At ClearScore, our mission is to help everyone achieve financial well-being. We began by giving everyone access to their credit score and report - for free, forever, using data from Equifax. ClearScore is not a credit reference agency, but checking your credit score and report regularly is an easy way to spot signs of identity fraud early on. But with identity fraud reaching record highs, we want to make sure everyone’s identity is better protected.

So, we created ClearScore Protect, a free dark web monitoring service for all ClearScore users. We’ve teamed up with cyber-security experts who scan the dark web for stolen data. When they find stolen passwords, they save them into a secure external database far from the dark web. ClearScore then searches these records securely and privately for your passwords so that you can act fast, change your passwords and protect your identity.

Discover ClearScore Protect: start your free dark web scan today.

Dark web monitoring is a service that checks hidden parts of the internet, known as the dark web, to see if your personal information has been stolen or exposed. This includes your email address, passwords, and bank account details.

How does ClearScore Protect work?

We’ve partnered with a team of cyber security experts who have been investigating criminals' use of the internet for over 20 years. They monitor thousands of criminal forums, websites and chat rooms to search for stolen data and save it into a secure database.

Here’s how it works:

• Data is securely stored in a private, external database.

• Every three months, ClearScore scans over 40 billion records in this secure database for stolen passwords linked to your registered email address.

• If we find any matches, we notify you with the details, including which account the password was used for.

You’ll also get detailed security recommendations and suggested actions to help you strengthen your protection against online identity theft.

What is the dark web, and why should I care?

Criminals use the dark web to buy and sell illegal goods, such as drugs, weapons, and personal information.

Dark web marketplaces sell all sorts of personal information, such as names, addresses and login details to banking apps. If a fraudster buys your personal details, they could commit fraud. They might open a credit card or loan in your name, run up large debts, or damage your credit score.

The impact can be devastating and takes a lot of time and money to fix.

Dark web monitoring is a useful way of checking whether any of your data is on the dark web, giving you the chance to secure your accounts early - though it can't prevent every fraud.

Why am I at risk?

With identity fraud cases reaching record highs last year, protecting your information is more important now than ever. Cifas, which runs the UK's National Fraud Database, records hundreds of identity fraud cases every day - its latest Fraudscape report shows identity fraud at record levels.

How to Protect Your Financial Data Before It Reaches the Dark Web

Most stolen data ends up on the dark web because of a breach at a company you trusted, not because you did anything careless. But the habits below decide whether one leaked password becomes one compromised account or a chain of them. Here's how to protect your financial data and reduce the damage a breach can do.

Use a unique password for every financial account

Password reuse is the single biggest risk. When criminals buy a leaked email and password pair, they don't just try it on the site it came from - they run it automatically against banks, credit card providers, email accounts and shopping sites. This is called credential stuffing, and it only works because most people reuse passwords. A password manager will generate and remember a different long password for every account, so one breach stays contained.

Turn on two-factor authentication - and choose app-based where you can

Two-factor authentication means a stolen password alone isn't enough to get into your account. Authenticator apps generate codes on your device and are harder to intercept than SMS, which can be hijacked through SIM-swap fraud. If a bank or provider only offers SMS, still switch it on - it's far better than nothing.

Learn to spot phishing, smishing and bank impersonation scams

Fraudsters often skip hacking entirely and simply ask you for your details. Genuine banks will never ask you to move money to a "safe account", read out a one-time passcode, or install remote-access software. Treat unexpected texts about missed deliveries, tax refunds or suspicious payments as fake until proven otherwise, and contact the organisation using the number on the back of your card rather than any number in the message.

Be careful on public Wi-Fi and social media

Avoid logging into banking apps on open Wi-Fi networks in cafés, airports or hotels, and use mobile data instead where possible. On social media, the details fraudsters need for security questions are often freely posted: your date of birth, your first pet, your mother's maiden name, your street. Lock down your privacy settings and think twice before joining a viral quiz.

Keep your address and electoral roll details up to date

Being registered on the electoral roll at your current address helps lenders confirm you are who you say you are, which makes it harder for someone to open credit in your name elsewhere. If you move, redirect your post through Royal Mail for at least a year - old statements and replacement cards arriving at your previous address are a well-worn route into identity fraud.

Review your credit report regularly for early warning signs

Your credit report is where identity fraud usually shows up first. Unfamiliar hard searches, accounts you never opened or an address you've never lived at are all signals worth acting on immediately. Checking your own report is a soft search and never affects your score, so there's no downside to looking often.

