CIFAS Marker Types Explained: What Your Subject Access Response Means

How to Identify the CIFAS Record on Your File

What a CIFAS subject access request tells you

A data subject access request (DSAR) to CIFAS is easily accessible and can be submitted online. CIFAS normally responds within one calendar month of receiving a fully completed form and the required supporting documentation. The right of access is grounded in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If CIFAS holds a record about you, the response should identify the relevant filing information, including the organisation that submitted it, the filing date and the record category. It may also contain details of organisations that have searched the database using your information, for example after a bank account or credit application.

Standard credit reports from Experian, Equifax and TransUnion will not reliably show CIFAS markers. However, two protective victim categories, Victim of Impersonation and Victim of Takeover, can appear on credit files.

Getting the investigation file from the filing organisation

Your CIFAS subject access response may identify the organisation that recorded the marker, but it will not necessarily contain all the evidence behind that decision.

The underlying investigation records are generally held by the bank, lender or other organisation responsible for the filing.

You can make a separate subject access request to that organisation, asking for personal information relating to the investigation and its decision.

This may include relevant communications, account records, internal notes and other information held about you.

However, some material may lawfully be withheld, particularly where disclosure could prejudice the prevention or investigation of crime. The documents you receive can help establish whether the organisation had sufficient grounds to record the marker.

Protective Records and Adverse Fraud Records: The Difference

The CIFAS National Fraud Database records two fundamentally different things: information about people who may have been victims of fraud, and member organisations’ assessments that fraud may have been committed by the person named.

These two purposes produce CIFAS markers with very different consequences.

Protective records exist to help the person named. They warn CIFAS member organisations to apply enhanced checks before processing an application in that person’s name. These include Victim of Impersonation and Victim of Takeover records.

They alert member organisations to carry out additional checks when applications or transactions involve the affected person’s details.

CIFAS also offers Protective Registration, a separate service that individuals can request when they believe their personal information is at risk. Adverse fraud records, by contrast, reflect a member organisation’s assessment that the person recorded may have been involved in fraudulent activity.

They do not appear on standard consumer credit reports but can be seen by Cifas members carrying out relevant checks. Adverse records may affect access to financial products and, in some cases, employment opportunities.

Understanding which type appears in your subject access response is therefore important. The category determines its meaning, the applicable retention period and the evidence relevant to any challenge.

CIFAS Marker Types and What They Mean

Protective Registration

Protective Registration is a voluntary service you can request if you believe your personal details have been compromised or you are at risk of identity fraud. It is not an allegation of wrongdoing.

When member organisations see a Protective Registration warning, they may carry out additional identity checks before processing an application in your name.

For example, someone whose passport and other identity documents were stolen might request Protective Registration to make fraudulent applications harder.

Protective Registration lasts two years. You can request its removal earlier or apply again if you still need protection after it expires. It is separate from the eight fraud and victim record categories explained below.

1. Victim of Impersonation

A Victim of Impersonation record is created when an organisation identifies that someone has used another person’s identity details without their knowledge or consent.

This is a protective marker, not an accusation against the person whose identity was misused. For example, a lender may record this category after discovering that someone used another person’s name and date of birth to apply for credit.

The purpose is to alert other organisations so they can make additional checks when those identity details are used again. This record remains for 13 months from submission and may appear on the person’s credit file.

2. Victim of Takeover

A Victim of Takeover marker is recorded when someone gains unauthorised access to an existing account or financial product belonging to another person. It is intended to protect the genuine account holder.

For example, if a fraudster obtains someone’s online banking credentials and makes unauthorised transfers, the bank may record a Victim of Takeover marker. This is different from the adverse Facility Takeover category.

Victim of Takeover identifies the person whose account was compromised, while Facility Takeover concerns the suspected fraudulent takeover itself. A Victim of Takeover record remains for 13 months and may appear on standard credit files.

3. Application Fraud

Application Fraud is an adverse CIFAS marker recorded where an organisation concludes that someone submitted false or misleading information when applying for a product or service.

Examples may include inaccurate income details, false employment information or altered supporting documents.

For instance, a lender may file this marker if it believes someone deliberately overstated their salary on a mortgage application. The distinction between deliberately misleading information and an honest error is important. Application Fraud markers can remain for up to six years.

They do not appear on standard credit reports but may be visible to CIFAS member organisations. The filing reflects the organisation’s assessment, not a criminal conviction, and it can be challenged where the evidence does not support it.

4. Identity Fraud

Identity Fraud is recorded where an organisation identifies the fraudulent use of another person’s identity or a fabricated identity to obtain a product or service. It differs from Application Fraud because the concern involves the identity used rather than simply inaccurate information in an application.

For example, a bank may identify that an application was submitted using identity documents belonging to someone else. This category can remain for up to six years.

It is important to establish whose details appear in the filing and whether the person recorded is alleged to have committed the fraud or was affected by impersonation. A solicitor can help clarify the information where the record is unclear or disputed.

5. Facility Takeover

Facility Takeover concerns the unauthorised takeover of an existing account or financial product. For example, a bank may identify that someone obtained access to another person’s account and used it to carry out transactions without permission.

This is distinct from the protective Victim of Takeover marker.

Facility Takeover describes the suspected fraudulent activity, while Victim of Takeover protects the person whose account was compromised. Facility Takeover records can remain for up to six years.

