Every letter the system generates is built from your specific case data. It is not a template. No two letters are the same, even for the same marker type at the same institution.
What feeds into every letter
When the system generates a letter, it draws on everything it knows about your case:
- Your CIFAS report: marker type, date recorded, filing institution.
- Your answers: what happened, whether the institution contacted you, vulnerability circumstances, impact on your life.
- Your evidence: each document is analysed and rated. The system selects which evidence to reference and which to hold back.
- Institution intelligence: the system has seen cases against your institution before. It knows their typical arguments, their weak points, and what's forced them to concede.
- Every previous letter sent: so every letter builds on what came before.
- Every response received: quotes, weaknesses, regulatory failures, and GDPR breaches extracted from their replies are woven into the next letter.
- DSAR forensic findings: if you've uploaded a Subject Access Request response, contradictions and procedural failures from their own records are cited.
- Deadline breaches: every missed statutory deadline is automatically recorded and cited in escalation letters.
- Your writing style: a unique voice profile assigned to you so every letter reads like you wrote it yourself. See Your writing style.
How the process works
You don't need to tell the system what to write. When you reach a letter step in your roadmap, the system assembles your complete case context in seconds. This includes:
- Letter type and legislation: which letter type is needed and which legislation applies to your marker type
- Full correspondence history: every letter sent, with full content, so every letter builds on the last
- Every institution response: with their exact quotes, identified weaknesses, and rebuttal points ready to deploy
- Institution intelligence: your institution's intelligence profile (their typical arguments, known weak points, what's forced them to concede in other cases, and FOS decisions that went against them)
- Privacy policy analysis: your institution's privacy policy analysed for transparency gaps, weak legal basis claims, and whether they properly disclose CIFAS participation
- GDPR breach log: every GDPR breach recorded against them (missed deadlines, incomplete responses), each one cited with the specific article and date
- DSAR forensic findings: your Subject Access Request analysis (contradictions in their own records, procedural failures, internal investigation notes, evidence they tried to withhold)
- Documented impact: accounts closed, credit refused, income lost, employment affected, housing affected, mental health impact (including whether your GP is involved), relationship impact
- Vulnerability flags: if applicable, the system invokes FCA Consumer Duty obligations, which impose heightened duties on the institution
- Information request history: if the institution asked you for information, the system tracks how you've responded to their requests
- Crime references: police crime reference and Action Fraud reference numbers included in the letter header if you've reported the situation
- Case patterns: anonymised outcomes from similar cases at the same institution, so the system knows what arguments worked before
- Timeline and deadlines: days since marker filed, FOS 8-week deadline status, marker expiry date
The letter is generated in seconds. You review it, optionally refine it, and send it.
Quality checks
After every letter is generated, the system runs automatic checks before showing it to you:
- Writing style verification: confirms the letter matches your assigned writing style. If it doesn't sound like you, the letter is automatically regenerated.
- Uniqueness check: every letter is checked for uniqueness. If it's too similar to anything else, it's regenerated with completely different wording.
Always up to date
If you return to a letter step you've already started, the system detects whether your case has changed and updates your letter accordingly. Your draft always reflects the latest state of your case.
Why every letter is unique
Two users with the same marker type at the same institution will receive completely different letters. This is because:
- Different circumstances: what happened, what evidence they have, what vulnerability applies, what impact the marker has had.
- Different case history: what's been sent, what responses have been received, what deadlines have been missed, what breaches have been documented.
- Different writing style: every user is assigned a unique voice profile covering tone, formality, phrasing, sentence structure, argument ordering, citation style, and more. It never changes.
- Uniqueness guarantee: every letter is verified for uniqueness before it's shown to you.
To the institution, every letter reads like it was written by the individual. There is no mention of ADVICIFAS anywhere in the correspondence.
The system generates all 13 letter types from your case data. See Letter types explained for a full breakdown of each type and when it's used.
What the system cites
Letters reference specific UK legislation, regulatory frameworks, and legal arguments based on your case. The system doesn't just name legislation; it builds arguments around it.
CIFAS framework
- CIFAS Principle 4: the standard of proof (reasonable grounds to believe fraud was committed, and clear, relevant and rigorous evidence held at the time of filing, not gathered retrospectively)
- CIFAS filing requirements: the specific procedural requirements for filing a marker, including evidence standards and proportionality
UK GDPR
- Article 5(1)(a): lawfulness, fairness, and transparency.
- Article 5(1)(d): data accuracy.
- Article 5(2): accountability (the institution must demonstrate compliance, not just claim it).
- Article 6: lawful basis for processing, including legitimate interests.
- Article 12: transparency requirements, cited when their privacy policy uses vague language like "fraud prevention agencies" instead of naming CIFAS.
- Article 15: right of access (Subject Access Requests).
- Article 16: right to rectification. The system also argues that this obligation cannot be delegated to third parties; the institution is the data controller and must act directly.
- Article 17: right to erasure.
- Article 21: right to object. If they process under legitimate interests, they must have notified you of this right. The system checks their privacy policy for this.
Data Protection Act 2018
- Schedule 2, Part 1: cited specifically when challenging SAR redactions and exemption claims
- Processing conditions: lawful basis requirements under domestic law
FCA regulatory framework
- DISP rules: complaint handling requirements for regulated firms, including what a Final Response must contain
- Consumer Duty (FG21/1): enhanced obligations for vulnerable customers, triggered automatically when vulnerability flags are present in your case
Statutory deadlines
- 5 working days: acknowledgement of complaints and submissions
- 1 month: Subject Access Request responses
- 8 weeks: from complaint to FOS escalation eligibility
FOS precedents
Where relevant, letters cite actual Financial Ombudsman Service decisions that went against your institution, referenced by case to demonstrate that the Ombudsman has previously ruled in favour of consumers in similar circumstances.
Institution's own privacy policy
The system analyses your institution's published privacy policy and cites it against them when their own terms contradict their actions: transparency failures, missing Article 21 notification, vague CIFAS disclosure language.
Legal arguments the system makes
Beyond citing legislation, the system constructs specific legal arguments tailored to your case:
- Suspicion alone is insufficient: unusual activity or unexplained conduct does not meet the evidential threshold
- T&C breach is not fraud: breaching terms and conditions does not constitute deliberate dishonesty
- Being a victim is not committing fraud: if you were tricked, manipulated, or coerced, you are the victim, not the perpetrator
- Declining to explain is not an admission: silence or refusal to provide an explanation is not evidence of guilt
- Negligence is not dishonesty: poor judgement, naivety, or carelessness are not the same as deliberate fraud
- Proportionality: the system quantifies the specific harm (accounts closed, mortgages refused, jobs lost, mental health impact) against what was alleged, arguing the marker is disproportionate
- Data controller accountability: the institution cannot delegate Article 16 responsibilities to CIFAS or any third party, and cannot deflect to external review to avoid their own obligations
The system automatically manages which escalation routes are available based on your case timeline and ensures letters only reference options that are currently applicable.
The case compounds over time
Every letter the system generates is stronger than the last. Each response received, each deadline missed, each GDPR breach recorded, each piece of evidence uploaded: it all feeds into the next letter. The institution intelligence updates continuously, prioritising the most recent patterns.
Every letter builds on what came before without repeating itself.
The longer the institution delays or deflects, the more ammunition the system has. This is by design.
The system automatically re-analyses your entire case every time new evidence is uploaded, a response is received, or a letter is sent. You don't trigger this; it happens silently in the background.
