If your dark web scan shows you have had a passwords stolen, it means they are available for criminals to use. While this doesn't mean criminals have already hacked into your accounts, it does mean you're vulnerable to identity fraud.

You should take action quickly to limit further damage. Here's what to do next:

If you’re still using this password and you can see which account has been hacked, change it t​here first. But if like many people, you’ve used this password for lots of sites, you’ll need to change it for your other accounts too.

2. Prioritise your most important accounts

Changing passwords can be time-consuming, so prioritise these accounts:

• Any account that provides access to other sites (e.g. your email account, password managers, Facebook, Google)

• Financial accounts (e.g. your bank account, credit card account, PayPal, ClearScore and investment platforms)

• Sites that hold your payment details (e.g. Amazon and other online shopping sites)

3. Use a different password for every account

To maintain security of your accounts, you need to use different passwords for every account, and make them as long as possible. Try joining three random words together for a stronger password.

4. Use a password manager

To keep track of all your passwords, you could try using a free password manager or a high-quality paid product with extra features, such as 1Password.

Password managers and 2FA methods compared

If you've just found out a password of yours has been leaked, the fastest way to protect yourself is to pick a password manager and a second authentication factor today rather than researching for a week. Here's how the main options compare.

Password manager options compared

Two-factor authentication methods compared

Why SMS 2FA is the weakest option

A text code can be intercepted if a criminal persuades your mobile network to move your number to a SIM card they control - known as SIM-swap fraud. Once they hold your number, the code meant for you arrives on their handset. An authenticator app or passkey removes that risk entirely, because the second factor never travels through the phone network. That said, SMS 2FA is still dramatically safer than relying on a password alone, so switch it on wherever it's the only choice on offer.

What to do if you lose your phone

Before you change anything, download and print the backup or recovery codes each account offers when you enable 2FA, and keep them somewhere secure at home. Register a second method too - a spare hardware key, a backed-up authenticator app, or a trusted device - so a lost or stolen phone doesn't lock you out of your own email and bank at the worst possible moment.

Are browser-saved passwords safe enough?

They're acceptable as a stopgap and much safer than reusing the same password everywhere, but they're only as secure as the account or device they sit behind. If someone gets into your Google or Apple account, they get the lot. A dedicated password manager with its own master password and its own 2FA gives you a second locked door, which is exactly what you want after a breach.

5. Turn on two-factor authentication

We also recommend that you turn on two-factor authentication (2FA) on all your important accounts, including your ClearScore account. You can turn this on in your ClearScore account under ‘Login and security’. Two-factor authentication adds another layer of protection, by asking you to re-confirm your identity using something other than a password. This could be a text to your phone, or an authentication app, for example. Two-factor authentication is a must for your email, banking, social, PayPal, ClearScore and password manager accounts.

Next step: Discover more on password security inside ClearScore Protect in your ClearScore account.

Can a stolen password damage your credit score?

A leaked password on its own has no effect on your credit score. ClearScore isn't a credit reference agency, but we give you your Equifax credit score and report for free - and agencies don't record breaches, dark web appearances or password changes, so nothing about a stolen login shows on your report. What can damage your score is what a criminal does next - and fraud can absolutely affect your credit score and report once it reaches the point of borrowing in your name.

How a stolen password turns into credit fraud

There are two routes. The first is account takeover: someone uses your stolen password to log into an account you already hold, such as a credit card, catalogue account or online shopping profile with a credit facility attached. They spend, you don't know, and the missed payment lands on your report. The second is new credit applied for in your name. A password often unlocks an email account, and from there a criminal can harvest enough personal detail - full name, date of birth, current and previous addresses, employer - to apply for loans, cards, mobile contracts or buy-now-pay-later agreements as if they were you.

What shows on your credit report after fraud

The warning signs are usually visible before any money is demanded from you. Look for hard searches from lenders you've never approached, new accounts you didn't open, an address linked to your file that you've never lived at, financial associations with people you don't know, and missed payments or arrears on accounts that aren't yours. Any one of these is worth investigating; two or more together strongly suggests fraudulent applications have been made in your name.

