Identity Theft Insurance and Protection UK: What It Really Covers

Introduction

Search for "identity theft insurance UK" and you'll find a mix of genuine insurance products, fraud-prevention services that aren't insurance at all, and marketing that doesn't always draw a clear line between the two. This guide is built specifically to draw that line clearly: what identity theft actually is, what a product genuinely marketed as identity theft insurance is designed to do, and how this differs from CIFAS Protective Registration, a well-known UK fraud prevention service that is explicitly not insurance.

This guide is written for individual consumers concerned about their own personal identity. For business-level protection against cyber attacks, data breaches and related liabilities, see our Cyber Insurance UK guide, which addresses an entirely different, commercial risk.

Key Terms Explained

Identity Theft

The theft of personal information, such as your name, date of birth or address, for use by someone else to impersonate you.

Identity Fraud

The use of stolen personal information to obtain money, goods, services or credit fraudulently, often the practical consequence of identity theft.

CIFAS

The UK's fraud prevention service, which operates the National Fraud Database used by many banks, lenders and other organisations to detect and prevent fraud.

Protective Registration

A CIFAS service that places a warning flag against an individual's details, prompting extra verification checks by organisations that use CIFAS data, explicitly described by CIFAS as a fraud prevention measure rather than insurance.

Identity Theft Insurance

A general term for insurance-style products intended to help with costs and practical support following identity theft, distinct from fraud-prevention services and from your bank's own protections against unauthorised transactions.

What Is Identity Theft?

According to the Information Commissioner's Office (ICO), identity theft happens when your personal information, such as your name, date of birth, or current or previous addresses, is stolen and used by someone else to impersonate you. The ICO notes this can happen whether the person whose identity is stolen is alive or deceased, and that it can lead to identity fraud, potentially causing financial loss or difficulty obtaining loans, credit cards or a mortgage.

It's worth being precise about the distinction: identity theft is the theft of the information itself, while identity fraud is what happens when that information is actually used to obtain something fraudulently. Not every instance of stolen information leads to fraud, but understanding the warning signs of both helps you act quickly if something does go wrong.

Warning Signs to Watch For

The ICO sets out a specific list of signs that may indicate you've become a victim of identity theft or identity fraud, which is worth keeping in mind as a genuine checklist rather than a vague sense of unease.

• Important documents, such as your passport or driving licence, have been lost or stolen.
• Mail from your bank or utility provider doesn't arrive as expected.
• Items you don't recognise appear on your bank or credit card statement.
• You apply for state benefits but are told you're already claiming.
• You receive bills or receipts for goods or services you haven't asked for.
• You're refused financial services, credit cards or a loan despite having a good credit rating.
• You receive letters from solicitors or debt collectors for debts that aren't yours.
• Your credit rating drops even though you haven't missed payments or fallen into arrears.

CIFAS Protective Registration Explained

CIFAS Protective Registration is one of the most commonly recommended steps if you're concerned about identity theft, and it's important to understand exactly what it is and isn't.

How It Works

According to CIFAS's own guidance, when you request Protective Registration, a warning flag is placed against your name and personal details in the National Fraud Database. This tells any organisation using CIFAS data to carry out extra checks when your details are used to apply for products or services, helping confirm it's genuinely you applying rather than a fraudster using your stolen information.

Cost and Duration

CIFAS states that Protective Registration currently costs £30 and remains in place for 24 months unless you request its removal earlier, after which it must be renewed if you want continued protection. CIFAS notes you won't receive an automatic email reminder when it's due to expire.

What It Explicitly Is Not

CIFAS states this directly and unambiguously: "Cifas Protective Registration does not affect your credit score. It is a fraud prevention measure and not a form of insurance against losses caused by fraud." It also doesn't cover transactions, such as existing credit or debit card payments, and CIFAS notes that even with registration in place, not every application is checked, so continuing to monitor your own credit report remains sensible.

Insurance vs Non-Insurance Protection

Given how often these concepts are discussed together, drawing a clear line between them is genuinely useful.

Fraud Prevention Services

Services like CIFAS Protective Registration work by making fraud harder to commit against you in the first place, through extra verification checks. They don't pay out money and, as CIFAS itself confirms, aren't insurance.

Credit Monitoring

Credit reference agencies and various services offer credit report monitoring, alerting you to new applications or changes on your credit file. This is a detection tool, not a form of compensation, and the ICO's own guidance recommends checking your credit file as a practical step if you're concerned about identity theft.

Genuine Identity Theft Insurance

Products genuinely structured as insurance are typically designed to help with the practical costs of resolving identity theft, potentially including expenses associated with reclaiming your identity or related professional support, rather than directly reimbursing money stolen from your bank account. Money taken through unauthorised transactions is generally addressed through your bank's own fraud protections and complaint processes, not through a separate identity theft insurance product.

The Card Protection Plan Mis-Selling Case

Understanding this well-documented UK regulatory case helps illustrate exactly why reading the small print on any identity protection product matters.

