Protecting a credit file against fraud

These are listed in the order worth acting on, which with credit fraud protection is not the order they are usually presented in.

Searches are the early warning

A fraudulent application creates a hard search on your file before any account appears. Reviewing searches periodically is the cheapest available detection method and takes minutes. An application you do not recognise is worth querying immediately rather than waiting to see what happens.

Query it with the lender named in the search rather than with the agency, since only the lender holds the application itself and can say what was submitted.

Registration and freezes

Protective registration flags a file so lenders carry out additional identity checks before granting credit. Some jurisdictions offer a full freeze, blocking new credit until you lift it. Both slow down your own legitimate applications slightly, which is the entire point.

On an ordinary week, neither protects an account you already hold, and neither stops fraud on an existing card, which is a separate exposure handled by the issuer rather than by the agency.

Financial association is a route in

A stale association with a former partner or housemate can expose you to their circumstances and vice versa. Breaking obsolete associations reduces both fraud exposure and lending confusion. This has to be applied for; it does not lapse on its own.

On an ordinary week, agencies will generally only break the link once the joint accounts behind it are closed, so the application is a second step after the account itself has been dealt with.

Practical hygiene

Redirect post when moving, shred documents containing account numbers, and treat unexpected calls about your accounts as suspicious by default. Most identity fraud starts with ordinary information rather than a sophisticated breach. Unique passwords and two-factor authentication on email matter most, because email is the reset route to everything else.

Where the second factor is a text message, a mobile number taken over by an impostor defeats it, which is why an authenticator app and a PIN on the mobile account are worth more than they sound.

If it happens

Report to the lender and the agency, obtain a reference number, and request the fraudulent entries be suppressed while investigated. You are generally not liable for debts taken fraudulently in your name, though proving it takes time and persistence.

Keep a dated written record of every call, because the process is long and the burden of narrative falls on you. Ask each lender for written confirmation that the entry has been removed, since searches and accounts can sit on the file for months after the lender has accepted internally that the application was fraudulent.

If that does not fit your week, it is not a failure of willpower.

What a freeze does not cover

Accounts you already hold, card details already in circulation and any lender that does not consult the agency you froze all sit outside the protection. A good deal of fraud never touches a credit file at all, including scams where the victim is persuaded to make the transfer themselves, and the protections there come from payment rules rather than credit law. Reimbursement rules for that kind of scam have been tightening in several jurisdictions and generally turn on what the bank warned and what you were told, which is why messages and call notes from the time are worth keeping.

The useful part is this: report to the national fraud reporting body as well as to the lender, because a lender record alone does not create the paper trail other institutions ask for later.

Everything above, in order of what to do first

1. Searches are the early warning. A fraudulent application creates a hard search on your file before any account appears.
2. Registration and freezes. Protective registration flags a file so lenders carry out additional identity checks before granting credit.
3. Financial association is a route in. A stale association with a former partner or housemate can expose you to their circumstances and vice versa.
4. Practical hygiene. Redirect post when moving, shred documents containing account numbers, and treat unexpected calls about your accounts as suspicious by default.
5. If it happens. Report to the lender and the agency, obtain a reference number, and request the fraudulent entries be suppressed while investigated.
6. What a freeze does not cover. Accounts you already hold, card details already in circulation and any lender that does not consult the agency you froze all sit outside the protection.

The takeaway

Read the searches section of your file. It shows attempted fraud before the debts arrive.

The version you keep doing is the version that works.