I am so excited to announce the launch of our latest feature for our millions of ClearScore users. We have been working on this new feature for nearly two years, and it’s now ready for launch. We are introducing dark web monitoring, for all our users, for free!

One of the many great benefits of checking your credit report is to protect your identity. If a criminal starts to apply for credit in your name, this will show up on your report, acting like an early warning system so you can take action. We were the first company in the UK to offer completely free access to your full credit report and score, updated regularly. We were so proud to deliver this benefit to the market five years ago.

Many of the identity protection products in the market include both credit report access, dark web monitoring and dedicated advice on fraud and security. They often charge over £70 a year for these services. I am delighted that we are now going to offer all our users free dark web monitoring and dedicated advice on how to protect your identity. I really hope that all our users will use this new feature which is free, forever.

The dark web is the name for the unregulated, anonymous part of the internet, often used for criminal activity. Often criminals use the dark web to buy and sell our personal information. This information comes from data breaches such as the hacks of Yahoo, LinkedIn, Equifax, TalkTalk or MyFitnessPal - several of which resulted in enforcement action by the Information Commissioner's Office. These hacks are, unfortunately, more and more common. When they happen criminals can get access to usernames, emails, passwords, and even sometimes financial data. They then sell this on the dark web.

Once these details have been posted on the dark web, other criminals use them to try and hack into accounts. They’ll try combinations of passwords and usernames to log in, or use the information to pretend to be your bank when they email or call you. This can lead to them attempting to take over your identity, taking out mobile phones, credit cards or finance in your name. Identity theft is a growing problem, with Cifas recording well over 400,000 cases of identity fraud filed to its National Fraud Database in a single year - more than 1,000 a day, as reported by Cifas.

I’ve been a victim of identity theft and it is a nightmare to sort out. It is stressful, takes ages on the phone with your bank, and you have to prove who you are over and over again. You feel violated and frightened.

Does fraud actually damage your credit score?

Fraud can damage your credit score, but the damage can usually be reversed once reported - and much of what people fear turns out not to affect their score at all.

Can fraud affect your credit score and report?

Yes. If a criminal successfully opens an account in your name and then never pays it, the missed payments and any resulting default are recorded against your credit file and will pull your score down. The important distinction is between fraud that succeeded and fraud that was merely attempted. An attempt that never became an active account has little to no lasting effect once it has been investigated.

Does a fraudulent hard search hurt my score?

A single hard search has a small, short-lived effect that fades within a few months. Most hard searches drop off your report after 12 months, though this varies by credit reference agency - TransUnion, for example, may retain search records for up to two years. Several fraudulent applications in a short window look worse, because clustered applications suggest financial distress to lenders. Once the searches are confirmed as fraudulent, they can be removed from your file.

Do missed payments on an account I never opened count against me?

While the account sits on your file, yes - the credit reference agencies cannot tell a fraudulent account from a legitimate one until someone tells them. This is why speed matters. Once the lender confirms the account was opened fraudulently, it should be removed along with the payment markers attached to it, and any negative impact linked to it should ease.

Is my score damaged just because my email appeared in a breach?

No. A data breach has no effect whatsoever on your credit score. Your score reflects your borrowing history, not your exposure to hacking. Finding your email on the dark web is a warning that criminals may have material to work with, not a mark against you.

What is the biggest killer of a credit score - is fraud really top of the list?

No. The biggest killers of a credit score are missed payments, defaults, County Court Judgments and bankruptcy, followed by heavy use of available credit and applying for too much credit at once. Fraud only enters the picture when it produces one of those outcomes on your file. For most people, a single missed direct debit does more damage than a dark web exposure ever will.

Will disputing fraud show up on my report to future lenders?

A dispute itself does not lower your score. While an entry is under investigation it may be flagged as disputed, which some lenders will see, but it is a neutral marker rather than a negative one. A Notice of Correction - a short statement you can add to your file explaining you have been a fraud victim - is also visible to lenders and is generally read sympathetically.

How long does it take for my score to recover after fraud is removed?

Once a fraudulent account is deleted from your file, your score usually recovers at the next refresh of your report - typically within four to six weeks, depending on when your lenders next report to the credit reference agency. There is no lingering penalty for having been a victim. Where recovery takes longer is when genuine missed payments happened while you were untangling the mess; those stay on your file for six years and rebuild gradually.

How ClearScore Protect compares to paid identity protection services

Paid identity protection packages in the UK are now mostly sold as monthly subscriptions, commonly working out at roughly £70 to £200 a year depending on the level of cover. Most of that price covers three things: dark web scanning, credit report access and some form of support if the worst happens. The first two are things you can now get for free. The third is where paid services genuinely differ - and whether that difference is worth paying for depends entirely on your circumstances.

