Someone Took Credit in Your Name: UK Steps to Fix Your File

When someone uses another person's identity to take out credit — such as a loan, credit card, or mobile phone contract — the resulting entries can appear on the victim's credit file. This is a form of identity fraud, and it can be deeply distressing.

The fraudulent accounts are not yours, but they sit on your record as though they are. This guide explains how credit files work in the UK, what rights exist under UK law, and what processes are involved in circulating a credit file after identity fraud.

• Who holds the data?: The three UK CRAs are Experian, Equifax, and TransUnion. They do not decide lending; they just store the data.
• Who fixes it?: CRAs cannot just delete data. The Lender (e.g., the bank that opened the fraudulent account) must confirm it was fraud first.
• First Steps:
  1. Report to Action Fraud (0300 123 2040) to get a Crime Reference Number.
  2. Contact the Lender to dispute the account.
  3. Add a Notice of Correction to your credit file.

Role of CRAs

CRAs (Experian, Equifax, TransUnion) are regulated by the Financial Conduct Authority (FCA) and the Information Commissioner's Office (ICO). They act as libraries. If a bank says "John Smith owes £500", the CRA writes it down. They cannot verify if it was actually John Smith who borrowed it.

Data Variation

A fraudulent loan might appear on your Equifax report but not your TransUnion report. Different lenders report to different agencies.

• Action: You must check your Statutory Credit Report from all three agencies.

Your Rights

Under the Consumer Credit Act 1974 and GDPR, you have:

1. Right to Access: Free statutory reports.
2. Right to Rectification: If data is wrong (fraud), it must be corrected.

Dispute Timeline

There is no fixed statutory limit for a fraud investigation, but:

• Complaint Rules: Under FCA rules (DISP), firms must respond to formal complaints within 8 weeks.
• Financial Ombudsman: If unresolved after 8 weeks, you can escalate to the Ombudsman for free.

Retention

• Fraudulent Data: Once confirmed as fraud, it is deleted entirely. It does not stay on your file for 6 years like a genuine default.

Notice of Correction (NoC)

A free 200-word statement you can add to your file.

• Example: "I have been a victim of identity fraud. Please verify my identity via [Phone Number] before granting credit."
• Effect: Lenders must read this manually, which stops automated loans from going through in your name.
• Learn More: See our guide on Notice of Correction.

CIFAS Protective Registration

For higher risk cases, you can pay (~£30 for 2 years) for CIFAS Protective Registration.

• Effect: Places a "fraud flag" on your name in the National Fraud Database. Lenders will perform extra checks on any application in your name. See our guide: Identity Fraud: How to Protect Your File.

1. Identify the Fraud: Check all 3 reports. Look for "Unrecognised Hard Searches" or new accounts.
2. Contact the Lender: Tell their Fraud Department: "I did not open this account. I am a victim of identity theft."
3. Get a Crime Reference: Report to Action Fraud. Lenders often require this number.
4. Wait for Removal: The lender will investigate. Once they confirm fraud, they will instruct the CRAs to delete the entry. This can take 4-8 weeks.

Can the CRA just delete it?

No. The CRA needs the lender's permission. If you tell Experian "This isn't me", Experian has to ask the bank "Is this him?". The bank decides.

Do I have to pay?

You are not liable for fraudulent debts. Do not pay them just to "make it go away" — that can be seen as admitting liability.

Will this ruin my credit forever?

No. Once the fraud is proven, the entries are deleted as if they never happened. Your score will return to normal.

What is CIFAS?

The UK's fraud prevention service. A "Protective Registration" tells lenders: "My ID has been stolen, be careful properly checking it's me."

Found an error on your file that isn't fraud? Learn How to Dispute an Incorrect Late Payment Marker or How to Fix Wrong Linked Addresses.