PanicStation.org
UK USA
uk Money & financial emergencies

What to do if…
an unfamiliar authorized user appears on your credit account

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Treat it as possible account takeover or a serious account error until your provider confirms what happened. Contact the card provider or lender’s fraud team now, ask them to remove the user, cancel any additional cards, and secure the account.

Do not do these things

  • Don’t wait to see if anything else happens; the provider can usually act sooner if you report it promptly.
  • Don’t use a phone number from a text, email, advert, or search result that could be fake.
  • Don’t confront anyone you suspect from your usual email, messaging, or phone accounts if those accounts might be compromised.
  • Don’t share screenshots of your account page; they may reveal partial numbers, addresses, balances, or security details.
  • Don’t close the account in-app before speaking to the provider’s fraud team, unless the provider tells you to.
  • Don’t assume it is only a credit file error if the new user appears inside your lender’s own account view.

What to do now

  1. Freeze the card and secure access.

    • If your provider offers it, freeze or lock the card in the app.
    • Use a trusted device and a trusted internet connection.
    • Change the password on the credit account.
    • Change the password on the email account used for resets.
    • Turn on two-step verification where available.
    • Check your email for unfamiliar forwarding rules, recovery details, or logged-in devices.

  2. Contact the provider’s fraud team using a trusted route.

    • Use the number on the back of the card, a statement, or the provider’s official website.
    • Ask them to remove the authorised user or additional cardholder.
    • Ask them to cancel any additional cards already issued.
    • Ask whether the card number needs replacing, not just the plastic card.
    • Ask them to add any extra verification they offer, such as a telephone passphrase or fraud note.

  3. Ask the provider what changed.

    • Ask for the date and time the user was added.
    • Ask how the user was added, such as online banking, app, phone, branch, or written request.
    • Ask whether the postal address, phone number, email address, contact preferences, app logins, devices, or credit limit were changed.
    • Ask the provider to confirm the outcome in a secure message, email, or letter.

  4. Check transactions and stop further use.

    • Review recent transactions, cash withdrawals, balance transfers, money transfers, and pending payments.
    • Tell the provider which items you do not recognise.
    • Ask what can be stopped immediately, including pending payments, merchant charges, and continuous payment authorities.
    • Ask the provider to start its unauthorised transaction process for anything you did not authorise.
    • Keep a simple timeline of dates, times, names, reference numbers, and what was agreed.

  5. Check your UK credit reports.

    • Check your statutory credit report with Experian, Equifax, TransUnion, and Crediva.
    • Look for new credit applications, searches, accounts, addresses, financial associations, or credit limits you do not recognise.
    • Dispute anything unfamiliar with both the credit reference agency and the lender shown on the entry.
    • Save copies of relevant entries before and after any corrections.

  6. Add extra identity-fraud protection if your details may be at risk.

    • Consider Cifas Protective Registration if you think your personal details may be used to apply for credit or services.
    • Cifas currently lists Protective Registration as £30 for two years; check the current price and term before paying.
    • Ask each credit reference agency whether it offers any extra verification, correction wording, or dispute marker that fits your situation.

  7. Report fraud in the right place for where you live.

    • If you live in England, Wales or Northern Ireland, report identity fraud through Report Fraud.
    • If you live in Scotland, report fraud to Police Scotland by calling 101.
    • Keep the report reference with your provider notes.

  8. Use the formal complaint route if the provider does not fix it.

    • Tell the provider you want this treated as possible unauthorised access or fraud.
    • Make a formal complaint if the user is not removed, losses are not handled, or the provider will not correct account or credit-file records.
    • If you receive a final response and remain unhappy, you can usually take the complaint to the Financial Ombudsman Service.
    • If the provider has not replied within eight weeks, you can usually refer the complaint to the Financial Ombudsman Service.
    • After a final response, a six-month time limit usually applies, so check the date on the final response letter.

What can wait

  • You do not need to decide today whether to close every account, switch banks, or change every financial product.
  • You do not need to buy paid identity protection services in the first hour to be safe.
  • You can wait to reset every non-financial password until the credit account and email account are secured, the new user is removed, and extra cards are cancelled.
  • You can wait to write a full complaint if the provider is actively securing the account and giving you a reference.

Important reassurance

A new authorised user or additional cardholder is alarming, but it can be caused by fraud, account error, or misuse of existing access. The useful first move is not to solve everything at once; it is to secure access, contact the provider, stop further use, check your credit reports, and keep a record.

Scope note

These are first steps only, to stabilise the situation and prevent avoidable harm. Later decisions about liability, refunds, credit-file correction, complaints, or legal rights may need the provider’s formal process, a regulator or ombudsman route, or specialist help.

Important note

This guide is general information, not legal, financial, fraud-investigation, or professional advice. If money is actively leaving your accounts, contact your provider urgently through a trusted route.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us