Broadband taken out in your name? What to do

The Information Commissioner's Office (ICO), the UK's data protection regulator, Experian and Police Scotland list warning signs that apply to broadband just as much as to loans:

• bills, receipts or payment demands for goods or services you never ordered;
• letters from debt collectors about debts that aren't yours;
• being turned down for credit unexpectedly, or a credit rating that drops even though you haven't missed payments;
• credit or searches on your credit report that you don't recognise, accounts you didn't apply for, or being linked to an address you've never lived at;
• post you're expecting not arriving, which Experian says can point to a mail redirection.

For broadband, that first sign could be, for example, a welcome email from a provider you've never used, a router parcel you didn't order, or a first bill. The fraud prevention organisation Cifas says not to ignore post that suggests you have an account you don't have.

Why a credit search may show up

Broadband providers often credit-check applicants. BT's website says its broadband packages are subject to a credit check, and Virgin Media's credit-checking policy says credit reference agencies may keep a record of the search whether or not the application goes ahead. So even an order that was stopped part-way may have left a search on your file. Our guide to how broadband credit checks work explains the difference between the searches you might see.

Is it fraud, or something else?

A few situations look similar but need a different fix:

• Your own line was moved to another provider without your agreement. That's a switching problem rather than an account opened in your name; our guide to fixing a broadband switch that's gone wrong covers it.
• You've just moved in and the last occupant's service is still live. The account is theirs, not yours; see what to do when a previous occupant's broadband is still connected.
• You spoke to a salesperson and an order went through that you didn't agree to. Start with our guide to broadband sold at your door or by phone, then come back here if your details were used without your consent.

Citizens Advice, the ICO, Experian and Virgin Media all say the same thing: contact the organisation involved and tell it you didn't open the account.

Use the contact details on the provider's own website, typed in yourself, rather than a phone number or link in a letter or email you don't trust. Be wary of unexpected follow-up calls claiming to be from the provider or your bank: the ICO warns that criminals can use stolen information to impersonate trusted organisations with convincing calls or messages. Our guide to spotting broadband scam calls and emails explains how to check who you're talking to. Providers' help pages don't always cover this situation specifically, so ask for the fraud or security team when you get through.

What to ask for

• Confirmation that the account will be closed or suspended and that billing will stop.
• That it's recorded as a disputed, suspected fraudulent account, not as a customer cancelling early.
• What it will do about any search or account entry it has reported to the credit reference agencies.
• What to do with any equipment that was delivered, so you aren't later charged for it.
• A reference number, and confirmation in writing or by email.

Don't agree that you owe anything, and don't pay a bill just to make the letters stop; the section on debt collectors below explains where you stand.

An example message you can adapt

This is a template, not wording any provider requires:

"I've received [a bill / a welcome email / a router] for a broadband account in my name at [address]. I did not apply for or agree to this account. Please treat it as identity fraud, close the account, stop all billing and collection, and confirm in writing what you have reported to credit reference agencies. My crime reference number is [number, or 'to follow']."

Keep a log

Police Scotland's identity theft advice says to keep a record of all communication, and Citizens Advice gives the same advice for bank fraud: keep a record of conversations and copies of letters. A simple table is enough:

Keep envelopes, emails and delivery notes too: they're evidence if you need to complain.

Reporting gives you a crime reference number, which makes the rest easier. Experian says a crime reference number can help it query fraudulent information on your credit report.

Report Fraud, run by City of London Police, replaced Action Fraud as the national fraud and cyber crime reporting service on 4 December 2025, according to a Serious Fraud Office announcement on GOV.UK; the phone number stayed the same. You may still see the old name on some pages: Virgin Media's, Experian's and Equifax's pages still mention it, and Virgin Media gives the same 0300 123 2040 number.

Once you have the crime reference number, send it to the provider and add it to your log.

The UK has three main consumer credit reference agencies: Equifax, Experian and TransUnion. These are the companies that hold records of how people manage credit and household bills, and that providers look at when you apply. The ICO says getting a copy of your file is free: look for the "statutory report" on each agency's website, and you don't need a paid subscription. The agency has one month to respond.

Equifax, for example, offers it online through a free Equifax Basic account or by paper form by post.

One agency or all three?

The official advice differs here, so here are both views:

• Citizens Advice says to contact all three agencies, because each might have only part of your file.
• The ICO says each agency has a Victim of Fraud team, and they share information about fraud victims, so once you've told one you shouldn't need to tell the other two.

Both can be true. The ICO also says lenders choose which agencies they report to, so a broadband account or search could appear on one file and not another. Telling one Victim of Fraud team may be enough to flag the fraud, but you only see what's on each file by checking each one, and the statutory reports are free.

Virgin Media's identity fraud page lists these numbers (checked October 2026): Equifax 0800 014 2955, Experian 0800 013 8888 and TransUnion 0330 024 7574.

What to look for and what to ask

• Searches by providers you didn't apply to.
• Accounts you didn't open, including any broadband or phone account.
• Addresses you've never lived at, or financial links to people you don't know.

Citizens Advice says to explain to the agency that you've been a victim of identity theft, say which accounts you didn't apply for and ask for them to be removed; the agency will contact the companies listed. Experian says that once a lender confirms an entry is fraudulent, the lender removes it.

The ICO adds an important detail: if an entry has a company's name on it, that company is likely responsible for it, and the agency can't change it without that company's permission. So keep pressing the provider as well as the agency. Telecoms companies that passed the information on share responsibility for whether it's accurate.

