To protect your accounts after fraud, start with your email account: change its password and turn on 2-step verification, because email is the key to resetting most other accounts. Then change passwords for your bank, phone, shopping and social media accounts, check your devices for software you did not install, and keep an eye on your bank statements and credit file. If your personal details have been stolen, you can also consider Cifas Protective Registration.
Which accounts should I secure first?
Work in this order, using a device you trust:
- Email. The National Cyber Security Centre (NCSC) says criminals can use your email to get into many other accounts. Give it a strong password you do not use anywhere else.
- Banking and payment apps, including PayPal and any crypto exchange accounts.
- Your mobile phone account, so no one can move your number to another SIM.
- Social media and messaging, especially if the scammer used them to contact you or your friends.
- Shopping accounts with saved card details.
If you think someone has had remote access to your computer or phone, do not use that device until it has been checked or reset. Read about remote access fraud.
How do I make strong passwords?
The NCSC suggests using three random words to make a password that is long and hard to guess, and using a different password for your important accounts. A password manager can help you create and remember them. Many phones and web browsers have one built in.
- Do not reuse the password the scammer may have seen.
- Do not use names, birthdays or pet names.
- Never share passwords, PINs or one-time codes with anyone, including people who say they are from your bank, the police or tech support.
What is 2-step verification?
2-step verification (2SV) adds a second check when you log in, such as a code sent to your phone or a prompt in an app. Even if a criminal knows your password, they cannot get in without the second step. The NCSC recommends turning it on for your online accounts, starting with email.
How do I check my devices?
- Install the latest software and app updates, which the NCSC says contain important security fixes.
- Remove apps you do not recognise, especially remote access apps.
- Check your email settings for forwarding rules you did not set up.
- Sign out of all sessions on important accounts, then sign back in.
- Back up your photos and important documents.
How do I check whether someone is using my identity?
Check your credit file. The three main credit reference agencies in the UK are Equifax, Experian and TransUnion. The Information Commissioner's Office says you have the right to ask for a copy of what they hold about you, and that this is free. Look for credit searches, accounts or addresses you do not recognise, and contact the agency if something is wrong.
Consider Cifas Protective Registration. Cifas is a UK fraud prevention service. If you are at higher risk of identity fraud, for example because your details were stolen, Protective Registration puts a warning flag on your name in its National Fraud Database. Organisations that use Cifas data then carry out extra checks when someone applies for products in your name. According to Cifas:
- it costs £30 for two years
- you apply online only
- it does not affect your credit score
- genuine applications may take a little longer while checks are made
Cifas also says it is not insurance against losses, and you should still check your credit report.
What should I keep watching for?
- payments, direct debits or new payees you do not recognise
- letters about loans or credit cards you did not apply for
- password reset emails you did not ask for
- calls or messages offering to help you recover money
The FCA warns that people who have been scammed may be targeted again. Read our guide to fund recovery scams.
If you are worried your accounts are still at risk, contact your bank first. You can also get free help from us to make a plan.
Frequently asked questions
Do I need to change all my passwords?
Prioritise your email, banking and phone accounts, then any account where you used the same password the scammer may have seen. Over time, change any password you reuse.
Will my bank give me a new account?
Banks can block cards, change account details and add extra security. Ask your bank what it recommends for your situation.
Is Cifas Protective Registration worth it?
It is designed for people whose identity is at higher risk, such as after a data breach or stolen documents. Cifas says it works best in the first months after your data is lost.
Should I give my bank my online banking password so they can check my account?
No. Your bank will never ask for your full password or PIN. Anyone who does is a scammer.