Fragments can be combined
A name and address may be low-risk alone but more useful when combined with a date of birth, document image, account history or security answer.
Protection, evidence and public rules
Identity theft and misuse: how your information can be used
Identity theft is the taking of personal information. Identity misuse or identity fraud is what happens when someone uses that information to impersonate you, obtain services, change accounts or support another deception.
Page T-003Guidance pageReviewed 29 August 2026
Key Guidance
Knowing that personal information has been exposed is a reason to watch and protect—not proof that identity fraud has occurred. Act quickly when you see an unfamiliar application, account, debt, benefit claim, address change or transaction.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Understand the issue
Why this matters to you
Identity is not one document or one number. It is a collection of details, records, accounts, relationships and behaviours that organisations use to decide whether a person is who they claim to be.
Misuse may be invisible at first
The criminal may apply for credit, redirect post, create an account or use your details to support another person’s scam before you see a direct loss.
Accurate details can deceive others
Your identity information may be used to impersonate you to relatives, employers, customers or service providers—not only to take money from you.
Correction can take time
Stopping a transaction may be quick. Correcting records, debts, credit files or linked accounts can require evidence and repeated contact.
Consequences and movement
What may happen next
Watch for changes that do not fit your normal activity. One sign may be an error. Several connected signs can reveal a process already under way.
Unfamiliar financial activity
New accounts, credit searches, debts, transactions or refused applications can indicate someone is using your details.
Missing or redirected communication
Expected bank, utility, government or insurance correspondence may stop arriving after an address or contact change.
Account and recovery changes
Password resets, new recovery details, unfamiliar devices or loss of access may show that identity information has supported an account takeover.
Claims made in your name
Benefits, mobile contracts, purchases, tax activity or services you did not request may surface through letters, bills or official contact.
Practical response
What you should do
The goal is to stop new misuse, correct existing records and build a clear evidence trail. Do not wait for every organisation to discover the problem independently.
- List what is missing or exposedRecord lost documents, breached data, unfamiliar accounts and the dates you first noticed each sign.
- Contact each affected organisationUse its official fraud or complaints route, explain that the activity is not yours and ask what evidence is required to block or correct it.
- Protect financial identityCheck bank and credit-card statements and obtain your credit files. Challenge unfamiliar searches, accounts, debts or address associations.
- Replace vulnerable documentsReport lost or stolen passports, driving licences, cards and other identity documents to the issuer.
- Strengthen connected accountsSecure email first, then financial and other important accounts. Remove unfamiliar sessions and recovery methods and enable stronger sign-in protection.
- Keep a case recordSave letters, screenshots, reference numbers, credit-file entries and the names and dates of every contact. This helps link separate symptoms to one identity-misuse case.
Look more closely
Fragments of identity can be assembled into a convincing impersonation
Your online profile is the partial picture that other people and services can build about you. Someone may combine separate details to pass checks, change records or approach people who trust the identity being copied.
Separate facts are gathered from breaches, public records, contact and observation.
The fragments are assembled into a believable version of you.
Applications, recovery processes or trusted relationships become the route.
Debts, records and suspicion may remain after the immediate fraud ends.
Selected history
Historical cases and lasting lessons
Equifax
A breach at a major credit-reporting organisation exposed identity and financial information on a very large scale.
Lasting lesson: Data held for identity and credit decisions can create long-lived effects. An individual still needs to check which later activity actually relates to them.
Marriott and Starwood
Travel and identity records were involved in a long-running reservation-system compromise.
Lasting lesson: A realistic identity picture can include travel, loyalty and relationship context—not only formal identity numbers.
Transferable understanding
Patterns over time
Identity theft and fraud are related but different
The theft supplies information. The later use creates the fraudulent act and its effects.
The first visible problem may be indirect
A rejected application or debt letter can reveal misuse before any money leaves your own account.
One correction does not clear every system
Banks, lenders, utilities, platforms and government services may each hold separate records that need separate action.
Victim identity can be used against third parties
Friends, colleagues and customers may trust a message because it appears to come from a known person.
Plain-language answers
Common questions
Is identity theft the same as account takeover?
No. Account takeover is control of an existing account. Identity information can also be used to create new accounts, applications or impersonation without entering an existing account.
Should I pay a debt that is not mine to protect my credit file?
Do not accept liability simply to make the contact stop. Tell the organisation that the account or debt is disputed as identity fraud and follow its evidence and complaints process.
Can a criminal use only my name and address?
Those details alone may not pass stronger checks, but they can support targeting, social engineering and attempts to obtain extra information.
What is protective registration?
Cifas offers a paid UK service that places a warning flag against your details so member organisations carry out extra checks when applications are made.
Challenge the misuse, not your identity
You should not have to prove that you exist from the beginning each time. State clearly which transaction, account, application or record is not yours, ask for the fraud process and keep a joined-up evidence log.
Scamology Insights
See how identity fragments become operational
These apps, tools, books and courses can help you see how separate personal details may be joined to build a convincing false identity—and where a safe check can interrupt the attempt. Links are intentionally withheld in this production version.
Continue understanding
Explore related guidance
Evidence and currency