a Notice of Correction of up to 200 words can be added to the credit file.

• Three Independent Agencies: The UK has three main Credit Reference Agencies — Equifax, Experian, and TransUnion — each of which independently creates and maintains address links and alias records on consumer credit files.
• Derived Data: Address links and aliases are derived data generated by the CRAs' own systems, not supplied by lenders. They are designed to track individuals across address changes and name changes, but they can sometimes be incorrect.
• Correction Rights: Under the UK GDPR (Article 16) and Section 159 of the Consumer Credit Act 1974, individuals have the right to request rectification of inaccurate personal data held by CRAs. CRAs are required to take reasonable steps to ensure data accuracy, but they are not held to a standard of absolute accuracy.
• Reports and Disputes: Statutory credit reports are available free of charge from each CRA, and must be provided within one month of the request. CRAs state that disputes are usually resolved within 28 to 45 days, depending on the agency.
• Escalation: If a CRA does not resolve a dispute, the matter can be escalated to the Information Commissioner's Office, which oversees data protection compliance. At any point, a Notice of Correction of up to 200 words can be added to a credit file to provide the individual's own account of the circumstances.
• Legal Standards: The legal standard governing CRA data accuracy is one of "reasonable steps," as confirmed by case law, and the regulatory framework now rests primarily on the UK GDPR and the Data Protection Act 2018 following the deletion of the FCA's CONC 9 rules in 2015.