How to Challenge a CIFAS Marker? Step by Step Guide

What Is a CIFAS Marker and Why Does It Matter

CIFAS operates a shared fraud prevention database used by member organisations across financial services and other sectors, including parts of the public and voluntary sectors.

When a member identifies or suspects that an individual has committed or attempted to commit fraud, it may file a CIFAS marker against that person on the database. Other member organisations can then see that marker when they carry out checks, for example, when someone applies to open an account or takes out a financial product.

A CIFAS marker reflects the filing member’s assessment at the time of filing. It is not a criminal conviction and it is not a judicial finding. The filing standard requires the member to hold reasonable grounds for believing that fraud occurred or was attempted.

That threshold is subjective, and it has been challenged and overturned in several cases. The fact that reasonable grounds existed in the member’s view does not mean the filing was accurate or procedurally correct.

In practice, a CIFAS marker may lead to declined banking applications, account restrictions, difficulties obtaining credit or concerns during certain employment checks.

If you believe a marker has been recorded incorrectly, obtaining the relevant information is the first step towards challenging it.

Types of CIFAS Marker and How Long They Last

The type of CIFAS marker that has been filed affects both the evidence relevant to a challenge and the length of time the marker remains on the database.

Victim of Impersonation is filed by a lender to protect an individual after identity fraud has occurred. This marker lasts 13 months and is intended to protect rather than penalise the subject. Protective Registration is a separate marker that an individual can request themselves if they suspect they have been a victim of identity fraud. It lasts two years and signals to members that extra care should be taken when processing applications in that person’s name.

Common adverse fraud marker categories include:

• First-Party Fraud: Where someone is suspected of obtaining goods or services without intending to pay.
• Facility Takeover: Where an account or financial product is taken over and used without authorisation.
• Misuse of Facility: Where an account or financial service is suspected of being used for fraudulent purposes.
• Asset Conversion: Where goods subject to a finance agreement are sold or disposed of without the required authority.
• Application Fraud: Where an application contains deliberately false or misleading information, such as inaccurate income or employment details.
• False Insurance Claims Fraud: Where an insurance claim involves information suspected of being deliberately false or misleading.

Common adverse fraud markers can remain on the database for up to six years.

However, retention periods depend on the category, and a marker may be removed earlier following a successful challenge.

Step 1: Request Your Records From CIFAS

Your right to request your records

Under UK GDPR, you have a legal right to request the personal data held about you by CIFAS through a Data Subject Access Request (DSAR). CIFAS normally responds within one calendar month.

The DSAR response will typically confirm which member organisation filed the CIFAS marker, the type of marker registered and the date it was registered.

How to submit the request

Visit cifas.org.uk and find the Data Subject Access Request section. An online form is available, and a postal route also exists. You will need to provide your full name, date of birth, address history for the last six years, your telephone or mobile number and your email address. You will also need to supply two proofs of identity, such as a passport, driving licence, bank statement or utility bill.

What the response will and will not tell you

The DSAR response from CIFAS is typically a limited dataset. It confirms that a CIFAS marker exists and identifies the filing organisation, but it does not contain the full body of internal evidence used to support the filing. The filing organisation is not required through the CIFAS DSAR to disclose every internal note or document used in its assessment.

For example, the bank’s internal investigation notes, account records or communications may need to be requested separately. This means the CIFAS DSAR is the starting point rather than the complete evidence needed for a challenge. Keep a copy of your request, the response and the dates of all correspondence.

Step 2: Request Relevant Information From the Filing Organisation

Why a separate request to the filing organisation matters

The DSAR to CIFAS tells you that a CIFAS marker exists and which organisation filed it. It does not supply the underlying evidence that the organisation relied upon. To understand and properly challenge the basis of the filing, you should make a separate DSAR directly to the organisation that filed the marker.

This second request can be submitted at the same time as the CIFAS DSAR, or immediately after you receive the CIFAS response.

What to ask for

Your request should cover personal information held in connection with the relevant account, application or investigation.

Ask for:

• The recorded reasons for filing the CIFAS marker.
• Relevant internal notes, fraud assessments and investigation records.
• Communications concerning the account, including letters, emails and call records.

You may also request relevant transaction records or information used when deciding to record the marker. Set out your request clearly in writing so the organisation understands which information you are seeking.

What the organisation may withhold and why

An organisation may rely on exemptions under data protection law, including the prevention or detection of crime exemption, to withhold certain information. Reliance on an exemption does not mean the CIFAS marker is correct.

