Cifas Protective Registration: How the UK Flag Works

A £30, two-year warning flag in the National Fraud Database for people whose details may have been stolen.

By Siddharth ShankarUpdated October 23, 2026

If your personal details have been stolen or misused in the UK, Cifas offers a service that works like a warning label on your identity. This guide follows the information on Cifas’s own Protective Registration page.

What it is

Protective Registration is a fraud prevention service for people whose personal details may have been stolen or misused. Cifas places a warning flag against your name and personal details in its National Fraud Database. Cifas members that use its data are then alerted to check carefully when your details are used for an application.

What it costs and how long it lasts

The price is £30 for two years, or 24 months. You can ask for it to be removed earlier. Cifas says it will not email you when the registration is about to expire, so you need to reapply if you want to renew.

How it works in practice

When someone applies for a product using your details, a lender that checks Cifas data will see the flag and know to be more careful. Cifas says genuine applications by you may take slightly longer. Where the risk is very low, some companies may accept an application without contacting you.

What it does not do

Cifas is clear about the limits.

• It does not affect your credit score.
• It is not insurance against fraud losses.
• It does not cover transactions such as credit or debit card payments, so it will not affect products you already use.
• Not all applications are checked. Cifas advises you to check your credit report regularly and to consider a credit report monitoring alert.

Who can apply

Protective Registration is for individuals only, not organisations. Each person at an address must apply separately. You must live at the address, although you can register a UK property that you own but do not live in if its details have been compromised.

How to apply

Use the online application form only. Cifas does not accept applications by phone, and its office is closed to the public. The payment card must be in your name, and its billing address must match the address on your application. You will receive a separate payment confirmation email from the payment provider. You can update details such as your address, or cancel, at any time.

When it is most useful

Cifas says the service is most effective in the first few months after your data is lost. Continuing to use it after the threat has passed makes it harder to identify the people most at risk. In other words, it is meant for people who have a reason to worry, not as a permanent default.

What else to do

Protective Registration is one layer. Add these:

1. Check your credit reports and look for accounts you do not recognise.
2. Change passwords on accounts linked to the stolen details, and turn on two-factor authentication.
3. Tell your bank if card or account details were involved.
4. Be alert to follow-up scams. Criminals who have your details may try to trick you again.
5. Read our guides on what to do if your identity is stolen and how to prevent identity theft.

Comparing it with a credit freeze

Some countries offer credit freezes that block new credit reports from being shared. Cifas’s service works differently: it flags your details for extra checking rather than blocking access. See credit freeze vs fraud alert for the US approach.

Reducing exposure in the UK

Your electoral register entry can be a source of personal details; read the open register guide. To ask an organisation what it holds about you, see how to make a subject access request.