Real Credit Bureau Alert vs Identity-Theft Phishing
How to tell a genuine fraud alert from your credit bureau apart from a phishing message designed to steal your identity.
Last reviewed: 1 June 2026
Credit reference agencies do send genuine alerts, and receiving one is not proof that something bad has happened. Often it simply means a new account, a search, or a change of address has landed on your file. A real alert is calm in tone, uses the name you registered with, and points you towards your own online account, where the same notification will be waiting when you log in independently. Identity-theft phishing copies that format because credit files feel both important and slightly opaque, so a warning about damage to your rating produces action before thought. The distinction that decides it is verification from your side. A real alert can always be confirmed by logging in yourself, and a real bureau never needs your full identifying numbers or your password sent back to it.
Side-by-side comparison
| Real credit bureau alert | Identity-theft phishing | |
|---|---|---|
| Sender | Sent from the bureau's verified domain; visible in your registered online account | Spoofed sender address; not visible inside your bureau account |
| Link or action | Directs you to log in at the bureau's main URL you type yourself | Provides a link to a lookalike site or asks you to 'confirm' details by reply |
| Information requested | Never asks for your full SSN, passwords, or card numbers via email | Requests SSN, date of birth, card details, or password to 'verify' you |
| Urgency | Gives a normal timeframe; you can log in at your convenience | Threatens credit damage or account closure within hours if you don't act |
| Personalisation | Uses your full registered name; refers to your account number (partial) | Generic greeting or wrong name; vague reference to 'your account' |
Common red flags
- Email asks for full SSN or passwords to 'confirm your identity'
- Link leads to a domain that is not the bureau's official site
- Extreme urgency threatening immediate credit damage
- Generic salutation such as 'Dear Customer'
- Alert not visible when you log in directly to your bureau account
Verification steps
- Go directly to the bureau's website by typing the URL — do not click the email link
- Log into your account and check the alerts or notifications section
- Call the bureau on the number printed on a previous statement or its official site
- Place a free fraud alert or credit freeze if you suspect identity theft
What not to do
- Don't click links in an alert email before verifying the sender
- Don't provide your SSN, password, or card details in response to an alert message
- Don't assume the alert is fake — check directly with the bureau, then act
A safe response
Do not reply and do not use the link. Open a browser, type the bureau's address yourself or use the app you already have, and log in to see whether the same alert appears in your notifications. If it does not, the message was fake, so forward it to the bureau's phishing reporting address and delete it. If it does appear, deal with it from inside your account. If you have already given details, change that password everywhere you reused it, place a fraud alert or freeze on your file, and watch your statements closely. Report identity theft to the relevant national fraud body and tell any affected lender directly.
Frequently asked questions
I logged in and the alert is genuine. What should I do first?
Read what actually changed before acting. Many alerts are triggered by ordinary events such as a credit search you authorised, a new address, or an account closing. If you recognise it, nothing more is needed. If you do not, contact the lender named on the entry directly using details you look up yourself, tell them the application was not made by you, and ask the bureau to add a notice of correction or a fraud marker while it is investigated.
I entered my details on a page like this. How would I know if someone is using my identity?
Watch for signs rather than waiting for a bill. Check your credit file regularly for searches, accounts, or addresses you do not recognise, and read bank statements for small unexplained payments, which are often tests. Post that stops arriving, or letters about accounts you never opened, both matter. Place a fraud alert or freeze on your file, and in the UK consider protective registration with Cifas. Misuse can appear months later, so keep checking rather than checking once.
Can a real credit bureau alert ask me to click a link?
Real bureaux do include links in alerts, but you are never required to click them — you can always go directly to the site and log in. Never provide sensitive data through a link you didn't initiate yourself.