What is a CIFAS marker?
A CIFAS marker is a fraud flag recorded against your name on the CIFAS National Fraud Database. CIFAS, originally the Credit Industry Fraud Avoidance System, is a UK-based fraud prevention organisation. Its members include banks, lenders, insurers, telecoms providers, and some employers. When a member believes you've been involved in fraud, they can file a marker against you.
Once filed, that marker is visible to every CIFAS member, over 775 organisations. It stays on the database for up to six years from the date it was filed. During that time, any organisation that checks CIFAS will see it. Most will automatically decline your application.
A CIFAS marker is not a criminal conviction. No court is involved. No independent body reviews the evidence. The institution files it unilaterally, often without telling you. You typically find out when you're refused a bank account, a loan, a mobile phone contract, or a job, and nobody will explain why.
According to CIFAS Fraudscape 2026, 444,993 markers were filed in 2025, up 6% year-on-year. That's nearly half a million people. A significant proportion are filed against individuals who were victims of fraud, manipulated into receiving or transferring money, or who made genuine mistakes on financial applications.
Key point: A CIFAS marker is an allegation, not a verdict. The institution that filed it was not required to prove fraud to a court standard. They were required to hold "reasonable grounds", a subjective threshold that is frequently challenged and overturned.
The 7 types of CIFAS markers
CIFAS uses seven marker categories. The type filed against you determines how institutions treat your applications and how the challenge strategy should be structured.
1. Misuse of Facility (6 years)
The most common type. Filed when an institution believes you used an existing account to facilitate fraud: typically by receiving, transferring, or withdrawing money connected to criminal activity. This is the marker filed against people accused of "money muling," where funds from fraud victims pass through their account. Read our guide for people used as money mules.
Why it's often wrong: Many people filed under this category were themselves deceived: approached by strangers online, offered money for a "simple favour," or told the funds were legitimate cryptocurrency transactions or business payments. The institution often has evidence that fraudulent money entered the account but no evidence the account holder knew it was fraudulent.
2. Facility Takeover (6 years)
Filed when an institution believes someone gained unauthorised access to your account: SIM swaps, stolen credentials, social engineering attacks. This marker is typically filed to protect the account holder, but it can still cause problems. Some institutions treat any account associated with a takeover as high-risk, regardless of who was at fault.
3. False Application (6 years)
Filed when an institution believes you provided false or misleading information on an application: income figures, employment status, undisclosed addresses, or identity details. This includes mortgage applications, credit card applications, and loan applications.
Why it's often wrong: Applicants frequently provide information based on their genuine understanding. An estimated salary that turns out to be slightly different, an old address not updated, or information provided by a broker or intermediary on the applicant's behalf; none of these constitute fraud, but they can all trigger a False Application marker.
4. Identity Fraud (6 years)
Filed when someone uses a stolen or fabricated identity to open an account or apply for a product. If you're the victim (your identity was stolen), this marker should be a Protective Registration instead. If the institution filed an Identity Fraud marker against you as the victim, that's a filing error and strong grounds for removal.
5. Asset Conversion (6 years)
Filed when a financed asset (a car, equipment, or other goods purchased on finance) is sold, moved, or disposed of in breach of the finance agreement. Common with vehicle finance and commercial equipment leasing.
Why it's often wrong: Many people don't realise they can't sell a financed vehicle, or believe the finance was fully settled when it wasn't. A breach of contract is not the same as fraud; the institution must demonstrate deliberate dishonesty, not just that the terms were broken.
6. False Insurance Claim (6 years)
Filed when an insurer believes a claim was fraudulent or exaggerated: inflated values, staged incidents, or undisclosed information. The insurer must hold evidence of deliberate dishonesty, not merely that the claim was unsuccessful or that the claimant overestimated the value.