The real score-killers that follow fraud

The biggest killer of credit scores is missed payments, and that's true whether the debt is genuinely yours or not. Payment history carries more weight than anything else on your file, so a single missed payment on a fraudulent account may lower your score noticeably and mean lenders see you as higher risk, and a default - recorded when an account goes roughly three to six months unpaid - does far more damage still. Behind that come high credit utilisation from spending racked up in your name, and a cluster of unfamiliar hard searches in a short window, which makes you look like someone desperately hunting for credit.

How long fraud-related marks stay on your report

Most negative information stays on your credit report for six years from the date it was recorded. Defaults, County Court Judgments and missed payments all follow that six-year rule. Hard searches drop off after 12 months, though most lenders only weigh the last six. The good news is that entries confirmed as fraudulent shouldn't stay at all - once a lender accepts the account or application wasn't yours, it should be removed from your file entirely rather than left to age out.

How quickly to act

Speed is what limits the damage. Change your passwords the day you find out, and check your full credit report within 24 to 48 hours - checking your own score on ClearScore is a soft search and won't affect it. Fraudulent applications typically surface as searches on your file within a few days, long before any missed payment is recorded. Catching it at the search stage means you're disputing an application rather than unwinding months of arrears and a default. To protect your credit score from fraud on an ongoing basis, check your report at least monthly and turn on alerts so any new search or account is flagged to you the moment it appears.

How to remove fraud from your credit report

If a fraudulent account, application or search has appeared on your credit report, it can usually be removed once the lender accepts it wasn't yours - and you shouldn't be left paying for debt you didn't take out. UK lenders and credit reference agencies have a defined process for this, and following it in order is the fastest route to a clean file.

• Step 1: Check your full credit report for anything you don't recognise. Go through every section, not just the accounts: open and closed credit agreements, hard searches from the last 12 months, linked addresses, financial associations and any public records. Write down the lender name, account number, date opened and balance for every entry you don't recognise. Take screenshots or download a PDF - you'll need this evidence at every later stage, and entries can change once a dispute begins. Check all three agencies where you can, because lenders don't report to all of them and fraud may appear on one file but not another.

• Step 2: Report it to Report Fraud (formerly Action Fraud) and get a crime reference number. Report Fraud is the UK's national reporting service for fraud and cybercrime, replacing Action Fraud from December 2025 and covering England, Wales and Northern Ireland; in Scotland, report directly to Police Scotland on 101. You can report online or by phone, and you'll be given a crime reference number. Keep it safe - lenders and credit reference agencies will ask for it, and having it ready removes a round of back-and-forth from every conversation that follows.

• Step 3: Contact the lender's fraud team directly. Go to the lender the fraudulent account sits with and ask specifically for the fraud or financial crime team, not general customer service. Tell them clearly that the account or application was not made by you, that you're a victim of identity fraud, and give your crime reference number. They will typically ask for proof of your identity and address, confirmation of where you were living when the account was opened, and a written statement that the debt isn't yours. Ask them to place the account on hold while they investigate, and to confirm in writing that they'll ask the credit reference agency to suppress or remove the entry.

• Step 4: Raise a dispute with the credit reference agency. Separately, raise a dispute with Experian, Equifax and TransUnion for whichever files show the fraudulent entry. Each has a free online dispute process. The agency will contact the lender on your behalf, and under the Information Commissioner's Office's expectations the lender is required to investigate and respond within 28 days. While the dispute is open, the entry should be marked as disputed so it doesn't count against you in new lending decisions. If it isn't marked, chase the agency and ask them to apply the flag.

• Step 5: Ask for a Notice of Correction if the entry can't be removed. If the lender won't remove an entry and you still disagree, you have the right to add a Notice of Correction - a free statement of up to 200 words attached to your credit file explaining the circumstances. Any lender assessing you has to read it. Keep it short, factual and specific: state that the account was opened fraudulently, give the date, and reference your crime reference number. Be aware it usually moves your application to manual review, which can slow decisions down.