Quick checklist: eight things to do this week

• Change the password on your main email account - it's the master key to everything else.

• Set up a password manager and start with your banking and email logins.

• Switch on two-factor authentication for every financial account that offers it.

• Check your credit report for searches, accounts or addresses you don't recognise.

• Update your device and app software so known security holes are patched.

• Review your social media privacy settings and remove your date of birth.

• Set up transaction alerts with your bank so you see spending in real time.

• Run a free dark web scan to see whether any of your passwords are already exposed.

Does ClearScore scan the dark web?

No. We work with a team of cyber security researchers who scan the dark web securely and privately without revealing any of your data. If they find information being traded on the dark web, they save it to a secure database.

ClearScore then searches this database to see if your passwords have been leaked on the dark web and alerts you if they have.

Is ClearScore Protect safe?

Yes. ClearScore Protect operates securely and privately:

• Your data is never shared with third parties or the dark web.

• Passwords are scanned in a secure database and only partially revealed to ensure your privacy.

Does ClearScore store my passwords?

No. ClearScore never stores your passwords in full.

We search a secure database for your email address to see if any passwords related to this email address are available on the dark web. If your passwords are available, we receive them in a partially starred out format so that we can inform you.

Do you send my data to the dark web?

No. Because ClearScore never accesses the dark web ourselves, we cannot pass your data to the dark web.

Is ClearScore closer to criminals? Will using ClearScore put me at more risk?

No. Because of the way ClearScore Protect works, we never access the dark web ourselves. We simply tell you if your data is on the dark web, empowering you to take positive action to reduce the risk of you or your family becoming a victim of identity fraud.

Can ClearScore remove my data from the dark web?

Unfortunately not. Once information is on the dark web, it can’t be removed. However, our goal is to empower you to take action once you know your data has been breached.

How often does ClearScore scan the database?

We'll scan the database once every three months for your registered ClearScore email address and let you know if we find anything.

If you want daily scans, you can subscribe to ClearScore Protect Plus for improved password security. This daily scanning costs us more, so we charge a small fee of £7.99 per month for this service - see the ClearScore Protect Plus page for the current price and full terms.

What does it mean if I have a stolen password?

If your password has been stolen, it means it’s available on the dark web for criminals to buy, sell, or use. Criminals will often use your password to log into your accounts to steal more information, which they can use to commit fraud. Common types of fraud include buying goods and services or taking out a credit card or loan in your name.

Bear in mind that if your password is available on the dark web, this doesn’t necessarily mean that a criminal has successfully hacked into your accounts - but they’ve likely tried. It’s essential to change your password as soon as possible to keep your information safe.

What to Do If You've Been a Victim of Identity Fraud: A UK Step-by-Step

If someone has used your identity to open accounts, take out credit or access your money, act in this order. Speed matters - the earlier you report it, the easier it is to have fraudulent entries removed and the less time a fraudster has to build on what they've taken.

Step 1: Secure the compromised accounts first

Start with your email account, because password reset links for everything else land there. Change it to a long, unique password, then work through your banking, payment and shopping accounts. Log out all active sessions where the option exists, and switch on two-factor authentication as you go. Don't change passwords on a device you suspect has malware - use a different, clean device.

Step 2: Contact your bank or lender and freeze affected accounts

Call your bank using the number on the back of your card, not one you've been sent. Tell them explicitly that you're reporting fraud so the call is routed to their fraud team. Ask them to freeze or block affected accounts and cards, flag the transactions in dispute, and confirm in writing what they've done. Under UK rules, banks must investigate disputed unauthorised transactions promptly, and may refund you depending on the circumstances and their own assessment of the claim.

Step 3: Report it to Report Fraud

Report Fraud (reportfraud.police.uk) is the UK's national reporting centre for fraud and cybercrime, covering England, Wales and Northern Ireland. Report online or by phone and keep the crime reference number you're given - lenders and credit reference agencies will often ask for it. If you live in Scotland, report directly to Police Scotland on 101 instead. If money is actively leaving your account as you discover it, call 999.

Step 4: Check all three credit reference agencies, not just one

The UK has three main credit reference agencies - Equifax, Experian and TransUnion - and lenders don't all report to all three. A fraudulent account can appear on one report and not another, so check every one. Look for hard searches you didn't authorise, new accounts, addresses you've never lived at, and financial associations with people you don't know.