If you believe a filing is incorrect, the relevant challenge will usually involve examining the evidence of unauthorised access and how your details became connected to the account.

6. Misuse of Facility

Misuse of Facility is an adverse CIFAS marker recorded where an organisation concludes that an account or financial product has been used for fraudulent purposes. It is frequently associated with money mule allegations.

For example, a bank may identify that an account received money connected to fraud and then transferred it to other accounts. The bank may consider whether the genuine account holder knowingly allowed the account to be used in this way.

However, a Misuse of Facility marker does not, by itself, prove that the account holder knew the funds were connected to fraud. The person’s explanation, communications and account activity may all be relevant to a challenge. Misuse of Facility markers can remain for up to six years.

7. Asset Conversion

Asset Conversion concerns the disposal of an asset that remains subject to a finance agreement where the lender retains an interest in it. For example, someone may sell a car under a hire purchase agreement without the finance company’s knowledge or consent.

The lender may investigate whether the sale breached the agreement and involved fraudulent conduct. An Asset Conversion CIFAS marker can remain for up to six years.

The nature of the finance agreement, the circumstances of the sale and what the person understood about their obligations may all be relevant when challenging the filing.

8. False Insurance Claims Fraud

False Insurance Claims Fraud is recorded where an insurer concludes that a claim involved deliberately false or misleading information. This can include exaggerating the value of a genuine loss, claiming for an event that did not occur or submitting inaccurate supporting documents. For example, an insurer may file this marker if it believes someone deliberately overstated the value of items allegedly stolen during a burglary.

However, a disagreement about valuation or an innocent mistake does not automatically establish deliberate fraud. The evidence supporting the insurer’s conclusion is therefore important.

False Insurance Claims Fraud markers can remain for up to six years and may affect applications for insurance or other services provided by CIFAS members.

How Long Do CIFAS Records Last?

Retention periods for each CIFAS marker type vary by category and run from the date the record was submitted to the database, not from the date it was discovered.

Protective Registration is retained for two years. Victim of Impersonation and Victim of Takeover are each retained for 13 months from the date of submission. These are the protective CIFAS marker categories.

All adverse fraud CIFAS marker categories, including Application Fraud, Identity Fraud, Facility Takeover, Misuse of Facility, Asset Conversion and False Insurance Claims Fraud, are retained for six years from the date of recording.

A CIFAS marker filed in January 2022, for example, would remain until January 2028 unless successfully challenged and removed earlier.

Misuse of Facility and Money Mule Allegations

Misuse of Facility deserves particular attention because it is commonly associated with alleged money mule activity.

A money mule allegation arises when a bank concludes that an account was used as a conduit for funds connected to fraud or other criminal activity. The account may have received deposits from a third party and transferred them onward, often in a pattern the bank considers inconsistent with ordinary personal banking.

The bank’s conclusion may be that the account holder allowed this knowingly, or it may be that the account was itself compromised without the holder’s awareness.

The filing of a Misuse of Facility CIFAS marker does not prove that the account holder knew the funds were connected to fraud. Dishonesty and knowledge are not established by the filing itself. They are factual questions that depend on the specific circumstances, the account holder’s explanation, any communication with the bank at the relevant time and the wider pattern of account activity.

The circumstances that led to the account activity are directly relevant to whether the Misuse of Facility CIFAS marker was filed on proper grounds and whether it can be challenged.

In January 2025, CIFAS introduced changes to the way certain money mule activity is recorded. If your subject access response was issued after that date, it is worth confirming with a solicitor whether the CIFAS marker category recorded reflects the current classification framework, as any discrepancy may be relevant to a challenge.

How the Category Affects Your Challenge

The type of CIFAS marker recorded against you determines what evidence is relevant to challenging it. Each category concerns different conduct, so a challenge should address the particular allegation made by the filing organisation.

For example, an Application Fraud challenge may focus on whether information supplied in an application was deliberately misleading.

A Facility Takeover dispute may involve evidence about who accessed an account and whether that access was authorised. For Misuse of Facility, the focus may be on the transactions, the source of funds and whether the account holder knowingly participated in fraudulent activity.

Protective records involve different concerns. If you believe a victim record contains inaccurate information, you can ask the relevant organisation to review it. For adverse markers, the organisation must have sufficient grounds for the filing.

If its evidence is inaccurate, incomplete or does not meet the required standard, you may have grounds to request removal.

How do you start a CIFAS marker challenge?

Start by complaining to the organisation that recorded the marker. Explain why you dispute the information and provide relevant supporting documents. If the organisation rejects your complaint, request its final response. You can then ask CIFAS to conduct an independent review.

Depending on the circumstances, further options may include the Financial Ombudsman Service or the Information Commissioner’s Office.

How a Fraud and Financial Crime Solicitor Can Help

Identifying the CIFAS marker on your subject access response is only the first step. Understanding why it was recorded, what evidence the organisation relied on and whether the filing met the required standard may require a closer review. A fraud and financial crime solicitor can examine your CIFAS response alongside the information obtained from the filing organisation.

They can assess the grounds for the marker and advise whether the evidence supports a challenge. Where appropriate, they can help prepare a formal complaint and communicate with the organisation responsible for the filing.

If the complaint remains unresolved, a solicitor can also advise on escalation to CIFAS or the relevant complaints and regulatory bodies. Where the circumstances may involve a criminal investigation, they can consider how that affects the approach to challenging the marker.