How to Protect Your Credit File From Identity Fraud

As of 6 October 2026. Every factual claim comes from a page we fetched and read that day (see Sources); all time estimates are our own. Our approach explains how we work.

The short version

• US: a security freeze at Equifax, Experian and TransUnion is free, lasts until you lift it, and stops anyone opening a new credit account in your name. You place it with each bureau separately.
• UK: the sources we read describe no freeze. The nearest tools are Cifas Protective Registration (extra identity checks for 24 months), your free statutory credit reports, credit-report monitoring alerts and Notices of Correction.
• Neither country: these tools cover new credit applications. They do not replace watching your existing accounts, and the US tax-refund fraud and medical identity theft routes need separate steps.

Who this is for

Anyone in the US or UK whose details may have been exposed, or who wants fewer ways for a stranger to borrow in their name. The systems differ legally, so each country has its own section.

What you need

• About 45 minutes per country (our estimate; identity checks can take longer), plus a few days for letters to arrive.
• Your full name, current address and date of birth; in the US also your Social Security number; in the UK, any other names and addresses from the last six years.
• Two-factor authentication on your email account; see our guide and password manager comparison.

US: step by step

The FTC says the three nationwide credit bureaus are Equifax, Experian and TransUnion. The CFPB says a security freeze (also called a credit freeze) is free and that you have a right to it by law.

What a freeze does

The FTC says that while a freeze is in place, nobody can open a new credit account in your name, including you. It is free to place and lift, lasts until you lift it, and does not affect your credit score. Anyone can place one for any reason, breach or not.

Step 1: Look at your reports (10 minutes)

The FTC says the only authorised website for free reports is AnnualCreditReport.com. The FTC also lists a phone line (1-877-322-8228) and a mail form. All three bureaus have a program that lets you check your report from each once a week for free there, and federal law also gives you a free report from each every 12 months. The FTC says unfamiliar accounts can signal identity theft.

Step 2: Freeze at all three bureaus (20 minutes)

1. Request a freeze at each bureau’s own site, using the links on the FTC and CFPB pages: equifax.com/personal/credit-report-services, experian.com/help and transunion.com/credit-help (we could not load TransUnion’s page). Type these in rather than searching, to avoid look-alike sites. The CFPB says you must contact each bureau separately.
2. Expect the freeze to be in place within one business day if you ask by phone or secure electronic means, or within three business days of receipt if you ask by mail. Written confirmation, with removal instructions, must follow within five business days.
3. Keep the confirmations and login details for lifting the freeze (our advice).

Bureaus also sell “credit locks” for a fee; never pay a third-party site to “freeze for you” (our advice). The CFPB says locks are no more effective than freezes, which are free by law.

Step 3: Consider a fraud alert (5 minutes)

A fraud alert tells businesses to check with you before opening a new account, and does not stop them seeing your report. An initial alert is free and lasts one year (renewable); you contact one bureau and it must tell the other two. You can have both.

Step 4: Protect your tax return (10 minutes)

In our reading, a freeze does not stop someone filing a tax return in your name. The IRS says an Identity Protection PIN (IP PIN) is a six-digit number that prevents someone else filing a return using your Social Security number, and that you can get one as a proactive step. The fastest route is through your IRS online account.

UK: step by step

The three main UK credit reference agencies (CRAs) are Equifax, Experian and TransUnion, and the ICO says they are licensed by the Financial Conduct Authority. The sources we read describe no freeze. Cifas, the UK fraud prevention service, offers Protective Registration, which works differently: Cifas describes a warning flag that prompts its members to carry out extra checks.

Step 1: Get your statutory reports (15 minutes to apply)

The ICO says you have the right to a copy of the information about your financial standing from any CRA, free of charge, and that you should look for the phrase “statutory report” rather than paying for a monthly subscription. Unless it needs more information, the CRA has one month to respond, extendable by up to two more. Equifax says you are entitled to a free statutory credit report for life, and Experian lists its statutory report as free. The ICO notes lenders choose which CRAs to use, so one report may not show everything. When fraud is a worry, ask all three (our advice). Look for anything unfamiliar.

