What are my rights and recourse options if my identity is stolen?
Identity theft victims have legal rights including the right to have fraudulent entries corrected on credit files, the right to dispute fraudulent debts, and access to specialist identity theft support services — acting quickly significantly limits the damage.
Last reviewed: 10 June 2026
Explanation
Identity theft occurs when someone uses your personal information — name, date of birth, National Insurance or Social Security number, address — to open accounts, take out loans, or commit other fraud in your name. The consequences can include damaged credit files, unexpected debt collection, and even criminal records in your name from fraud committed by others.
In the UK, you have the right to add a Notice of Correction to your credit file explaining that entries relate to identity theft, to dispute inaccurate entries with credit reference agencies (Experian, Equifax, TransUnion), and to ask lenders to investigate fraudulent accounts. Cifas operates a fraud prevention service (Protective Registration) that flags your file to lenders to apply extra verification.
In the US, you can place a fraud alert or credit freeze at the three major bureaus, file an identity theft report with the FTC at IdentityTheft.gov, and dispute fraudulent accounts under the Fair Credit Reporting Act, which gives you rights to have inaccurate information removed.
This is general information only. The specific steps depend on your country, the type of information stolen, and what the thief did with it. A consumer law adviser or identity theft support organisation can help you navigate the process.
Common red flags
- Unexpected credit applications or new accounts appearing on your credit file
- Debt collection letters for debts you do not recognise
- Being declined for credit unexpectedly due to unknown entries
- Receiving bills or statements for services you did not sign up for
- Tax or government agencies contact you about activity you did not authorise
What to do now
- Obtain your credit report from all three major credit reference agencies and check for unknown entries
- Add a fraud alert or place a credit freeze with credit reference agencies
- Report to Action Fraud (UK), the FTC (US), or your national fraud authority
- Contact each lender where a fraudulent account was opened and raise a dispute
- Apply for Protective Registration with Cifas (UK) to flag your file to future lenders
- Report to the police and obtain a crime reference number for disputes with lenders
Frequently asked questions
Can I be held liable for debts taken out in my name by an identity thief?
You should not be held liable for genuinely fraudulent debts if you report them promptly and co-operate with lenders' investigations. Under UK and US law, you have clear rights to dispute fraudulent credit entries. Document everything and escalate through the ombudsman if a lender refuses to resolve a clearly fraudulent account.
How long does it take to clean up identity theft?
Resolution varies — simple cases may take weeks, while complex ones involving multiple fraudulent accounts, government records, or overseas identity use can take months or longer. Staying organised, keeping records of every dispute, and following up persistently are key.