Step 5: Apply for CIFAS Protective Registration

Protective Registration places a flag against your name and address in the national fraud database. Lenders then carry out extra checks before approving anything in your name. It normally costs £25 for two years, as set by Cifas, and can slow down your own genuine applications slightly, which is a trade-off most fraud victims are happy to make. It's included free with ClearScore Protect Plus if you become a victim of fraud.

Step 6: Dispute fraudulent entries in writing and keep records

Raise a dispute with the credit reference agency showing the entry, and separately with the lender who placed it. Put it in writing, reference your Report Fraud crime number, and state clearly that the account or search was not made by you. Keep a dated log of every call, the name of every person you spoke to, and copies of all correspondence. The agency has 28 days to investigate and must remove entries confirmed as fraudulent.

Step 7: Keep monitoring for at least 12 months

Stolen data gets resold, so fraud often resurfaces months after the first attempt. Check your credit report at least monthly for a year, watch for post that stops arriving (a sign of mail redirection fraud), and review bank statements line by line rather than glancing at the balance.

Where to get free help and support

Identity fraud is stressful as well as expensive, and you don't have to sort it out alone. Victim Support offers free, confidential help to anyone affected by crime, whether or not they've reported it. Citizens Advice can help with disputes and creditor pressure, and StepChange offers free debt advice if fraudulent borrowing has left you facing demands. If your bank refuses to refund you and you disagree with their decision, you can escalate the complaint free of charge to the Financial Ombudsman Service.

I have a stolen password - what do I do?

ClearScore Protect will guide you through the next steps for password security online if you have one or more stolen passwords.

Can Fraud Affect Your Credit Score? What Happens and How to Fix It

Can fraud affect your credit score and report?

Yes. If a fraudster successfully opens credit in your name, that account appears on your credit report exactly as though you'd opened it yourself. Missed payments on it, the extra debt it represents and the applications made to get it can all pull your score down. The important thing to understand is that this damage can be put right: once an entry is confirmed as fraudulent, it must be removed from your report, and your score is then calculated as though it had never been there.

How does identity fraud show up on a credit report?

The tell-tale signs are usually visible before any real damage is done, which is why regular checking matters:

• Hard searches you don't recognise - a record of someone applying for credit in your name.

• New accounts you never opened - credit cards, loans, mobile contracts or catalogue accounts.

• Addresses you've never lived at - fraudsters add an address so post and cards go to them.

• Missed or late payments on an account you didn't know existed.

• Financial associations with people you have no joint finances with.

• A sudden, unexplained drop in your score with no change in your own behaviour.

How do I remove fraudulent activity from my credit report?

To remove fraud from your credit report, raise a dispute with the credit reference agency showing the entry and, in parallel, contact the lender that reported it. Tell both clearly that the account or search was not made by you, and quote your Report Fraud crime reference number. The agency must investigate within 28 days and will mark the entry as disputed while it does, so other lenders can see it is contested - though each lender still makes its own decision. If the lender confirms the application was fraudulent, the account, the associated searches and any missed payments come off your file entirely. Because the three agencies hold separate files, you'll need to repeat this with each one that shows the entry.

How long does it take to fix a credit score after fraud?

Straightforward cases are often resolved in four to eight weeks - 28 days for the investigation, plus the time it takes the correction to filter through to each agency's file. More complex cases involving several lenders, or where a lender initially disputes your account, can run to three to six months. Once the fraudulent entries are removed, your score doesn't have to recover slowly: it can update as soon as the file is corrected, because the calculation is based on what's on your report at that moment.

Will disputing fraudulent entries hurt my score further?

No. Raising a dispute is not recorded as negative information and has no effect on your score. While an entry is under investigation it's flagged as disputed, which signals to lenders that it shouldn't be relied on. The bigger risk to your score is leaving a fraudulent account sitting on your file untouched, where missed payments will keep accumulating.

What is a Notice of Correction and when should I add one?

A Notice of Correction is a short statement of up to 200 words that you can add to your credit report to explain something a lender might otherwise misread. It's useful when fraud has left a mark that can't be fully removed, or when your file is being flagged because of a fraudster's activity at an old address. Bear in mind that a Notice of Correction has to be read by a human, so it can slow down or block automated credit decisions - add one when the explanation genuinely helps your case, not as a matter of routine.

Who do I contact - the lender, the credit reference agency, or both?

