If your personal details have been stolen, exposed in a data breach, or you suspect someone may be using your identity, CIFAS Protective Registration is the most structured way to protect yourself in the UK. This guide explains when to use it, how it works, and what else you should do alongside it.
What is CIFAS?
CIFAS (Credit Industry Fraud Avoidance System) is the UK’s leading fraud prevention service. It operates the National Fraud Database (NFD) — a shared intelligence system used by banks, lenders, insurers, and other organisations to detect and prevent fraud.
Almost every major UK bank, lender, and financial institution subscribes to CIFAS and checks the National Fraud Database before approving applications.
What CIFAS Protective Registration Does
When you register, a protective marker is added to your name, date of birth, and current address. When any subscribing organisation searches the NFD:
- They see the Protective Registration marker
- They are required to apply additional checks before proceeding
- This typically means contacting you directly to verify the application
What it prevents:
- Someone using your stolen details to open a bank account online in minutes
- Fraudulent credit card or loan applications being instantly approved
- Mobile phone contracts or utility accounts being set up without verification
What it doesn’t do:
- It doesn’t prevent applications being attempted
- It doesn’t block your own legitimate applications
- It isn’t a credit freeze (there’s no UK equivalent to the US credit freeze)
How to Register with CIFAS
- Go to: cifas.org.uk/services/identity-protection/protective-registration
- Pay the fee: £30 for 2 years (credit/debit card online)
- Provide your details: Name, date of birth, current address, previous addresses
- Confirmation: You’ll receive confirmation by email
Registration is live within a few working days. You’ll receive a reminder before it expires after 2 years.
When You Should Consider Protective Registration
| Situation | Protective Registration useful? |
|---|---|
| You’ve received a data breach notification | ✅ Yes |
| Documents stolen (passport, driving licence) | ✅ Yes |
| Post being intercepted or redirected without your knowledge | ✅ Yes |
| You’ve discovered accounts opened in your name | ✅ Yes — and also report to Action Fraud |
| You’re concerned after a phishing attack | ✅ Consideration |
| Routine precaution (no specific threat) | ⚠️ Personal choice — some do this proactively |
What Else to Do After Identity Theft
Protective Registration is one tool among several:
1. Add a Notice of Correction to Your Credit File
Contact each of the three Credit Reference Agencies and add a Notice of Correction:
- Experian: experian.co.uk
- Equifax: equifax.co.uk
- TransUnion: transunion.co.uk
A Notice of Correction adds a short statement (up to 200 words) to your credit file explaining circumstances. It’s visible to lenders and appears alongside your credit data.
2. Check Your Credit Report for Fraudulent Accounts
Use free services to review your credit report:
- Credit Karma (TransUnion data) — free
- Experian — basic report free, paid for full report
- Checkmyfile — all three agencies, 30-day free trial then subscription
Look for credit accounts, applications, or addresses you don’t recognise. Dispute any fraudulent entries directly with the CRA and the lender concerned.
3. Report to Action Fraud
If fraud has actually occurred (not just risk), report to:
- Action Fraud: actionfraud.police.uk or 0300 123 2040
- You’ll receive a crime reference number
4. Report Stolen Documents
- Passport: Report to HMRC Passport Office (gov.uk/report-a-lost-or-stolen-passport)
- Driving licence: Report to DVLA (gov.uk/tell-dvla-about-driving-licence-loss)
5. Contact Affected Lenders Directly
If fraud has already happened:
- Contact each affected company’s fraud team
- Ask for fraudulent accounts to be closed and removed from your credit file
- Request a Deadlock Letter if they won’t resolve it (needed for Financial Ombudsman)
CIFAS Protective Registration vs CIFAS Warning Marker — Not the Same Thing
There are two very different types of CIFAS markers:
| Type | Who adds it | What it means |
|---|---|---|
| Protective Registration | You add it voluntarily | “Extra care needed — I may be a fraud victim” |
| CIFAS Warning (Impersonation/Fraud marker) | Lenders/organisations add it | “This person was involved in fraudulent activity” |
A CIFAS fraud warning marker placed on you without your knowledge (because a lender suspects you of fraud) can devastate credit applications. If you’re being incorrectly flagged, you have the right to:
- Request your CIFAS data (Data Subject Access Request — free)
- Challenge incorrect markers through CIFAS’s dispute process
- Escalate to the ICO if CIFAS doesn’t resolve it
How CIFAS Protective Registration Interacts with Credit Applications
When you apply for credit with a Protective Registration marker:
- Lender checks the NFD
- Lender sees the marker
- Lender contacts you to verify you’re the genuine applicant
- Usually a phone call or letter to your registered address
- If you confirm → application proceeds normally
- If no response from you → lender should not proceed
This process typically adds 1–5 working days to application timelines. For time-sensitive applications (e.g. a mortgage), it’s worth alerting the lender upfront that you have a Protective Registration marker.