menuMistho

Complaints & Incident Procedure

Last updated: 10th August 2026.

At Mistho, we are committed to providing high-quality, secure services and handling all complaints, incidents, and identity-related issues fairly, transparently, and promptly.

This policy fulfils our obligations under the UK digital verification services (DVS) trust framework (rule 12.5.5) and relevant data protection legislation.

How to Contact Us

You can reach Mistho at any time using the contact details below:

Complaints: complaints@mistho.io
Incidents or Security Issues: incidents@mistho.io
Postal address:
Mistho Services Limited
27 Old Gloucester Street
London, WC1N 3AX
United Kingdom

For general information on data processing, please refer to our Privacy Policy and Terms & Conditions.

Complaints Procedure

How to Make a Complaint

You can submit a complaint at any time by emailing complaints@mistho.io or by writing to us at the postal address above.

Please include:

  • Your full name and contact details
  • A clear description of your complaint
  • Any relevant supporting information

What Happens Next:

  1. Acknowledgement – We will confirm receipt of your complaint within 24 hours.
  2. Investigation – Your complaint will be reviewed by the relevant Mistho team.
    • If your complaint relates to data privacy or data sharing, our Data Protection Officer (DPO) will be involved.
  3. Involvement of Relying Parties – If your complaint involves data collected or shared with a relying party (for example, an employer, payroll provider, or financial institution), we may need to involve them to investigate and resolve the matter.
    • This includes data subject access, correction, or deletion requests that relate to data shared externally.
  4. Resolution – We aim to provide a full response within 7 days.
    • If we require more time, we will inform you and provide an updated timeline.
  5. Escalation – If you are not satisfied with our response, you may escalate the matter to the Information Commissioner’s Office (ICO) or another relevant regulator.
    • If your complaint concerns our certified verification service and you are not satisfied with our final response, you may also escalate it to our certification body, the Kantara Initiative, or to the Office for Digital Identities and Attributes (OfDIA).
  • Transparency: We will keep you informed throughout.
  • Fairness: All complaints are handled impartially.
  • Confidentiality: Only those necessary to the investigation will have access.
  • Continuous Improvement: We analyse complaints regularly to enhance our services.

Incident Reporting Procedure

Mistho treats any event that could impact the confidentiality, integrity, availability, or privacy of our systems or users as an incident.

How to Report an Incident

  • Email incidents@mistho.io as soon as possible.
  • Include details such as:
    • The date/time of the event
    • Description of what happened
    • Any data or users potentially affected
    • Your contact details

How We Respond

Our Incident Response Team (per our internal Incident Response Plan) will:

  1. Acknowledge the report within 1 business day.
  2. Triage and classify the incident (Severity 1–4).
  3. Investigate and contain the issue to prevent further impact.
  4. Recover and remediate affected systems or processes.
  5. Notify affected users and regulators when required:
    • If a data breach occurs, we notify the ICO and/or OfDIA within 72 hours and affected users without undue delay.
  6. Close the incident after documentation, root-cause analysis, and lessons learned.

We follow NCSC and ISO27001 best practice for incident management.

Identity Repair

If you believe your identity has been misused or compromised in connection with data shared through Mistho, we will help you establish exactly what was shared and support your recovery.

How to reach us

Email complaints@mistho.io. If you can, use the subject line “Identity Repair” — it helps us route your request quickly. This is a convenience only: your request is handled in exactly the same way under this procedure however you label it, and you will not be delayed, deprioritised or turned away for leaving it out.

Support while we deal with your case

Identity theft is stressful and people’s circumstances differ. We will check whether you need additional support — for example because of ill health or disability, a bereavement or other major life event, financial difficulty, or because you would like things explained differently or confirmed in writing — and we will adjust how we handle your case accordingly. We can also point you to Victim Support (08 08 16 89 111) and Citizens Advice.

What we will do

  1. We will acknowledge your request within 24 hours.
  2. We will establish and document exactly what was shared — when, with whom, on what basis and through which route — and provide that record to you on request to support your recovery.
  3. We will coordinate with the relying party (the organisation that requested your verification), since they control the data once shared, so that any application made in your name can be unwound.
  4. We will share relevant logs or evidence to support the investigation and, if appropriate, help retract or flag erroneous verifications.
  5. We will give you the guidance set out below, and explain any part of it that would help.
  6. We will document and close the case once resolution is achieved.

What you should do

The steps below are the ones that will protect you. We are not able to carry them out on your behalf, but we can explain any of them.

Immediate protective measures

  • Change the password on the government service account that was used — HMRC Government Gateway, DWP Universal Credit or the equivalent — and turn on or re-check two-factor authentication.
  • Change the password on any email account linked to that service.
  • Secure your home wifi network.
  • Ask any organisation processing an application in your name to place it on hold.

Report it

  • Report the fraud to Report Fraud (City of London Police), which replaced Action Fraud, or to the equivalent service in your country.

Restoring the account that was used

  • Contact the authoritative source directly — HMRC, DWP or the equivalent service in your country — to secure the account. That is the credential that was compromised. Mistho does not hold user accounts and does not issue credentials, so the account you need to secure is always the one held at the source, never a Mistho account.

If you have lost money

  • Where money has been lost, the claims process of the bank or finance provider concerned is the route to recovery. Mistho holds no funds and does not operate a reimbursement scheme.

Protecting against further misuse

  • Contact the credit reference agencies — Equifax, Experian and TransUnion — and check the file held on you.
  • Consider a credit checking or monitoring service to detect accounts opened in your name.
  • Contact your creditors — banks, credit card providers, store cards, phone and utility companies — to alert them or, where they are unaffected, to ask them to monitor.
  • Review your passwords for banking, email and social media, and change any that you have reused.
  • Consider a password manager to generate and store passwords securely.
  • Consider an identity protection service, such as Cifas protective registration.
  • Register with the Mailing Preference Service and the Telephone Preference Service.
  • Register for free property alerts with the Land Registry.

Fraud Reporting

If you suspect fraudulent activity (e.g. impersonation, account misuse, or attempted identity theft):

  • Report immediately to incidents@mistho.io.
  • Our ISMT will investigate per our Fraud Management Policy and Procedure.
  • Where criminal fraud is confirmed, we will:
    • Notify affected relying parties and users
    • Preserve evidence for at least 6 years
    • Cooperate with law enforcement under lawful basis

Fraud cases are logged in Mistho’s Fraud Case Register and reviewed quarterly as part of Trust Framework compliance.

Data Subject Access Requests (DSARs)

If you wish to:

  • Access the data we hold about you
  • Request correction or deletion
  • Object to processing or withdraw consent

You can contact privacy@mistho.io or complaints@mistho.io.

We will:

  1. Verify your identity.
  2. Respond within one month (or sooner where possible).
  3. Where data has been shared with a relying party, we will direct or coordinate your request with them to ensure full compliance with GDPR Article 19.

Verification Failures & Alternative Options

If you cannot complete data sharing successfully through Mistho:

  • The relying party may restart the process to allow another attempt.
  • If repeated attempts fail, the relying party will remain your main contact to discuss alternative verification methods, such as manual or in-person checks.

Review and Continuous Improvement

  • This procedure is reviewed annually or after any significant incident or regulatory update.
  • Updates are approved by Mistho’s Information Security Management Team (ISMT).
  • The policy forms part of our ISMS and Trust Framework control set under Section 12.5 (Responding to Incidents).

Contact summary: