Signs your identity has been stolen
- Payments, accounts or credit searches you don’t recognise.
- Letters or emails about credit, deliveries or debts that aren’t yours.
- Password reset emails you didn’t request, or being locked out of accounts.
- Your post stopping or being redirected.
- A company telling you your data was involved in a breach.
The first 24 hours
- Call your bank and card providers about any suspicious activity and ask them to block cards if needed.
- Secure your email first, as it unlocks everything else: change the password, turn on two-step verification and remove unknown devices and forwarding rules.
- Change passwords on other important accounts, using a different password for each (a password manager helps).
- Check your credit reports for accounts you didn’t open.
- Report it and keep a log of who you contacted and when.
In the US
- Report at IdentityTheft.gov (run by the FTC), which creates an identity theft report and a personal recovery plan.
- Freeze your credit for free with each of the three nationwide credit bureaus: Equifax, Experian and TransUnion. A freeze stops new creditors seeing your report until you lift it.
- Or place a fraud alert: contact one bureau and it must tell the other two.
- Check your credit reports free at AnnualCreditReport.com.
In the UK
- Report identity fraud to Report Fraud (England, Wales and Northern Ireland) or Police Scotland on 101.
- Check your credit reports with the three main credit reference agencies: Experian, Equifax and TransUnion. You have a legal right to see your data free of charge.
- Consider Cifas Protective Registration, a paid service that flags your details so organisations make extra checks before opening accounts.
- If your post may have been redirected, contact Royal Mail.
In the EU
- Report to your national police; you may need a police report to dispute fraudulent accounts.
- Ask banks and lenders for details of accounts opened in your name, and check your record with your country’s credit bureau or central credit register where one exists.
- Under the GDPR you can ask organisations what personal data they hold about you, and ask them to correct it.
After a data breach
Under the GDPR and UK GDPR, organisations must usually report a personal data breach to the regulator within 72 hours, and tell affected people without undue delay where there’s a high risk to them. In the US, every state has its own breach notification law.
If you’re told your data was exposed, change the affected password and any reused ones, watch for targeted phishing that mentions the breach, and consider a credit freeze or alert. You can complain to the data protection authority (the ICO in the UK) if an organisation mishandled your data.
General information, not legal advice. Rules vary by country, state and situation, and they change. Check the official sources below, and speak to a qualified lawyer or a free advice service if a lot is at stake.
Last updated: 14 October 2026
