Credentials can create direct access
Passwords, answers used to recover an account, one-time codes and app approvals can let someone enter or change an account.
Protection, evidence and public rules
I shared personal or bank information — what should I do?
If you shared personal or bank information, what you should do depends on exactly what you shared. A password can open an account. A security code can approve an action. Card details may be used for payments. Identity details may be combined and used later.
Page P-022Guidance pageReviewed 29 August 2026
Key Guidance
Act now based on what you shared. Contact your bank at once if you shared card, banking, security or payment details. Secure exposed accounts through the real app or website. Protect identity documents as advised by the organisation that issued them. Do not wait for money to be taken.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Guided route 2
I may have shared money, personal details or account access
Current position: Step 3 of 4 — Protect information and accounts. Read the guides in the order shown.
Understand the issue
Why this matters to you
‘Personal information’ can mean many different things. List each item you shared. Then ask what it could let someone see, approve or pretend to be.
Financial details have different powers
A card number, bank sign-in details, account number and payment approval do not give the same powers. Tell the bank exactly what you shared.
Identity information can be combined
Someone may combine your name, address, date of birth, identity-document image or official number. They may use the details to apply for services, pretend to be you or pass identity checks.
Consequences may be delayed
Someone may store the information and use it later. Correct details can also make a false call from a bank, employer or public body feel genuine.
Consequences and movement
What may happen next
Make a simple list of what you shared and who received it. Deal first with anything that can move money, control your email or approve account access. Then protect your identity and watch for misuse.
Bank, card or payment security
Contact your bank, card company or payment service at once. Tell them every detail and approval you shared. Follow their steps to protect the account, card or payment service.
Password, code or account recovery
Open the genuine app or website yourself. Change any exposed or reused passwords. Sign out unknown devices, remove unfamiliar recovery details and strengthen sign-in security.
Identity document or fixed identifier
Contact the organisation that issued the identity document when needed. Check credit and account records. Challenge any application or change you do not recognise.
General contact or profile information
Expect more targeted calls or messages. Tighten privacy settings where useful. A caller knowing correct details does not prove who they are.
Practical response
What you should do
Do not ask the recipient whether they saved or deleted the information. Contact each real bank, service or document issuer using details you found yourself.
- List the exact informationWrite down exactly what you shared. Include passwords, codes, card or bank details, identity documents, addresses, dates, official numbers, images and signatures.
- Call the bank for financial exposureUse your bank's official app or a phone number you trust. Say whether you shared card details, bank sign-in details, security codes, payee details or payment approvals.
- Recover affected accountsUse a trusted app, website or phone number. Change exposed and reused passwords. Check recent activity, signed-in devices and recovery settings. Turn on stronger sign-in security.
- Protect identity routesReport a lost or exposed identity document to the organisation that issued it when needed. Check bank statements and credit files. Investigate any unfamiliar account, application or address change.
- Preserve the disclosure recordSave the message, form, phone number, web address, files and the time you shared them. These records help the bank or service understand what may be possible and support a complaint.
- Prepare for informed follow-upWarn family members or colleagues if someone could pretend to be you. Check any later security, refund or recovery contact using a phone number, app or website you chose.
Look more closely
Shared information may make later contact more convincing
Sharing information does not prove that harm has happened. But the details can make a later call or message seem genuine. Check every new request using contact details you found yourself.
A form, conversation or upload leads you to share the information.
Passwords, identity documents and financial details can help someone enter an account, prove a false identity or move money.
The same details can make a later call or message look informed and genuine.
The follow-up may ask for account access, money, documents or a fee to recover losses.
Keep protecting and checking for as long as the information could still be useful. A password or card can be replaced; identity details may stay useful for years.
Selected history
Historical cases and lasting lessons
Identity information used in applications
Stolen or exposed personal details can be used to seek credit, create accounts or impersonate the individual.
Lasting lesson: Monitor the records where misuse would appear and challenge unfamiliar activity rather than relying only on message blocking.
Phishing for credentials and bank details
False messages and websites commonly seek passwords, security information and financial details.
Lasting lesson: Contain the genuine account or payment route even when the false contact has disappeared.
Transferable understanding
Patterns over time
Information has different authority
Different details allow different actions. A postcode may help someone target you. A one-time code may approve an action straight away.
Fragments gain value when linked
Several ordinary details may become more useful when combined with a password, identity document or account history.
No immediate loss can create false closure
Nothing may happen at first. Someone may use your identity or account details after the original message is forgotten.
Recovery contact can reuse the evidence
A later caller may know exactly what you shared. They may use that knowledge to offer a false repair, refund or recovery service.
Plain-language answers
Common questions
Are my sort code and account number secret?
A sort code and account number do not give the same access as a password or security code. But someone may use them for targeted contact, payment requests or other misuse. Tell your bank exactly what you shared.
Should I replace my passport or driving licence?
Contact the issuing authority and explain what was exposed. Replacement or monitoring should follow the document, exposure and issuer’s advice rather than an automatic rule.
What if I sent a photo of myself holding an identity document?
Treat both the identity document and the photo as exposed. Save the evidence, contact the organisation that issued the document or the service involved, and watch for unfamiliar identity or account activity.
How long should I monitor?
The time varies. Passwords and cards can be replaced. Identity details may stay useful much longer. Keep checking for a period that matches the risk, and investigate any later activity you do not recognise.
Give each exposure to the organisation able to contain it
Contact the organisation that can act on each risk. Your bank can protect money. Account services can restore access. Document issuers can protect or replace documents. Fraud-reporting services can record the incident. Keep one list of the evidence and every action taken.
Scamology Insights
Protect information according to what it can enable
Learning resources can help you turn a vague worry into a clear list of what someone may access, approve or use to pretend to be you. Links to the apps, tools, books and courses are not included in this first version.
Guided route 2 · Step 3 of 4
Continue your route
The next guide follows directly from this one.
Continue understanding
Explore related guidance
Evidence and currency