What to do if…
your credit file is suddenly frozen or locked and you did not request it

What to do now

1. Confirm where the locked, frozen, restricted, or blocked message came from.
   If a lender, landlord, agent, mobile provider, or finance company told you, ask which credit reference agency they checked: Experian, Equifax, or TransUnion. Ask whether they can pause the application and use manual or alternative ID checks instead of repeatedly running the same check.

2. Get your statutory credit reports from all three UK credit reference agencies.
   Check Experian, Equifax, and TransUnion, because different organisations can use different agencies and the files may not match exactly. Look for:

   • accounts you do not recognise
   • recent hard searches you did not authorise
   • addresses, name variations, or financial associates you do not recognise
   • fraud warnings, protective registrations, or other restriction notes
   • missing or wrong date-of-birth, address, or electoral register details

3. Check for simple mismatch problems before assuming the worst.
   Compare your name spelling, date of birth, current address, previous addresses, and address dates across all three reports. If an address or account record is wrong, contact the organisation that supplied that record and ask how to correct it; for electoral register information, check with your local council.

4. Contact the credit reference agency or company that shows the restriction.
   Use contact details from the agency’s official website, not from a search advert or unexpected message. Say: “My credit file appears to be locked, frozen, restricted, or blocked and I did not request this. Please tell me what type of restriction this is, when it was applied, who requested it, and the safe process to regain access or challenge it.”

5. If an online account may have set the lock, treat it as possible account takeover.
   Change the password for the email account used for credit, banking, and ID checks. Turn on two-factor authentication where available, then change passwords for banking, credit-card, loan, phone, and finance apps. Check your email forwarding rules and filters for anything you did not set.

6. If you see a fraud marker or fraud-prevention flag, get the source before trying to remove it.
   If the report points to Cifas or another fraud-prevention database, ask which organisation filed the marker and use the relevant subject access route to see what is held about you. Contact the organisation that filed it and ask for its fraud-team process to challenge anything incorrect.

7. If there are signs of identity fraud, report it through the right UK route and keep the reference.
   In England, Wales, and Northern Ireland, use Report Fraud. In Scotland, report non-emergency fraud to Police Scotland through its online, phone, or in-person routes. Keep the report reference, because lenders and credit reference agencies may ask for it.

8. Contact any lender or company you do not recognise on your reports.
   Ask for the fraud team. Say you did not apply for or open the account, ask them to stop processing any application, and ask what they need from you to investigate. Keep a simple log of the date, time, company, person spoken to, and next step agreed.

9. Consider extra friction only if your details may be repeatedly misused.
   Cifas Protective Registration can ask many member organisations to carry out extra checks when your details are used. Cifas says it costs £30 for two years. It can slow genuine applications, so use it only if it fits what you are seeing.