What every dark web monitoring tool has in common

Every credible service works the same way underneath. A security team collects breached data circulating on criminal forums and marketplaces, loads it into a searchable database, and then checks your email address against it. Nobody can delete your details from the dark web - that is not technically possible once data has been copied and resold. What every tool actually offers is early warning, so you can change the passwords that matter before someone else uses them.

Where paid services add something

Three features stand up to scrutiny. A named restoration handler who will phone lenders, complete paperwork and chase disputes on your behalf saves genuine hours if fraudulent accounts have already been opened in your name. Tri-bureau cover matters because Equifax, Experian and TransUnion hold slightly different lender data, so a fraudulent account can appear on one and not the others. And identity theft insurance covers legal fees and lost earnings, though in practice most direct financial losses are already refunded by your bank under UK rules.

Where paid services don't add much

Continuous rather than quarterly scanning sounds better than it is - breached data is usually months or years old by the time it reaches a forum, so the difference between a same-day alert and a quarterly one rarely changes the outcome. "Dark web removal" claims should be treated with suspicion; no one can recall data that has already been copied. And paying for credit report access is simply paying for something ClearScore gives away.

How to choose the right level of protection

If you have never had an account opened fraudulently in your name, free monitoring plus good password hygiene covers the realistic risk. If you have already been a victim, work in a public-facing role, or have had post intercepted at a shared address, the case for paid restoration support and tri-bureau cover becomes stronger. Start free, and only pay for the specific gap you can actually name.

How does ClearScore Protect dark web monitoring work?

We have teamed up with a team of cyber security experts who trawl the dark web secretly, undercover if you like, to download as much stolen information as possible.

They have been investigating the use of the internet by criminals for over 20 years. They monitor thousands of criminal forums, websites and chatrooms to search for stolen data, and save it into a secure database.

They are collecting more and more information every day - currently their secure database has over 41 billion data points in it.

At ClearScore we then search this database, securely and privately, and without ever revealing your information, to see whether your email address is associated with any information found on the dark web. We then tell you if we’ve found anything, and suggest what you should do about it. We can’t remove the information from the dark web, but we can make you aware so that you can change emails or passwords to keep yourself safe.

While the threat of identity fraud is serious, there is a lot you can do to protect yourself, and ClearScore is here to help. With ClearScore, you can monitor your credit report and your identity for free.

The service is super easy to use. You just need to verify your email address if you haven’t already, and then initiate the search. In a few seconds we’ll tell you whether any of your information has been compromised and what to do about it. We also give you security tips and recommend security products.

We’ll scan the dark web privately and securely for you every three months for free, forever. If we ever find anything then we’ll send you an email straight away to let you know. You can find ClearScore Protect inside your ClearScore account.

The team has worked so hard to get this into market and I can’t wait for you to try it. I hope we don’t find any of your information on the dark web, but if we do, we will help you take the right steps to protect your identity.

Preventing exposure in the first place: protecting your financial data

Monitoring tells you when something has already gone wrong. Prevention is what stops it going wrong in the first place, and most of it comes down to a handful of habits that take an afternoon to set up and then look after themselves.

• Use a password manager and stop reusing credentials. Password reuse is the single reason a breach at one company becomes a problem everywhere else. A password manager generates a different long password for every account and remembers them for you, so a leaked login from a forum you joined in 2014 cannot open your bank account. Change the reused ones first - email, banking, and anywhere your card is stored.

• Turn on two-factor authentication - and understand why SMS is the weakest option. Any second factor beats none. But SMS codes can be diverted through SIM-swap fraud, where a criminal persuades your mobile provider to move your number to their handset. An authenticator app on your phone, or a physical security key, keeps the second factor on a device you physically hold.

• Learn the signs of a phishing email or a vishing phone call. Fraudsters use breached data to sound convincing - quoting your address, your bank, even a recent transaction. The tells are urgency, a request to move money to a "safe account", a link that does not match the sender's domain, and pressure not to hang up. No bank will ever ask you to transfer money to protect it. Hang up, wait five minutes, and call back on the number printed on your card.

• Lock down your email account. Your email is the master key: it can reset the password on almost every other account you own. Give it your strongest password, enable two-factor authentication, check the recovery phone number and address are still yours, and review any forwarding rules - criminals often add a quiet forward so they can watch for password resets.

• Be careful what you share publicly. Your first pet, your mother's maiden name, your first school and your date of birth are all standard security answers, and all of them regularly appear in public social media posts. Treat security question answers as passwords: make them fictional and store them in your password manager.