7. Protective Registration (2 years)
The only marker designed to help you. You apply for it yourself, through Cifas, if you believe you are at risk of identity fraud. It alerts other institutions that applications in your name should be verified more carefully. It lasts two years and should not cause you to be declined. Victim of Impersonation and Victim of Takeover markers, which an institution files after identity fraud, are different, and last 13 months. If it does, the institution declining you is misusing the CIFAS system.
Not sure which type of marker you have? Submit a Subject Access Request to CIFAS; they must tell you within one calendar month. You can also see the marker type on a statutory credit report from CheckMyFile.
How to check if you have a CIFAS marker
Institutions that decline you because of a CIFAS marker are not required to tell you that's the reason. You'll get a generic rejection, "we're unable to offer you an account at this time", with no explanation. There are three ways to find out:
1. Subject Access Request to CIFAS
Submit a Subject Access Request (SAR) directly to CIFAS. Under the UK GDPR, they must respond within one calendar month with details of any markers held against you, including the filing institution, marker type, date filed, and a brief description.
2. Check your credit report
CIFAS markers appear on credit reports from CheckMyFile (which shows data from all three bureaus plus CIFAS). The standard Experian, Equifax, and TransUnion reports may also show the marker, though the level of detail varies. A statutory credit report costs nothing; you're entitled to one from each bureau.
3. SAR to the filing institution
Submit a SAR to the bank, lender, or insurer that filed the marker. They must provide all personal data they hold about you, including their internal investigation records, the evidence they relied on to file the marker, and any communications about your case. This is essential if you plan to challenge the marker, their internal records often reveal that the evidence doesn't meet the CIFAS filing threshold.
How long does a CIFAS marker last?
Up to six years for fraud-related markers (Misuse of Facility, Facility Takeover, False Application, Identity Fraud, Asset Conversion, False Insurance Claim). Two years for a Protective Registration, which you apply for yourself, and 13 months for the victim markers (Victim of Impersonation and Victim of Takeover).
The six-year period runs from the date the marker was filed, not the date of the alleged fraud. A marker can be held for up to six years, but it does not have to run its course: it can be removed at any point through a challenge, and Principle 8 of the Cifas National Fraud Database Principles requires the filing member to delete data once it has served its purpose. There is no automatic review, so removal has to be asked for.
However, a marker can be removed before the six years expire if the filing institution agrees to remove it, or if an independent body (the Financial Ombudsman Service or the Information Commissioner's Office) orders its removal. This requires a formal challenge; the institution will not remove it voluntarily unless you demonstrate that it was filed incorrectly.
What does a CIFAS marker affect?
Almost everything. A CIFAS marker is not just a note on a credit file; it's a live fraud flag shared across 775+ organisations. Here's what it can block:
Bank accounts
Most high street banks will automatically decline a current account application if a CIFAS marker is present. Even basic bank accounts, which banks are legally required to offer, are sometimes refused on "money laundering" grounds. Some challenger banks and e-money institutions (EMIs) are more flexible, but your options are dramatically reduced.
See our guide to bank accounts that accept CIFAS-marked customers, or explore verified options through ADVICIFAS Pro Kit.
Credit and loans
Credit cards, personal loans, mortgages, car finance; a CIFAS marker will result in automatic decline from most mainstream lenders. Even subprime lenders who specialise in poor credit histories will typically refuse applicants with active fraud markers. See our guide to getting a mortgage with a CIFAS marker.
Insurance
Motor insurance, home insurance, travel insurance, insurers check CIFAS. A fraud marker doesn't just increase your premium; it often results in a flat refusal. This can make it illegal to drive (you need valid insurance) and difficult to get a mortgage (buildings insurance is a requirement).
Mobile phone contracts
All major UK mobile networks (EE, Three, Vodafone, O2) are CIFAS members. A contract phone application involves a credit check and CIFAS check. Most will decline. You're limited to pay-as-you-go SIM-only deals.