What Happened

According to the Financial Conduct Authority (FCA), in November 2012 its predecessor regulator, the Financial Services Authority, fined Card Protection Plan Limited (CPP) £10.5 million, one of the largest retail fines issued at the time, for mis-selling its Card Protection and Identity Protection products. The FCA's own published findings identify the key failing specifically: "CPP overstated the risks and consequences of identity theft during sales of its Identity Protection product."

The Redress Scheme

In August 2013, the FCA reached agreement with CPP and 13 high street banks and credit card issuers to establish a redress scheme, approved by the High Court, covering around seven million customers who had bought or renewed roughly 23 million policies since January 2005. Eligible customers were entitled to a refund of premiums paid, less any amount previously paid out under the policy, plus 8% interest. As a direct result of the FCA's action, CPP stopped selling regulated insurance products entirely.

Why This Case Still Matters

This case remains a genuinely instructive example precisely because it centred on a firm exaggerating identity theft risk to sell a product, rather than the underlying concept of identity protection being invalid. The lesson isn't that identity theft protection is worthless, it's that understanding exactly what a specific product covers, and whether the risk being described matches reality, is essential before paying for one.

Reporting and Recovery Steps

If you believe you've become a victim of identity theft, the ICO recommends acting quickly, and sets out a specific sequence of practical steps.

• Report all lost or stolen documents containing personal information, such as passports, driving licences, credit cards and chequebooks, to the organisation that issued them.
• Inform your bank, building society and credit card company of any unusual transactions on your statement.
• Request a copy of your credit file to check for suspicious credit applications made in your name.
• Report the theft of personal documents and any suspicious credit applications to the police and ask for a crime reference number.
• Contact CIFAS to apply for Protective Registration.

In England, Wales and Northern Ireland, fraud can be reported to Action Fraud via reportfraud.police.uk. Residents of Scotland are directed by the ICO to Police Scotland's own advice and reporting channels instead. The Financial Ombudsman Service can also help with unresolved disputes involving financial firms.

Home Insurance Add-Ons

Some UK insurers offer identity fraud protection or resolution assistance as an optional add-on alongside certain home or landlord insurance policies, sitting alongside other optional extras such as legal expenses cover. This isn't included as standard on every policy, and the specific scope of what's provided varies by insurer, so it's genuinely worth checking exactly what a specific add-on covers rather than assuming a particular level of protection is included.

Making an Informed Choice

Bringing this together, a sensible starting point is treating free or low-cost measures, securing documents, using a password manager, monitoring bank and credit statements regularly, and knowing the CIFAS Protective Registration process, as the foundation, since these address the ICO's own recommended risk-reduction and response steps directly. From there, if considering a paid product marketed as identity theft insurance, the CPP case is a useful reminder to read exactly what's covered, what isn't, and whether the described risk genuinely matches your situation, rather than relying on how the product is marketed alone.

Real-World Examples

Common Mistakes to Avoid

• Assuming CIFAS Protective Registration will reimburse money lost to fraud.
• Not reading exactly what a product marketed as identity theft insurance actually pays for.
• Delaying reporting lost documents, unusual transactions or suspected fraud.
• Assuming home insurance automatically includes identity theft protection without checking.
• Forgetting that Protective Registration expires after 24 months without an automatic reminder.

Common Myths

• Myth: CIFAS Protective Registration is a form of insurance. CIFAS states directly that it's a fraud prevention measure, not insurance against fraud losses.
• Myth: Identity theft insurance always reimburses stolen money. Many such products are designed around resolution costs and support rather than direct reimbursement of funds taken from accounts.
• Myth: Identity theft protection products are inherently a scam. The CPP case involved a specific firm overstating risk, not evidence that all identity protection products lack value; understanding exactly what's covered is what matters.

Frequently Asked Questions

References and Editorial Standards

Conclusion

Identity theft protection in the UK spans a genuinely wide spectrum, from free fraud-prevention measures like CIFAS Protective Registration, which is explicitly not insurance, through to genuine insurance-style products addressing the practical cost of resolving identity theft. The most useful thing any consumer can do is understand exactly which category a specific product or service falls into, informed by the ICO's own guidance on warning signs and response steps, and by the well-documented CPP case as a reminder that marketing claims and actual product scope don't always match.

For related guidance, see our Cyber Insurance UK, Contents Insurance UK and Legal Expenses Insurance UK guides.

Next Steps

• Familiarise yourself with the ICO's warning signs of identity theft.
• Consider CIFAS Protective Registration if your details have been compromised, understanding it's a prevention measure, not insurance.
• Check whether your existing home or landlord insurance includes any identity fraud add-on before buying a separate product.
• If considering a paid identity theft insurance product, read exactly what it pays for before purchasing.
• Know the reporting routes: your bank, the document issuer, the police, and Action Fraud or Police Scotland.