Someone in UK has their identity stolen EVERY two minutes, new report warns

During the first six months of this year, the organisation's National Fraud Database logged more than 118,700 identity-fraud cases in the UK — part of a record 217,000 total fraud filings, which works out at about one identity case every 2 - 3 minutes. Yikes.

If that doesn't make you sit up and want to harden your defences, very little will.

What happens when your identity is stolen?

According to Cifas' latest Fraudscape report, there are two playbooks for criminals who have stolen your personal information. First, the tried-and-tested approach: criminals use the stolen identity to open accounts or make false applications — think bank accounts, credit cards or even motor-insurance impersonation.

Second, and increasingly common, is account takeover: thieves hijack an existing online account, change contact details, silence alerts, and then order goods, move money or buy devices to resell.

In summary:

• Unauthorised transactions that drain your bank accounts or charge your credit cards
• New debts incurred without your knowledge
• Damage to your credit score, impacts your ability to obtain loans, mortgages, or insurance
• Long-term complications when trying to regain control of your identity

Adding to the challenge, fraudsters often disable notifications or change account contact information to conceal their activities from victims, making it even harder to detect the crime early.

The worst part? "As we move into the second half of 2025, fraud in the UK is expected to continue to grow," the latest Cifas report cautions. Fraud now accounts for 41% of all crime nationwide. It adds: "Fraud threats are being compounded by several factors, including significant economic pressures on households and business"

AI tools will only make scams more sophisticated. Global losses to scams have surpassed $1 trillion (£759,936,200,000 converted) last year, the Global Anti-Scam Alliance (GASA) has estimated.

The 217,000 fraud and financial crime cases filed in the first half of 2025 in the Cifas Fraudscape 2025 report represent a 1% rise on the previous year. Among these, more than 118,000 were identity fraud cases, a figure that translates to roughly one person every two minutes having their identity stolen or compromised. Identity fraud remains the dominant type of fraud, representing over half of all cases recorded in the National Fraud Database.

Given the alarming prevalence of identity theft, safeguarding yourself has never been more critical. Here are essential steps to keep your identity safe and what to do if it’s compromised.

Use a strong, unique password for every online account

Each of your online accounts should be protected by a unique, impossible-to-guess password — in the same way that each of the doors into your home has its own key. Granted, this is a pain as you need to remember them all.

But if you reuse passwords, a hacker who gains access to one compromised account can easily break into everything else in your name — this is a common tactic known as "credential stuffing".

Strong, unique passwords make it significantly harder for cybercriminals to guess or crack your credentials with automated tools, safeguarding your financial and personal data.

If your head is hurting at the mere thought of having to remember all of those passwords, there are some alternatives. Passkeys are being widely adopted across the industry as a smarter, tougher replacement.

No typing, no remembering, no phishing. Instead, when you attempt to log in to a new app or website, your device proves who you are using its built-in security, like a face or fingerprint scan. Since it's these biometric authentication systems that are vouching for you, there's nothing for hackers to guess, steal, or reuse.

Alternatively, you can rely on a password manager. These popular apps are like a digital safe for all of your logins — storing all of the passwords and email address combos, memorable phrases, and unique codes, so you don’t have to. You create one strong master password, and it locks away the rest.

When you visit a site, it fills in the right details automatically. No more reused or forgotten passwords, and everything stays encrypted, secure, accessible across your devices — so hackers can’t peek, even if they try.

Password managers are available from brands like ExpressVPN, 1Password, Dashlane, and are even included preinstalled on some smartphone operating systems, like iOS.

Enable two-factor authentication (2FA) wherever possible

This is another sure-fire way to stop hackers who have stumbled across an email address and password combination that's been stolen from an online retailer or email provider in an online data breach from using this stolen identity to break into your other accounts.

As the name suggests, 2FA means you'll need more than just a username and password to get into your accounts. As well as these details, you'll need a unique one-time code that's sent to your mobile number or via a dedicated 2FA application, like Microsoft Authenticator or Google Authenticator.

Use a Virtual Private Network (VPN)

With identity theft striking every two minutes in the UK, adding a reputable VPN to your cybersecurity arsenal is a smart move.

That's because a VPN encrypts everything that's transferred over your internet connection and hides your real IP address, making it much harder for hackers, data brokers, or cybercriminals to intercept your online activities or access the personal data you transmit — especially when browsing on public WiFi networks.

By routing your internet traffic through secure remote servers, a VPN effectively disguises your location and turns your browsing data into unreadable “gibberish,” reducing the chances of your identity being compromised online.

Award-winning ExpressVPN goes one step further and proactively monitors the Dark Web to check that none of your personal information has been shared by bad actors on the hidden and unsearchable parts of the internet.

If your identity — like your real name and address — appears on these sites, ExpressVPN will send an alert immediately, so you can take the necessary steps to protect yourself. In the United States, ExpressVPN subscribers will be reimbursed for expenses up to $1 million if their stolen identity is used for forgery of checks or promissory notes, embezzlement, and a variety of other terrifying use cases.

ExpressVPN bundles a password manager with its subscription too.

This all-in-one package is designed to keep your digital footprint secure and your private information out of the wrong hands. When paired with strong passwords and two-factor authentication, using a VPN helps you stay several steps ahead of today's sophisticated fraudsters.

What is a VPN?

A Virtual Private Network (VPN) is software that protects and anonymises everything you do online. VPNs can conceal your online activities by routing traffic through an entrypted tunnel that connects to secure servers worldwide.

The most reliable VPNs employ the same encryption standard as governments in the United Kingdom and the United States, ensuring that even your Internet Service Provider (ISP) connected to Wi-Fi cannot record the websites you visit, the duration of your sessions on each site, or your current location. This protection extends to advertisers, trackers, and hackers, preventing them from monitoring your online behaviour.

Furthermore, personal information entered into online forms and sensitive data transmitted to and from your device will be safeguarded from hackers using strong encryption provided by a VPN.

What now?

With someone losing their identity every two minutes in the UK, 2025 is shaping up to be a defining year for identity fraud awareness and prevention. Being proactive about protecting your data, vigilant in monitoring accounts, and informed about the right steps to take if you’re targeted can make all the difference.

Identity theft isn’t just a statistic — it’s a personal threat, but with the right knowledge and tools, it’s one you can fight back against effectively.