Employment
Employers in financial services, government, and regulated industries can check CIFAS during recruitment. A fraud marker can result in a job offer being withdrawn or a promotion being blocked. The employer is not required to tell you that CIFAS was the reason; they can simply say the role has been filled. See our full guide to CIFAS markers and employment.
Renting a property
Landlords and letting agents often use referencing agencies that check CIFAS. A fraud marker can result in a failed reference, forcing you to find a guarantor or pay rent upfront, if the landlord will accept you at all.
The cumulative effect is severe. A single CIFAS marker can cut you off from mainstream banking, credit, insurance, phone contracts, and employment simultaneously, for six years. This is why challenging it early matters.
Can a CIFAS marker be removed?
Yes. A CIFAS marker is not permanent and not unassailable. It can be removed before the six-year period expires through a formal challenge process. The institution that filed it is the data controller under UK GDPR; they are responsible for ensuring the data they hold about you is accurate, and they have a legal obligation to review it when challenged.
There are three main routes to removal:
1. Direct complaint to the filing institution
Write a formal complaint to the institution that filed the marker. Your complaint must address the CIFAS filing standards, specifically, whether the institution held evidence of deliberate dishonesty at the time of filing. You should also invoke your rights under Article 5 and Article 21 of the UK GDPR, the principles of accuracy and the right to object to processing.
The institution must respond to your complaint within 8 weeks under FCA DISP rules. If they don't, or if their response doesn't engage with the substance of your challenge, you can escalate.
2. Financial Ombudsman Service
If the institution rejects your complaint or fails to respond within 8 weeks, you can refer the case to the Financial Ombudsman Service (FOS). The Ombudsman can order the institution to remove the marker. FOS decisions are binding on the institution (though not on you, if you disagree with the outcome, you can still pursue other routes).
The Ombudsman assesses whether the marker was filed in accordance with CIFAS principles and whether the institution's evidence meets the required threshold. They regularly order removal where institutions have filed markers based on suspicion rather than evidence of dishonest intent.
3. Information Commissioner's Office
If the marker involves a breach of data protection law (inaccurate data, failure to respond to a SAR, failure to address an Article 21 objection), you can complain to the Information Commissioner's Office (ICO). The ICO can order the institution to erase the data. This route is particularly effective where the institution's investigation records are inadequate or where they failed to conduct a proper review before filing.
The challenge process: step by step
Challenging a CIFAS marker follows a structured escalation path. Each step builds on the previous one, if the institution doesn't remove the marker at one level, you escalate to the next with a stronger case.
Step 1: Gather your evidence
Submit SARs to both CIFAS and the filing institution. Get copies of everything: their investigation records, the evidence they relied on, any internal communications about your case. Check your credit report to confirm the marker type and filing date.
Step 2: Formal complaint to the institution
Write a structured complaint that addresses the CIFAS filing standards head-on. Don't write an emotional letter; make a legal argument. Demonstrate that the institution's evidence does not meet the threshold for deliberate dishonesty. Cite UK GDPR, the Data Protection Act 2018, and the specific CIFAS principle your marker was filed under.
Step 3: Analyse their response
Most institutions respond with a templated letter that recites their conclusion without providing reasoning. That's not a substantive response. If they don't address the specific points in your complaint, don't engage with the evidence threshold, or simply restate that the marker "meets CIFAS criteria"; that's a weakness you can exploit at the next level.
Step 4: Counter-response
If their response is inadequate, write back. Point out what they failed to address. Make it clear you're building a record for escalation. Give them a final deadline.
Step 5: Financial Ombudsman referral
If the institution maintains its position, refer the complaint to FOS. Your referral should include your original complaint, the institution's response, your counter-response, and a clear summary of why the marker doesn't meet the CIFAS filing threshold. The stronger and more structured your paper trail, the better your chances.
Step 6: ICO complaint (if applicable)
Run this in parallel with the FOS referral if there are data protection issues: SAR delays, inaccurate data, failure to respond to your Article 21 objection. The ICO route targets the institution's compliance failures rather than the merits of the marker itself.