Step 2: Apply for Cifas Protective Registration if you are at risk (10 minutes)

• What it is: a warning flag against your name and details in the National Fraud Database, telling Cifas members to carry out extra checks.
• How long: 24 months, unless you ask for removal. There is no expiry email, and renewing means reapplying.
• Cost: Cifas lists £30 for two years (as of 6 October 2026).
• How to apply: online only; Cifas does not accept telephone applications. Each person at an address applies separately. Cifas says the payment card should be in your name, with a billing address matching your application. Type cifas.org.uk yourself before entering card details; never pay via an advert or message link.
• Limits: it does not affect your credit score, is not insurance against fraud losses, and does not cover transactions on products already running. Not all applications are checked, and genuine applications may take slightly longer.
• Who it suits: Cifas says it is only for people whose identities are at heightened risk, is most effective in the first few months after a loss of personal data, and that continued use after the threat has diminished devalues the service. Do not apply by reflex.

Cifas says you should still check your credit report regularly and consider a monitoring alert. Equifax’s page describes a statutory report as a snapshot of your credit history, and lists a free Equifax Basic account with credit alerts once monthly; you can view your statutory report by registering for any Equifax product, including Basic. Equifax’s paid plans start with a 30-day free trial, then £14.95 or £22.95 a month depending on the plan; Experian’s Credit Expert is £14.99 a month after a 30-day trial (as of 6 October 2026). Trials can convert to paid, so choose the free options unless you want more. We could not read what alerts Experian’s free account includes.

Step 3: Fix wrong entries (10 minutes)

If an entry is wrong, raise it with the CRA. The ICO says the problem may lie with the lender that supplied it, in which case contact the lender, and that the company named on an entry is likely responsible for it. If a CRA does not reply within 28 days, or does not fix the problem, you can ask it to add a Notice of Correction: a statement of up to 200 words that anyone looking at the entry will see. The ICO cannot investigate fraud itself.

Step 4: Reduce the leak (a few minutes)

See phishing, digital footprint, data minimisation, our money and digital sections and the self-audit tool.

When not to freeze, and how to lift

A freeze blocks you as well as thieves. The FTC says if you need to apply for new credit or a job, rent an apartment or buy insurance, you can temporarily lift the freeze and put it back afterwards. The FTC suggests lifting it only at the bureau the lender will use.

• US timing: the CFPB says a freeze can be removed free of charge within one hour of a request by toll-free phone or secure electronic means, or within three business days by mail. You can also lift it temporarily for a period you choose. Do this before a mortgage, car loan or phone contract application, not during it (our advice).
• Pending applications (US): the CFPB says creditors typically will not offer you credit if they cannot access your file. Do not leave a freeze on while an application is pending without checking the lender will still be able to see your report.
• UK: there is nothing to lift, but Cifas warns that Protective Registration can make genuine applications take slightly longer, so allow extra time. You can ask for removal at any time.

What these tools do not protect against

• Existing accounts (US): the CFPB says creditors of accounts you hold can still see your file during a freeze. The FTC advises reviewing bills and bank statements for charges you did not make.
• Tax-refund fraud (US): the FTC says credit monitoring will not alert you when someone files a tax return in your name. Use the IRS IP PIN.
• Medical identity theft and benefits (US): the FTC lists getting medical care among the ways thieves misuse your details, and says most identity monitoring will not alert you to Medicare or Medicaid misuse. A freeze covers new credit accounts, so in our reading it does not address these.
• UK: Cifas says not all applications will be checked, and Protective Registration does not cover products already running.

If you are already a victim

US

Report it to the FTC at IdentityTheft.gov for a free personal recovery plan with pre-filled letters for bureaus and businesses. Place an initial fraud alert. Once you have an FTC identity theft report or a police report, you can request a free extended fraud alert, which lasts seven years.

