Ilia Nikolaevich Zavialov on how a fraudster takes out a loan in your name: protection tools and what to do next

Loans taken in your name

English version for the United Kingdom.

Ilia Nikolaevich Zavialov on how a fraudster takes out credit in your name and how to stop it. A counter loan after a call from a fake bank fraud team, access to online accounts through a one-time passcode and personal data from breaches turn the owner of an identity into a debtor. Cifas recorded 242,003 cases of identity fraud in the UK in 2025, 54 percent of all cases in its database. In the UK the main tools are Protective Registration with Cifas and a free statutory credit report from every agency. This guide explains each tool and what to do if the credit has already been taken.

Reference / Blog

Published: 29 September 2026 · 11 min read · Ilia Nikolaevich Zavialov

01Why fraudsters now go after credit in your name

Savings are something not everyone has. A credit line is available to almost any adult with an identity document and a credit history. That is why many recent schemes are built around borrowing: a person is persuaded to take out a loan themselves, or the fraudster gains enough access to take one out in that person's name. The money goes to the fraudster, and the debt stays with the owner of the identity.

A loan in someone else's name hurts for years. Money taken from a card is a one time loss. A loan means repayments, interest, calls from collectors and a damaged credit file that then has to be repaired through the lender, the credit bureaus and sometimes a court.

Ilia Nikolaevich Zavialov explains how a fraudster gets credit in another person's name and which tools stop it. The details differ from country to country, but each tool closes one part of the same scheme: the application, the approval or the moment the money leaves.

02How a fraudster takes out a loan in your name

The most common scenario starts with a call. The caller claims to be the bank's fraud team and says a loan application has been made in your name. To cancel it you supposedly need to take out a counter loan and move the money to a safe account. The person takes out a real loan and sends the money to the fraudster with their own hands.

The second scenario relies on access to online accounts. The fraudster talks the victim into reading out a one-time passcode under the pretext of a delivery, a tax refund or a security check, gets into the account and acts in the owner's name from there.

The third scenario uses data from breaches. A name, date of birth, address and phone number are often enough to apply for a card or a small loan with a lender whose checks are light. The sums are modest, but several can be taken at once.

The scenarios are often combined. First a call about a suspicious application, then a request to read out a code to cancel it, then a second call from supposed police asking for help in catching a bank employee. Each step leans on the trust won in the previous one.

03Signs that credit was taken in your name

The first sign is often a letter. A welcome pack for a card you never ordered, a statement from a lender you never used, a reminder of a payment you never agreed to. Such letters are worth opening and reading, even when they look like advertising.

The second sign is a call from a collector about a debt you do not recognise. It is tempting to hang up, but it is better to ask for the lender's name and the account details in writing, because that is the start of the paper trail you will need.

The third sign is a refusal. A mortgage or car loan application declined for reasons you cannot explain may mean your credit file already contains accounts you did not open.

The most reliable sign is the credit report itself. An account, an inquiry or an address you do not recognise is a reason to act the same day.

04Where fraudsters get the data

A loan application needs only a handful of details: name, date of birth, address, phone number and sometimes an identity number. Most of them have already leaked somewhere, through a breach at a shop, a delivery service or a clinic, and are traded in bundles.

The missing pieces are collected by phishing. A text about a parcel, a tax refund or a parking fine leads to a page that asks for card details and a date of birth. Social media fills in the rest: the town, the employer, the names of relatives that often double as security answers.

Post is still a source too. A stolen bank letter or a card delivery taken from a shared mailbox gives the fraudster both details and a document with the victim's address on it.

None of this can be fully prevented, which is why the tools below work on the other side. They assume the data is already out there and make it useless for opening credit.

05What happens after the money is issued

Once a loan is issued in someone else's name, the clock starts. The first repayment falls due within weeks, and when it is missed, the lender sends reminders to the address and phone number on the application, which often belong to the fraudster. The real person hears nothing until the account is passed to collectors.

By then the missed payments are already on the credit file. A default can make a mortgage, a car loan or even a phone contract harder to get for years, although the person never borrowed anything.

Disputing the debt is possible but slow. The lender has to investigate, the credit bureaus have to correct the file, and each step needs documents: the fraud report, letters, proof of address. The earlier the fraud is found, the shorter this path is.

06Protective Registration with Cifas

The United Kingdom has no single national freeze like the one in the United States. The closest tool is Protective Registration with Cifas, the fraud prevention service used by banks and lenders.

Protective Registration places a warning flag against your name and personal details in the Cifas National Fraud Database. When an organisation receives an application with those details, it carries out extra identity checks before opening anything. The service costs 30 pounds for two years.