It may, however, limit the amount of detail available to you before you reach the complaint stage. Where key information is withheld, legal advice can assist in identifying whether the withholding is lawful and whether there are grounds to challenge it.

Keeping records of your requests

Keep copies of each request and response, including the dates they were sent and received. These records may become important if you later need to complain to Cifas, the Financial Ombudsman Service or another organisation.

Subject access requests normally have a one-month response period, although extensions may be permitted in certain circumstances. If an organisation fails to respond within the applicable deadline, you may have grounds to raise a separate data protection complaint.

Step 3: Submit a Written Complaint With Supporting Evidence

The CIFAS filing standard

Before drafting your complaint, it helps to understand the standard the filing organisation was required to meet. CIFAS requires its member organisations to hold reasonable grounds for filing a CIFAS marker, meaning evidence sufficient to support a genuine belief that fraud occurred or was attempted.

A challenge to a marker is, in effect, an argument that those reasonable grounds did not exist, or that the filing was procedurally incorrect. Your complaint should be focused on that question.

What a persuasive complaint should include

Start with a clear, accurate timeline of events relating to the account or transaction in dispute. Identify specifically which finding or findings you dispute and explain why, referring to the evidence available to you. Include copies of relevant communications, such as letters, emails and messages, and any responses you have already received from the organisation.

Where account compromise or identity theft is the basis of your dispute, include supporting evidence. This may include:

• A police crime reference number
• An Action Fraud report reference
• Correspondence from your bank confirming a fraud report
• Any Protective Registration confirmation from CIFAS

A crime reference number or Action Fraud report reference is supporting evidence, but it is not by itself conclusive proof that the CIFAS marker was filed incorrectly. It forms part of a broader evidential picture.

Statements from third parties can be valuable where they are relevant. A landlord confirming your address or an employer confirming your employment details may directly address a specific ground on which the marker was filed.

Include any evidence showing that you did not authorise the transactions or applications in question, such as account statements, correspondence or device records where available.

What a complaint need not include?

Your complaint does not need to include personal background unrelated to the dispute, unverified claims about the organisation’s internal processes, or any assertion of a particular outcome.

Keep it factual, evidence-based and focused on the specific grounds you are challenging. A precise, well-evidenced complaint is more effective than a lengthy one containing irrelevant material.

Where to send the complaint and what happens next

Address the complaint to the filing organisation’s complaints team or, where appropriate, its data protection officer. Keep a copy of everything submitted, with proof of delivery if sent by post. 

For most complaints involving FCA-regulated financial firms, the organisation has up to eight weeks to provide a final response. However, some complaints involving payment services, electronic money or fraud and scams are subject to shorter complaint-handling deadlines. The relevant timescale depends on the nature of your complaint.

If the organisation upholds your complaint, it will notify CIFAS and the CIFAS marker should be amended or removed. If it does not uphold the complaint, or does not respond satisfactorily within the applicable timeframe, you can move to the next stage.

Step 4: Request a CIFAS Review

What a CIFAS review is

If the filing organisation does not uphold your complaint or does not respond satisfactorily, you can request that CIFAS carry out an independent review. 

CIFAS considers whether the member followed the appropriate procedures and whether the information met its filing standards. This review is separate from the organisation’s internal complaints process. It is not a criminal investigation or a court hearing.

If CIFAS concludes that the marker should not have been recorded, it can arrange for the information to be corrected or removed.

How to request a review

You must normally complete the filing organisation’s complaints process and obtain its final response before requesting a CIFAS review. Contact CIFAS through its complaints procedure and provide the relevant details.

These should include your personal information, CIFAS DSAR reference, the organisation’s final response and any supporting correspondence. CIFAS will then review the complaint with the organisation concerned.

You can find the procedure on the CIFAS complaints page.

What CIFAS will and will not assess

CIFAS will assess whether the filing member complied with its filing standards and procedures. It is not a court and it does not make findings of fact about whether fraud occurred.

Its review is focused on whether the CIFAS marker was filed correctly according to its own rules. If CIFAS concludes that it was not, it has the power to direct removal or amendment of the marker.

What to do while the review is ongoing

Continue keeping records of correspondence and any decisions received. If you are also considering a complaint to the Financial Ombudsman Service, pay particular attention to the applicable deadlines.

A CIFAS review does not automatically extend the time available to refer a complaint to the Ombudsman. Depending on your circumstances, you may need to pursue more than one complaints process.

Step 5: Consider the Financial Ombudsman or Other Appropriate Routes

The Financial Ombudsman Service

The Financial Ombudsman Service (FOS) can consider eligible complaints against financial businesses within its jurisdiction. If the organisation that filed your CIFAS marker is covered by the FOS, you may be able to refer the dispute after receiving its final response.