UK

1. Contact the bank, card company or other organisation involved.
2. Report to Report Fraud on 0300 123 2040 (the number Cifas gives; we could not confirm it on Report Fraud’s own site). The ICO says to contact Police Scotland on 101 if you live in Scotland or the fraud happened there.
3. Consider Cifas Protective Registration. A “Victim of Impersonation” warning, placed by a Cifas member, lasts 13 months.
4. Get your reports from the CRAs. The ICO says each has a Victim of Fraud team, and that once you have told one CRA you are a fraud victim you should not need to notify the other two. If a lender has acknowledged an account was fraudulently operated but will not remove the entry, the ICO says it may be able to look into a complaint, with that evidence.

The 45-minute plans (our estimates)

US

1. Minutes 0 to 10: pull all three reports at AnnualCreditReport.com and scan for unknown accounts.
2. Minutes 10 to 30: freeze at Equifax, Experian and TransUnion; save the confirmations.
3. Minutes 30 to 40: request an IRS IP PIN through your IRS online account.
4. Minutes 40 to 45: turn on two-factor authentication for your email.

UK

1. Minutes 0 to 15: apply for statutory reports from Equifax, Experian and TransUnion.
2. Minutes 15 to 25: decide whether Protective Registration fits your risk and, if so, apply at cifas.org.uk.
3. Minutes 25 to 35: set up a credit-report alert.
4. Minutes 35 to 45: when reports arrive, dispute anything wrong.

Mistakes to avoid

• Freezing at only one US bureau. Contact each one.
• Ordering free reports from look-alike sites. The FTC says AnnualCreditReport.com is the only authorised website for them.
• Paying for a US “credit lock”. The CFPB says it is no more effective than a free freeze.
• Expecting a UK reminder. Cifas will not email you at expiry.

How to check it worked

• US: you should have a written confirmation from each bureau within five business days. Check each bureau’s account or confirmation for the freeze status, and re-check your weekly free reports.
• UK: you will get a payment confirmation email from Cifas’s payment provider; keep it. Cifas does not say it confirms the registration, so check cifas.org.uk or contact Cifas to confirm it is active, and diarise 24 months. Re-request statutory reports periodically.

What we could not verify

• MoneyHelper, Action Fraud/Report Fraud and Citizens Advice pages were blocked, so none is a source. Report Fraud details come from the ICO and Cifas; we could not confirm the Action Fraud to Report Fraud name change.
• TransUnion’s own pages (blocked); we rely on the FTC, CFPB and ICO for it.
• What alerts Experian’s free account includes (its comparison table uses icons we could not read), and TransUnion UK’s offering.
• That the UK has no freeze at all. We found none in the sources we read, but do not have a source saying so explicitly.
• The ICO “credit explained” PDF carries no date we could read, and the ICO credit page says its guidance is under review following the Data (Use and Access) Act.

Sources

All fetched 2026-10-06; HTTP 200.

• FTC, Credit Freezes and Fraud Alerts (August 2025): https://consumer.ftc.gov/articles/what-know-about-credit-freezes-fraud-alerts
• FTC, Free Credit Reports: https://consumer.ftc.gov/articles/free-credit-reports
• FTC, What To Know About Identity Theft (September 2024): https://consumer.ftc.gov/articles/what-know-about-identity-theft
• CFPB, What is a credit freeze or security freeze on my credit report? (reviewed September 2025): https://www.consumerfinance.gov/ask-cfpb/what-is-a-credit-freeze-or-security-freeze-on-my-credit-report-en-1341/
• IdentityTheft.gov: https://www.identitytheft.gov/
• IRS, Get An Identity Protection PIN: https://www.irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin
• Cifas, Protective Registration: https://www.cifas.org.uk/services/identity-protection/protective-registration
• Cifas, Victim of Impersonation: https://www.cifas.org.uk/services/identity-protection/victim-of-impersonation
• ICO, Credit: https://ico.org.uk/for-the-public/credit/
• ICO, Credit explained (PDF): https://ico.org.uk/media2/migrated/1282/credit-explained-dp-guidance.pdf
• Equifax UK, Statutory Credit Report: https://www.equifax.co.uk/Products/credit/statutory-report.html
• Experian UK, Statutory Credit Report: https://www.experian.co.uk/consumer/statutory-report.html

This guide is general information, not financial or legal advice.