• Check your credit report regularly for unfamiliar searches and accounts. A monthly glance at your report catches fraud in weeks rather than years - and checking your score on ClearScore is a soft search, so it won't affect it. Look at hard searches, new accounts, and the addresses linked to your name. Setting up alerts on your credit report means you get told about significant changes rather than having to remember to look.

• Redirect your post and update the electoral roll when you move. Intercepted post is still one of the most effective routes into someone's identity - bank statements, replacement cards and PIN letters all arrive on paper. Use Royal Mail's redirection service for at least six months, tell every lender your new address, and register at your new address on the electoral roll.

• Register with Cifas Protective Registration if you are high risk. If you have lost your wallet, had post stolen, live in a shared house with an insecure letterbox, or have been defrauded before, Protective Registration flags your name for extra identity checks across member lenders. Applications take longer, which is precisely the point.

Warning signs your identity may already be compromised

Act quickly if you notice any of the following: post from a lender you have never dealt with, a card or PIN arriving that you did not order, expected bank statements failing to turn up, a rejected application you did not expect despite a healthy score (a score is only an indication; lenders use their own criteria to decide applications), small unexplained transactions on your account, or a call from your mobile provider about a change you did not request. Each of these is a normal early symptom of identity fraud, and each is far easier to unwind in the first week than the first year.

What to do if your data is found on the dark web: a step-by-step action plan

Finding your details in a breach is unsettling, but it is not the same as being defrauded. Work through these steps in order - the first two take ten minutes and close off the most likely route a criminal would use.

• Change the compromised password - and anywhere you reused it. Start with the account named in the alert, then change every other account where you used the same password or a close variation of it. Criminals run stolen combinations against hundreds of sites automatically, so a password reused on a shopping site is a password that also unlocks your email. Make each new password long and unique.

• Turn on two-factor authentication for email and banking. Two-factor authentication means a stolen password alone is not enough to get in. Prioritise your email account and any banking or investment logins. An authenticator app is stronger than an SMS code, because SMS can be intercepted through SIM-swap fraud.

• Check your credit report for accounts you don't recognise. Look for credit agreements you never opened, hard searches from lenders you never applied to, and addresses linked to you that you have never lived at. Any of these is a sign someone has already tried to borrow in your name. ClearScore is not a credit reference agency, but we give you your credit report and score for free using data from Equifax, updated regularly - so this check costs nothing but a few minutes.

• Report suspected fraud to your bank and Report Fraud (reportfraud.police.uk). If money has moved or an account exists that you did not open, call your bank immediately using the number on the back of your card - never a number from an email or text. Then report it to Report Fraud, the UK's national reporting centre, and keep the crime reference number. Lenders will ask for it.

• Consider Cifas Protective Registration. Cifas Protective Registration places a flag on your name and address telling every member organisation to carry out extra checks before granting credit. It costs a small annual fee and lasts two years. The trade-off is real: your own genuine applications will take longer and may require you to prove your identity in person or by post. It is worth it if you have already been targeted; it is overkill if your email simply turned up in an old breach.

• Add a Notice of Correction to your credit report. This is a free statement of up to 200 words that sits on your file and is read by anyone assessing your application. Use it to explain that you have been a victim of identity fraud and that applications should be scrutinised carefully. It does not affect your score, and it gives context to any entries still under investigation.

• Dispute fraudulent entries with the lender and the credit reference agency. Contact the lender that granted the credit and tell them the account is fraudulent, quoting your Report Fraud reference. At the same time, raise a dispute with each of the three credit reference agencies - Equifax, Experian and TransUnion - because the account may appear on one, two or all three. Put everything in writing and keep copies.

How long fraudulent accounts take to come off your report

Credit reference agencies have 28 days to investigate a disputed entry. In straightforward cases the lender confirms the fraud within that window and the account, along with any missed payment markers, is deleted entirely. More complex cases - where the lender needs statements, identity documents or a police reference - can run to eight weeks. Once the entry is removed, your score typically corrects at the next monthly refresh, so your score may begin to recover within four to six weeks of the deletion, though timings vary.

What to do if the lender refuses to remove the entry

If the lender rejects your claim, ask for their final response in writing and request the evidence they relied on - the application data, the IP address, the address used. You are entitled to see how the decision was reached. If you still disagree, escalate to the Financial Ombudsman Service. You must do this within six months of the lender's final response, the service is free to use, and its decision is binding on the firm. In the meantime, keep the Notice of Correction on your file so lenders can see the entry is contested.