For most complaints, you can also approach the Ombudsman if eight weeks have passed without a final response. Shorter timeframes apply to certain payment-service complaints.

You generally have six months from the date of a valid final response to refer the complaint. This deadline should not be overlooked while waiting for a CIFAS review or another process to finish.

Limited exceptions may apply, but you should not assume that a late referral will be accepted. The FOS can investigate whether the financial business acted fairly when recording the marker. Where it upholds a complaint, it may require the business to take corrective action, including arranging removal of an incorrectly recorded marker.

Compensation may also be awarded where appropriate.

Where the FOS may not apply

Not every CIFAS member is FCA-regulated. Public sector bodies, certain insurers and some other organisations may fall outside the FOS’s jurisdiction. If the filing organisation is not within the FOS’s scope, this route will not be available and you will need to consider alternative options, which may include a complaint to the ICO or, in appropriate cases, a court claim.

The Information Commissioner’s Office

The Information Commissioner’s Office (ICO) is the UK’s data protection regulator. You can complain to the ICO if you believe an organisation has handled your personal information unlawfully.

For example, your complaint might concern inaccurate personal data, inappropriate retention or the refusal to disclose information under a subject access request.

The ICO can consider whether an organisation has complied with data protection law and take regulatory action where appropriate. However, an ICO complaint does not automatically result in a CIFAS marker being removed. It is a separate process from a CIFAS review or an FOS complaint.

Court proceedings

Where other routes have not produced a satisfactory outcome, a court claim may be available. This could include a claim under data protection legislation for compensation or a claim in defamation where the circumstances justify it.

Court proceedings are a significant step and require careful legal assessment before they are commenced. Legal advice is strongly recommended before this route is considered.

A note on commercial removal services

You may encounter commercial services that offer to remove CIFAS markers for a fee. The FCA has warned consumers about firms that falsely claim to guarantee the removal of CIFAS markers or that misrepresent what they can do. Not every CIFAS marker removal service requires FCA authorisation, but you should understand precisely what any service is offering and verify its credentials before engaging it.

No provider can guarantee removal, because the outcome of any challenge depends on the evidence and the specific circumstances of the filing.

How Long Can the Process Take?

The full CIFAS marker challenge process may take several months, particularly where a dispute proceeds through multiple stages. CIFAS normally responds to a completed subject access request within one calendar month.

A separate DSAR to the filing organisation usually has a similar response period, subject to permitted extensions. The filing organisation’s complaint investigation may take several weeks.

CIFAS aims to resolve its independent reviews within one month, although some cases take longer. A complaint referred to the Financial Ombudsman Service may take additional time, particularly where the evidence is complex. If the dispute passes through several stages, the overall process may take six months or longer.

Keep records of every request, complaint and response. Most importantly, track any deadlines for referring the matter to the Financial Ombudsman Service or another body.

What if There Is a Parallel Criminal Investigation?

In some cases, a CIFAS marker may be filed in connection with conduct that is also the subject of a police investigation or criminal proceedings. Where that is the position, the interaction between the civil challenge process and the criminal process requires careful handling.

For example, providing a detailed written explanation of disputed transactions to a bank could have implications for a related criminal investigation. This does not mean you should ignore the CIFAS marker or miss complaint deadlines.

However, it may be sensible to obtain legal advice before making detailed representations about the underlying allegation. A solicitor can help you understand how the civil complaints process and criminal investigation may affect each other.

They can also advise on preserving evidence and meeting deadlines while protecting your position in any criminal proceedings.

How a Fraud and Financial Crime Solicitor Can Help

Challenging a CIFAS marker can involve several organisations, different evidence requirements and separate complaint deadlines.

A solicitor experienced in fraud and financial crime can review the CIFAS subject access response and the information obtained from the filing organisation. They can assess whether the evidence supports the marker and whether the organisation followed the required procedures.

Where appropriate, they can help prepare a written complaint that addresses the specific reasons for the filing.

If information has been withheld, a solicitor can advise whether the organisation appears to have relied on a lawful exemption. They can also advise on escalation to CIFAS, the Financial Ombudsman Service or the Information Commissioner’s Office. Where a criminal investigation is connected to the marker, legal advice can help ensure that the complaints process is approached without unnecessarily affecting the criminal matter.

No solicitor can guarantee removal of a CIFAS marker. However, a solicitor can assess the strength of your challenge, explain the available options and help you present the relevant evidence.

Speak to our Fraud and Financial Crime solicitor for advice about your circumstances and next steps.