It suits people whose identity is at heightened risk: after a lost passport, a data breach involving their details or a fraud attempt already caught. For someone in London, Manchester, Birmingham or Glasgow who has just found an account they did not open, it closes the door for the next attempt.

07Your free statutory credit report

The fastest way to see whether credit was taken in your name is your credit file. The Information Commissioner's Office explains that requesting a copy from a credit reference agency is free, can be made verbally or in writing and must be answered within a month. On the agencies' websites it is called a statutory report.

Equifax states that a free statutory credit report is available for life. The same right applies at the other agencies, and it is worth requesting from each of them, because lenders do not all report to the same agency.

Reading the report takes a few minutes. Look for accounts you do not recognise, searches by lenders you never approached, addresses you never lived at and people financially linked to you whom you do not know. Any of these is a reason to contact the agency and the lender the same day.

Many people still do not know this. A study by the Financial Conduct Authority found that 43 percent of consumers did not realise they have a right to access their statutory credit report for free.

08What the UK figures show

Cifas recorded a record 444,993 cases in its National Fraud Database in 2025, 6 percent more than a year earlier. Identity fraud accounted for 242,003 of them, 54 percent of all cases.

The same database shows how quickly misuse grows once details are out. Cases of misuse of facility, the category that also covers money mule accounts, rose by 43 percent in 2025 to 106,497. Accounts opened or taken over with stolen details are the raw material for both.

Another 78,387 cases were facility takeovers, in which a criminal uses compromised personal data to take over an existing account or product, 6 percent more than a year earlier. Both figures describe the same resource: a person's details used without their knowledge.

09If credit was already taken in your name in the UK

Contact the lender that opened the account, say that you did not apply and ask for the account to be closed and the fraud recorded. Ask which details and phone number were used on the application.

Since 4 December 2025 fraud in England, Wales and Northern Ireland is reported to Report Fraud, which replaced Action Fraud, at reportfraud.police.uk or on 0300 123 2040. Keep the reference number for the lender and the credit reference agencies.

Request your statutory reports from every agency to see whether other accounts were opened, ask each agency to correct the file, and consider Protective Registration with Cifas to stop repeat attempts.

Change the passwords of your online banking and email accounts and switch on extra verification. These steps close the path for a second attempt.

10When the fraudster is someone you know

Not every loan in another person's name is taken by a stranger. Relatives, former partners and flatmates have easy access to documents, post and sometimes phones, and a share of identity fraud happens inside the household.

Such cases are the hardest emotionally, because reporting means reporting someone close. Yet the debt stays in the victim's name until the fraud is recorded, and lenders and bureaus cannot correct the file without a report.

The protective steps are the same. Keep identity documents and bank letters locked away, change passwords that others in the home may know, and use the credit protection available in your country so that nobody, known or unknown, can open credit without you.

11Protecting older parents

Older relatives are called about loan applications more often than anyone and are the least likely to know what a credit freeze is. The most useful conversation takes ten minutes: explain that banks never ask customers to take out counter loans, and set up the protection together.

It helps to agree on one simple rule. Any call that mentions a loan, a safe account, a fraud team or an investigator ends with the words I will call you back, after which the person calls you or the bank on the number printed on the card.

If parents have online banking or government accounts, check which phone number they are linked to and whether extra verification is switched on. A number that one of the children also watches is often safer than a number an older person reads out to anyone who sounds official.

12Your name as a fraudster's resource

The loan scheme shows a wider pattern: fraudsters treat another person's identity as a tool. An identity document, a phone number and access to online accounts turn a specific person into a borrower, a payee and a phone subscriber, although they never signed anything.

Protecting your name has to be done in advance. A freeze on your credit, refusing to share cards and codes, and checking your credit report at least once a year together make you an inconvenient target. Fraudsters choose people whose path to money is shorter.

13Questions and answers

How can I tell that credit was taken in my name?

Letters about accounts you never opened, calls from collectors about unknown debts, unexplained refusals and unfamiliar accounts in your credit report are the main signs.

Does a bank ever ask customers to take out a counter loan?

No. A call that asks you to take out a loan to cancel an application, or to move money to a safe account, is a scam. Hang up and call the bank on the number on your card.

Is there a credit freeze in the UK?

There is no single national freeze. The closest tool is Protective Registration with Cifas, which flags your details so lenders run extra identity checks. It costs 30 pounds for two years.

How do I get my credit report for free in the UK?

Ask each credit reference agency for your statutory report. The ICO says the request is free and must be answered within a month, and Equifax says the free report is available for life.

What should I do if credit was taken in my name?

Tell the lender, report to Report Fraud at reportfraud.police.uk, request statutory reports from every agency and consider Protective Registration with Cifas.

Reference updated: 4 September 2026