Step 7: MP letter
Write to your Member of Parliament. MPs can write to institutions and regulators on your behalf, which adds political pressure. This is particularly effective for vulnerable individuals: young people, victims of fraud, people with mental health conditions.
Step 8: Regulatory complaint
If all else fails, file a formal complaint with the Financial Conduct Authority (FCA). While the FCA doesn't resolve individual complaints, patterns of complaints can trigger regulatory action against institutions that are systematically over-filing markers.
ADVICIFAS Pro Kit
Bank, Even With
a CIFAS Marker.
Stop getting rejected. We've found the ones that actually say yes. 700+ verified banks and EMIs that accept CIFAS-marked customers. £3.99/mo, cancel anytime.
Common myths about CIFAS markers
"You can't get a CIFAS marker removed"
Wrong. CIFAS markers are removed every day: through direct complaints, Financial Ombudsman decisions, and ICO enforcement. The Financial Ombudsman has publicly stated that it regularly orders removal of markers where the filing institution cannot demonstrate the required standard of evidence.
"You need a solicitor"
You don't. CIFAS marker challenges are complaints-based, not court-based. The Financial Ombudsman is a free service. You don't need legal representation to submit a SAR, write a complaint, or refer to the Ombudsman. What you need is a structured argument that addresses the CIFAS filing standards; that's a research and writing exercise, not a legal one.
Read more: Why CIFAS markers are not legal issues.
"Only criminals get CIFAS markers"
The data doesn't support this. CIFAS's own Fraudscape report shows hundreds of thousands of markers filed annually. A significant number involve people who were manipulated, deceived, or simply made mistakes. Young people are disproportionately affected, particularly those who were approached via social media and asked to receive or transfer money without understanding the consequences.
"The marker will just expire; wait it out"
You can wait six years. But during those six years you may not be able to open a bank account, get a loan, insure your car, take out a phone contract, or pass employment checks. For most people, the damage is immediate and ongoing. Challenging the marker early, especially if the evidence doesn't support it, is the rational choice.
"CIFAS is a government body"
It's not. CIFAS is a private, not-for-profit organisation. It is not part of the government, law enforcement, or the judiciary. Its members are private companies. The markers it holds carry no legal status; they are data entries on a private database. They are subject to the same data protection laws as any other personal data held by a private organisation.
Your legal rights
You have specific legal rights in relation to CIFAS markers under UK law:
- Right of access (Article 15 UK GDPR): You can request all personal data held about you by CIFAS and by the filing institution, including their internal investigation records and the evidence they relied on.
- Right to rectification (Article 16 UK GDPR): If the data is inaccurate; and a fraud marker filed without adequate evidence is inaccurate; you can require its correction or erasure.
- Right to object (Article 21 UK GDPR): You can object to the processing of your personal data in the CIFAS database. The institution must then demonstrate "compelling legitimate grounds" that override your interests, or stop processing.
- Right to erasure (Article 17 UK GDPR): Where the data is inaccurate or the processing is unlawful, you can require deletion.
- FCA DISP rules: The filing institution must handle your complaint fairly, consistently, and promptly. They must provide a substantive response within 8 weeks. If they don't, you can escalate to the Financial Ombudsman.
These rights are not theoretical. They are enforceable. The filing institution is the data controller. They cannot delegate their obligations to CIFAS, and they cannot refuse to engage with a properly structured challenge. If they do, that refusal becomes evidence for your Ombudsman referral.
CIFAS marker removal guides by institution
Different institutions have different filing patterns, response behaviours, and known weaknesses. We've published detailed removal guides for every major CIFAS-filing institution in the UK, covering their typical response timelines, the evidence gaps in their filing practices, and the specific arguments most likely to succeed.
Browse all institution guides, including Barclays, HSBC, Lloyds, NatWest, Monzo, Revolut, and Starling.
