Credit Reference Disputes

You are entitled under UK GDPR to a free copy of your personal data held by any organisation, including credit reference agencies. You can access your statutory credit report in two main ways:

Free statutory reports:

• Experian: Free statutory report available at experian.co.uk/consumer/statutory-report (or by post). Also offers a free credit monitoring service (CreditExpert) with a monthly subscription for more detailed access.
• Equifax: Free statutory report at equifax.co.uk. Free monthly credit score available via ClearScore (a third-party service that uses Equifax data).
• TransUnion: Free statutory report available at transunion.co.uk. Free credit score and report available via Credit Karma.

You should check all three reports because lenders report to different agencies and information can differ. Some lenders only report to one or two agencies. The statutory credit report must be provided within one calendar month of your request.

What to look for:

• Accounts you do not recognise (could indicate fraud or identity theft)
• Incorrect personal details (wrong address, date of birth, name spelling)
• Incorrect account statuses (showing defaulted when you have always paid on time)
• Outdated information that should have been removed (entries more than six years old)
• County Court Judgments that are wrong or that you have paid and should be marked as satisfied

If you find inaccurate information on your credit report, follow these steps:

1. Identify the error precisely — note the exact entry you are disputing (the lender, account number, status, and what is wrong).
2. Contact the CRA — raise a dispute directly with the credit reference agency that holds the incorrect data. You can do this online through their dispute/query portal, by email, or by post. The CRA must investigate and respond within 28 days.
3. Contact the original lender — simultaneously write to the lender (the company that reported the data) and explain the error. Under UK GDPR, they must correct inaccurate personal data.
4. Provide evidence — attach any proof you have: payment receipts, bank statements, correspondence confirming the account was settled, or identity documents showing the account is not yours.
5. Add a Notice of Correction — if the CRA and lender maintain that the data is correct but you disagree, you can add a Notice of Correction of up to 200 words to your credit file explaining your position. This notice must be shown to any lender who searches your file.

CRAs are required under the Credit Reference Agency (CRA) Framework and UK GDPR to maintain accurate data and to investigate disputes properly. If they do not, they are in breach of data protection law.

If the CRA or lender does not correct a genuine error after you have raised a formal dispute, you have two main escalation routes:

Information Commissioner's Office (ICO): The ICO enforces UK GDPR and the Data Protection Act 2018. If a CRA or lender has refused to correct data that you believe is genuinely inaccurate, you can complain to the ICO at ico.org.uk/make-a-complaint. The ICO can investigate and, if they find a breach, require the organisation to correct the data. However, the ICO focuses on systemic issues and may not intervene in individual disputes where the facts are genuinely disputed.

Financial Ombudsman Service (FOS): If your dispute involves a financial services firm (such as a bank, credit card company, or lender) that is FCA-regulated, and the firm has either failed to respond or has issued a final response you disagree with, you can complain to the FOS. The FOS can direct the firm to correct information on your credit file and may award compensation for distress.

County Court: For incorrectly recorded County Court Judgments, you can apply to the court that issued the judgment to have it set aside (if you should never have received it) or to have it marked as satisfied (if you have paid). Court fees apply but may be refunded.

If you spot accounts you do not recognise on your credit file, this may indicate identity theft or fraud — someone has used your details to take out credit in your name. Take the following steps immediately:

1. Contact the lender — call the lender associated with the unknown account and tell them you did not open the account. Ask them to freeze or close it and raise an investigation.
2. Contact the CRA — tell Experian, Equifax, or TransUnion that you suspect fraud and ask them to add a Notice of Correction and flag the account as disputed.
3. Report to Action Fraud — report the identity theft to Action Fraud (actionfraud.police.uk) and get a crime reference number. This is important evidence for disputes with lenders.
4. Consider a CIFAS protective registration — CIFAS runs the National Hunter fraud prevention service. A protective registration (currently free for suspected victims) flags your identity as at risk, meaning lenders must take additional verification steps before extending credit in your name.
5. Check all three CRAs — fraudsters often apply for credit using the same details at multiple lenders. Check your reports with Experian, Equifax, and TransUnion.

Lenders must remove fraudulent accounts from your credit file and credit any charges or fees accrued. If they refuse, escalate to the FOS and the ICO.