• Step 6: Consider CIFAS Protective Registration. CIFAS is the UK's fraud prevention service, and Protective Registration places a flag against your name and address for two years. It doesn't stop you borrowing - lenders still weigh your credit score alongside income, existing borrowing and affordability - but it tells every member organisation to carry out extra checks before approving anything in your name - which is what makes the next fraudulent application much harder to push through. There's a small fee, and it's free for confirmed victims through some routes, so ask when you register.

• How long removal takes, and what to do if the dispute is rejected. Straightforward cases are usually resolved in two to four weeks; more complex ones involving multiple lenders can take a couple of months. If your dispute is rejected, ask the lender for its final response in writing, then escalate free of charge to the Financial Ombudsman Service, which can compel a lender to correct your file. Complaints about how a credit reference agency has handled your data go to the Information Commissioner's Office instead. Keep every letter, email and reference number - a documented paper trail is what wins these cases.

Stolen password FAQs

How did my password end up on the dark web?

Almost always through a data breach at a company you held an account with, rather than anything you did wrong. When a website's systems are compromised, the stolen login details are bundled up and traded or dumped on criminal forums. Breaches from years ago still circulate, which is why a password you've long forgotten can suddenly appear in a scan.

Can I get my details removed from the dark web?

No - and be wary of any service that claims it can. Once data has been copied and shared across multiple sites and forums, there's no way to recall it. What you can do is make the stolen information useless: change the password everywhere it was used, switch on two-factor authentication, and monitor for any sign it's being acted on.

Should I close the account that was breached, or just change the password?

Changing the password is enough for accounts you actively use, provided you also add two-factor authentication and check the account's security settings for unfamiliar recovery email addresses or phone numbers. Close accounts you no longer use, particularly if they store payment card details or personal data - a dormant account is one you'll never notice being misused.

How do I set up alerts on my credit report so I know if someone applies in my name?

Sign up with a credit report provider that offers free notifications and turn them on. Alerts tell you when a new hard search is recorded, a new account appears, an address is linked to your file, or a financial association is added. These are the earliest warning signs of fraudulent applications, and getting an alert within days rather than discovering it months later is the difference between a quick dispute and a default on your file.

Does checking my credit report or signing up for monitoring lower my score?

No. Checking your own report is a soft search, which is visible only to you and has no effect on your score whatsoever. You can check as often as you like. Only hard searches - the ones lenders run when you formally apply for credit - are visible to other lenders and factored into decisions.

Is free credit monitoring good enough, or should I pay for it?

For most people, free is genuinely sufficient. A good free service gives you your full report, your score, alerts on changes and a dark web scan for your email address at no cost. Paid services tend to add multi-agency monitoring, insurance products or dedicated case handlers. The best credit monitoring tool for you is the one you'll actually open - a free service checked monthly beats a paid one you ignore.

My password was stolen years ago - do I still need to act?

Yes, if you're still using that password or any close variation of it anywhere. Criminals work through old breach lists constantly, trying leaked combinations against banking, email and shopping sites - a technique called credential stuffing. An old password is only harmless once it's been retired everywhere.

What should I do if money has already gone missing from my account?

Contact your bank immediately using the number on the back of your card or in your banking app, and ask for the fraud team. Under UK rules, banks should normally refund unauthorised transactions by the end of the next working day, though they can investigate first and may refuse if they can show you acted fraudulently or with gross negligence. Then report it to Report Fraud for a crime reference number, change the password on that account and your email, and check your credit report for anything else opened in your name.

Should I tell my bank even if nothing has happened yet?

It's worth a call if the stolen password was used for your banking, your email, or anywhere your card details are stored. Banks can add a note to your account, increase monitoring on your transactions and reissue cards as a precaution. It costs you ten minutes, and it means any suspicious activity is questioned rather than waved through.