Once someone has your details, they may try again. These measures add friction for a fraudster without stopping you getting services.

A password on your credit file

You can ask a credit reference agency to add a notice of correction password to your file. Citizens Advice says the agency will ask you for the password if you apply for credit, and Experian says a lender should ask for it before opening a credit account in your name. At Experian you add it through Contact us, then Fraud. The ICO says you can also add a notice of correction to explain a particular entry.

Cifas Protective Registration

Protective Registration puts a warning flag against your name and details on Cifas's National Fraud Database. Organisations that use Cifas data then carry out extra checks when your details are used to apply for something. Cifas's terms (checked 9 October 2026):

• it costs £30 for two years;
• you apply online only, not by phone, and it's for individuals only;
• it doesn't affect your credit score;
• it stays for 24 months unless you ask for it to be removed, and you won't get an email when it's about to expire, so put a reminder in your calendar;
• your own genuine applications may take slightly longer, including a new broadband order.

Cifas is clear about the limits: it isn't insurance against fraud losses, and not every application will be checked, so keep checking your credit report.

A "Victim of Impersonation" entry

Sometimes the organisation that spotted the fraud adds a protective entry for you. Cifas says other organisations then see "Cifas – Do Not Reject – Validation Required", which tells them to check it's really you rather than turn you down. It lasts 13 months. If you don't get a letter explaining it within about a week, contact the organisation that created it.

Your post and passwords

• If you think your post has been stolen or redirected, contact Royal Mail on 03457 740 740.
• If you gave a password or PIN to anyone, change it straight away, along with any other account that uses the same password, as the government's Stop! Think Fraud campaign advises.
• Be extra wary for months afterwards. Stop! Think Fraud says fraudsters add victims' details to lists sold to other criminals, and no official organisation will contact you out of the blue asking for full passwords, one-time passcodes or PINs.
• If a caller claiming to be your bank seems suspicious, hang up and call 159, which Citizens Advice says connects you to your bank.

If the fraud followed a known data breach at a provider, the ICO also suggests getting a copy of your credit report and considering Protective Registration. Our guide to what to do after a broadband provider data breach covers that situation.

Sometimes someone uses your address rather than your name, or a household member opens an account. The steps change a little:

• The account is in someone else's name at your address. Tell the provider that the named person doesn't live there, or that you didn't agree to a service at your home, and ask it to stop sending bills and debt letters to you. It isn't your debt to pay, but post that keeps coming can be a sign your address is being used for fraud.
• The account is in your name but was set up by someone you live with. It's still an account you didn't agree to, and the same steps apply. Victim Support offers free, confidential support to fraud victims in England and Wales if the situation is difficult.
• Your credit file shows a link to someone or somewhere you don't recognise. Experian lists being linked to an address you've never lived at as a warning sign. Raise it with the agency's Victim of Fraud team.

If you need your own broadband at the address once it's sorted out, you can compare broadband deals at your postcode. If you have Protective Registration, extra checks may slow the order slightly.

Unpaid bills on a fraudulent account can end up with a debt collector. Don't ignore the letters, and don't pay just to make them stop.

1. Reply in writing to say you dispute the debt because the account was opened fraudulently in your name. Give the crime reference number.
2. It's worth asking them to put the debt on hold while the provider investigates, and to show you what they're relying on as your agreement to the contract. That's our suggestion, not a rule they must follow.
3. Tell the provider that the debt has been passed on, so its fraud team can recall it.
4. Keep copies of everything you send and receive.

Citizens Advice's debt advice for England says you'll usually have to pay a debt if the law says you must or you've signed a contract agreeing to pay, and that if you're not liable you should be able to challenge the creditor. For advice on your situation, its consumer helpline is 0808 223 1133 (weekdays, 9am to 5pm). That number is on its pages for England; Citizens Advice has separate pages for Scotland, Wales and Northern Ireland.

This is different from a genuine debt on an old account of your own. If you owe a provider money you did agree to, our guide to switching broadband when you owe money is the one to read.

If the provider insists the account is yours, escalate in writing:

• Make a formal complaint under the provider's complaints code, quoting your crime reference number and your log. Our guide on how to complain about your broadband provider explains how.
• Alternative dispute resolution (ADR). Ofcom has approved two ADR schemes for broadband complaints, CISAS and the Communications Ombudsman. For complaints first raised from 8 April 2026, you can go to ADR six weeks after first complaining, or straight away if the provider sends a deadlock letter (its final answer). We couldn't confirm whether either scheme will take a dispute from someone who says they were never a customer, so ask the scheme before you apply.
• A credit file entry the provider won't remove. The ICO can't decide whether an account was opened fraudulently. But if a company has accepted that an entry relates to a fraudulent account and still refuses to remove it, the ICO says it may look into a complaint.
• A wrong fraud marker from a financial firm. If the fraud spread to a bank or lender and it wrongly recorded a fraud marker against you, the Financial Ombudsman Service may investigate.

Once the fraudulent account is closed and your files are clean, keep checking your credit reports for a while: Cifas advises regular checks even with Protective Registration in place.

If you're choosing a provider, our guide to UK broadband providers links to each provider's page, and pages such as our BT broadband deals and Virgin Media broadband deals show what's available at your postcode. SwitchMyBroadband compares deals through a partner tool; it can't investigate fraud, contact providers or credit agencies for you, or give personal financial advice.