Both, and it's worth doing them at the same time rather than in sequence. The credit reference agency owns the report but cannot change an entry without the lender's agreement; the lender owns the data and is the one who has to authorise its removal. Contacting the agency starts the formal 28-day clock, while contacting the lender's fraud team directly usually gets the account closed and the debt written off faster. You should also report the fraud to Report Fraud and consider a CIFAS Protective Registration to stop further applications in your name.

Does checking your own credit score affect it?

No. Checking your own credit score and report is a soft search. It's visible only to you, never to lenders, and has no impact on your score no matter how often you do it. Only hard searches - the credit checks lenders run when you actually apply for something - are visible to other lenders and can affect your score. That means there's no reason to hold off on checking your report regularly, and it remains the quickest way to spot identity fraud before it does real damage.

Why is ClearScore offering this service for free?

At ClearScore, our mission is to help everyone achieve financial well-being. When we started ClearScore in 2015, we were the UK's first company to offer free access to your Equifax credit report and score.

A great benefit of being able to check your credit report and score regularly is that you can keep an eye out for signs of identity fraud. If you spot credit application searches or new accounts that you don’t recognise on your report, you can take action early. In fact, millions of ClearScore customers use our services for this purpose.

However, as the number of data breaches and hacks increases, we want to ensure our users keep their identities protected. Scanning the dark web is a great way to securely and privately check whether any personal information, such as passwords, has been stolen.

How does ClearScore make money?

Every ClearScore user gets a free scan of the dark web every three months. Given how often the data changes and the number of hacks and breaches, that’s about the right frequency for most people.

However, we are also offering an enhanced service called ClearScore Protect Plus, which runs the scan every day for extra peace of mind. This enhanced service costs £7.99 per month.

What is ClearScore Protect Plus?

ClearScore Protect Plus is an enhanced version of ClearScore Protect.

With Protect Plus, we’ll scan the database every day for your information.

We’ll also search for more of your personal information: not only your passwords but your address, name, phone numbers, national insurance number, and driving licence. And we’ll protect two additional email addresses.

As well as more monitoring, you’ll get personalised fraud support if you do become a victim of identity fraud. We’ll also give you the option to register for a protective registration with CIFAS, which adds additional checks to your credit report, for free (normally £25).

This daily scanning costs us more, and so we charge a small fee of £7.99 a month for this added peace of mind. You can cancel any time.

Layers of Identity Protection: Which Tool Does What

No single tool protects your identity on its own, which is why comparing them head to head can be misleading. They do genuinely different jobs, and a sensible defence uses three layers: detecting that your data has been exposed, detecting that someone is misusing it, and blocking that misuse before it succeeds. Dark web monitoring covers the first layer, credit report alerts cover the second, and a CIFAS Protective Registration covers the third.

How to set up alerts on your credit report

The quickest way to put alerts on your credit report is to enable notifications inside your ClearScore account, so you're told when something changes on your file - a new hard search, a new account, or a change in your score. Turn on both push and email notifications so a change reaches you even if you don't open the app. Because lenders don't all report to the same agency, it's worth registering with more than one credit reference agency and switching alerts on for each. An alert on its own doesn't stop fraud, but it shortens the gap between a fraudster applying and you finding out - and that gap is what decides how much work you face later.

When a CIFAS Protective Registration is worth it

Protective Registration costs £25 and lasts two years, and it's the only one of these tools that prompts lenders to run extra checks that can stop a fraudulent application, rather than just telling you about it. It's clearly worth it if you've already been defrauded, if your passport, driving licence or bank cards have been stolen, or if you've been caught in a breach that exposed identity documents rather than just a password. The trade-off is friction: because lenders run additional checks, your own applications can take longer to approve - and approval always depends on the lender's own assessment of your income, existing borrowing and affordability. If you're about to apply for a mortgage, factor that in. It's included free with ClearScore Protect Plus for subscribers who become victims of fraud.

What none of these tools can do

None of them can delete your information once it's on the dark web, and any service claiming otherwise is overpromising. None of them can stop a company you've done business with from being breached. None will prevent a fraudster who already has your card details from attempting a payment - that's your bank's job. And none of them substitutes for reading your own statements and credit report. What these layers actually buy you is time: the hours or days between your data being exposed and someone using it, which is almost always enough to shut the door.

Can I opt out of ClearScore Protect?

Yes. You can opt out anytime by visiting the “My Account” section on your ClearScore profile.

Start your free dark web scan now and take the first step toward safeguarding your identity.