Identity fraud: what to do if you're being chased for debt that's not yours

Identity fraud — when someone uses your stolen personal information for financial gain — is on the rise. But instead of getting support, you could be forced into a long, frustrating battle with a creditor who treats you with suspicion. 

That’s what happened to one victim who discovered fraudsters had run up £2,200 of debt in his name nearly six years earlier.

Fraud prevention service Cifas recently reported spikes in identity fraud cases involving personal store cards, bank accounts, credit cards and motor insurance, warning that people over 60 were particularly likely to be targeted. 

Your identity is extremely valuable to a fraudster: they can open credit in your name, pocket the cash and leave you to deal with the debt. In the worst cases, the repercussions can last for years.

Here, we share the most important steps to take if you discover you are a victim of identity theft, and explain five ways to prevent scammers from stealing your identity in the first place. 

‘No one believed me — I was threatened with bailiffs’

Ollie Scott, 31, from Surrey has never had a credit card yet a letter from debt collectors arrived last November telling him he owed £1,210 for purchases on a Capital One card all the way back in August 2019. The transactions were over three days, mostly for petrol purchases, though he doesn’t drive. 

Things took a turn for the worse almost instantly. He was told to contact a law firm that specialises in debt recovery about a sum of £990 he supposedly owed on a Shop Direct account (part of the Very Group), also opened in August 2019. His stomach lurched when he was told that a county court had ordered him to repay £100 per month or risk bailiff action. 

Anxious but hopeful he could clear up both mistakes quickly, Ollie explained that he was a victim of identity fraud, but no one seemed to believe him. 

Capital One initially said that the purchases would not be treated as fraudulent, because security checks had been passed. The Very Group said there was nothing it could do as the debt had been sold on. He asked both companies for more details about the fraudulent applications, but was largely ignored.

After weeks of battling, the Capital One debt was finally removed, following an internal review process that confirmed it was fraud. But, Ollie was still facing enforcement action by the law firm who said that he had 'live credit data at the address at the time the account was opened'.

• Find out more: how to avoid identity theft

Putting things right

Not knowing what else to do, Ollie came to Which? for help. 

We pointed out to the Very Group that Ollie had provided bank statements proving that he wasn't living at the address in question at the time of the fraudulent credit applications. We also asked why he was still being threatened with enforcement action when the Capital One debt had been confirmed as fraudulent and occurred at the same time. 

The Very Group said: ‘We take fraud extremely seriously. On receiving new evidence regarding this case, we agree the activity appears fraudulent. We will therefore remove the debt from our records and will work with the other parties to support the setting aside of the County Court Judgment (CCJ). This will ensure his credit score is not impacted by this activity.’

While Ollie is no longer being chased for the debt, he is still waiting for the CCJ to be removed, due to a court backlog. 

He told us: 'The overall situation was quite draining as it took a number of months to resolve but I'm glad that things have finally been sorted.'

• Find out more: how criminals are using AI to scale identity fraud

Make your money go further

Find the best deals, avoid scams, and grow your savings with our expert guidance. From only £4.99 a month.

Join Which? Money

Cancel anytime.

What should you do if your identity is stolen?

It’s easy to feel overwhelmed if you discover someone has stolen your identity, but it’s important you take action quickly. 

Try to stay calm, change the passwords of any compromised accounts such as your email, financial and social media accounts (secure them with two-factor authentication if you haven’t already) and follow these steps:

1. File a police report via Action Fraud to get an official crime reference number. You will need this to dispute the debt.  
2. Report lost or stolen documents such as passports, driving licences, credit cards and cheque books to the organisation that issued them.
3. Notify the credit reference agencies Experian, Equifax, and TransUnion to place a fraud alert or ‘Notice of Correction’ on your credit file (this is a maximum 200-word statement warning lenders of the identity theft). Ask them what credit agreements are on your file and report any fraudulent accounts.
4. Inform the creditor or debt collection agency in writing that you are the victim of identity theft and the debt is fraudulent, attaching your Action Fraud report and reference number. Ask them to stop chasing the debt, investigate the fraudulent account and remove it from your credit report. 
5. Keep detailed records of any calls, emails and letters you send when dealing with identity fraud.
6. Consider Cifas’ protective registration so that its members carry out extra checks to see when anyone, including you, applies for credit using your details. It costs £30 for two years.

Get some help if needed, for example, debt charities such as National Debtline and StepChange offer free debt advice. Victim Support also provides free, confidential advice and support in England and Wales. 

Identity fraud and debt: what are your rights?

If you’re being chased for debt taken out by a fraudster, don’t pay it just to make the problem go away. The starting point is that you should not usually be held liable for outstanding debts incurred due to identity theft. 

Once you have informed a creditor or its chosen debt collection agency that you are a victim of fraud, it should not pursue you for the money while your case is being investigated, under Financial Conduct Authority (FCA) rules. Debt collectors should not harass or threaten you and can be reported if they do (Citizen’s Advice has more on this). 

For regulated debts such as personal loans and credit cards, debt collectors must be licensed by the FCA to operate legally, so check the Financial Services Register to make sure they are legitimate and not scammers.

You can request a free copy of your credit file from the three major credit reference agencies (Equifax, Experian, and TransUnion).

You are also entitled to request a copy of the credit agreement from the creditor for a fee of £1 under the Consumer Credit Act 1974. If it shows someone else’s signature or incorrect details, this would significantly strengthen your case. However, the creditor only has to provide a 'true copy' of the agreement, which won't necessarily include a signature.

Make a formal complaint if you think you've been treated unfairly, using the official complaints procedure of the creditor or debt collection agency. It must respond within eight weeks.

If you aren’t able to resolve your complaint, take your complaint to the Financial Ombudsman Service (FOS). This is free and legally binding on the business.

• Find out more: how to check your credit score for free

5 ways to prevent identity theft and fraud

While it’s impossible to eliminate all risk, there are practical steps you can take to make life much harder for scammers: 

1. Protect your mail 

Use a lockable mailbox or redirect your mail to a more secure address if your mailbox is insecure. Note the dates you should receive any bills and bank statements, then contact both the sender and Royal Mail immediately if you suspect these have been stolen. 

Sign up for the Mail Preference Service (MPS) to limit unsolicited marketing and report anything suspicious to the Royal Mail.

2. Protect your bank account 

Keep a close eye on your statements (most banks offer text or app notifications to alert you to certain account activities). 

Treat all unsolicited calls and messages (whether emails, texts or letters) with caution. If you’re at all unsure, contact your bank using a trusted method. 

If you think someone has misused your bank or card details, report it to your bank immediately. Use a shredder to destroy anything containing your personal or banking details.

• Find out more: the biggest banks rated for security 

3. Protect your computer 

Keep the operating systems of any devices up-to-date and install antivirus software to prevent attacks. 

Never enter sensitive data on unencrypted websites (where you see HTTP instead of HTTPS in the address bar). 

• Find out more: best antivirus software reviewed

4. Protect your online accounts 

Create unique, strong passwords (use a password manager so you don’t need to remember them) and two-factor authentication for your email and other online accounts. 

Remove sensitive data from your social media profiles and LinkedIn, such as your phone number and birthday. 

• Find out more: how to create secure passwords

5. Protect your address 

If you move to a new home, update your address details as soon as possible with your bank, utility companies and other important organisations. You can also use a mail redirection service. 

For belts and braces, you can request that your data be removed from 192.com (an online directory of residential and business records) and, if you are a property owner, you can set up Land Registry email alerts.