Last reviewed: June 2026 | Source: CIFAS and the Information Commissioner's Office
TL;DR- CIFAS is the UK fraud prevention service that runs the National Fraud Database used by banks and lenders.
- A CIFAS marker is a record of suspected or confirmed fraud, not the same as a credit score entry.
- Markers can make it difficult to open accounts, obtain credit or pass identity checks.
- You can request your CIFAS file free of charge through a Subject Access Request.
- Protective Registration is a voluntary marker that flags your details for extra checks if you are at risk of identity fraud.
Key Facts
●Operator: CIFAS, a not-for-profit fraud prevention membership organisation
●Database: The National Fraud Database used by member organisations
●Subject Access Request cost: Free under UK GDPR data access rights
●Typical marker retention: Up to 6 years depending on marker type
●Protective Registration: Voluntary marker, usually renewable each year
●Regulator for data rights: Information Commissioner's Office
A CIFAS marker can come as a surprise: an application for a bank account or loan is refused, the credit file looks fine, and the reason is a fraud-prevention record held by an organisation many people have never heard of. CIFAS runs the National Fraud Database, which member banks and lenders consult when assessing applications. This guide explains what the markers are, why they are added, how to obtain your CIFAS file and how to challenge an entry you believe is wrong.
What CIFAS is and how the database works
CIFAS is a not-for-profit fraud prevention service whose members include banks, lenders, insurers and other organisations. It operates the National Fraud Database, a shared record of suspected and confirmed fraud that members both contribute to and check when making decisions. A CIFAS marker is a record on this database, and it is separate from the credit files held by the three credit reference agencies.
Because the database is shared across members, a marker added by one organisation can be seen by others when they carry out fraud checks. This is why a single marker can affect applications across several different banks and lenders, even though it does not appear as a normal entry on a standard credit report.
CIFAS markers are governed by data protection law, and the Information Commissioner's Office oversees the data rights that allow individuals to see and challenge the information held about them.
Types of CIFAS marker
There are several categories of marker. Application fraud markers relate to applications believed to contain false or misleading information. First-party fraud markers concern a person's own conduct on an account, such as misuse of a facility. Other markers cover identity fraud where someone else has used a victim's details, and misuse of facility cases.
There is also Protective Registration, a voluntary marker that an individual can request when they are at risk of identity fraud, for example after a wallet or documents are stolen. This marker is different in nature because it is placed at the person's own request to trigger extra checks rather than to record suspected wrongdoing.
Each marker type carries its own meaning and retention period, and the impact on applications depends on the category. Markers indicating confirmed fraud carry more weight than those indicating only suspicion, but any marker can prompt a member organisation to ask additional questions or decline an application.
How a CIFAS marker affects applications
A CIFAS marker does not automatically block an application, but it prompts member organisations to apply extra scrutiny. In practice this can mean account openings, loans, mortgages and other products are refused, or that the applicant is asked to provide more evidence of identity and circumstances before a decision is made.
Because the marker sits outside the standard credit file, an applicant may have a healthy credit score and still be turned down. The refusal letter may not always explain that a fraud marker is the cause, which is one reason it is important to know how to check the CIFAS database directly.
The effect can extend across multiple providers because the database is shared, so a marker added in connection with one organisation can influence decisions made by others. This makes it worth resolving an inaccurate marker promptly rather than simply applying elsewhere.
How to check your CIFAS file
Anyone can ask CIFAS what information it holds about them through a Subject Access Request, which is free under UK GDPR. The request is made directly to CIFAS, which must respond within the statutory time limit, normally one month, and provide details of any markers and the member organisation that placed them.
The response sets out the type of marker, the date it was added and which member supplied it. Knowing the originating member is important because any dispute about the accuracy of a marker usually has to be taken up with that organisation, since it is responsible for the data it contributed.
Making a Subject Access Request is the most reliable way to find out whether a CIFAS marker is behind a refused application. It is sensible to do this before reapplying for products, because applying repeatedly while a marker stands can lead to further declines.
How to dispute and remove a marker
If a marker is believed to be inaccurate or unfair, the first step is usually to contact the member organisation that placed it, because that organisation is responsible for the data and for deciding whether to amend or remove it. CIFAS can explain the process but does not unilaterally remove a member's marker.
The individual can ask the member to review the evidence behind the marker and to correct or delete it if it is wrong. If the member does not resolve the matter satisfactorily, the individual can complain to the organisation under its complaints process, escalate to the Financial Ombudsman Service where the firm is within its remit, or raise a data concern with the Information Commissioner's Office.
Markers are not permanent and are removed at the end of their retention period, which is up to six years depending on the type. Where a marker results from genuine identity theft by a third party, providing evidence of the fraud usually supports removal of an incorrectly recorded entry.
Protective Registration for identity theft victims
Protective Registration is a service for people who believe they are at heightened risk of identity fraud, for instance after losing documents, suffering a burglary or being caught up in a data breach. The individual asks CIFAS to place a protective marker against their details, which tells member organisations to carry out extra checks before approving anything in that person's name.
Unlike fraud markers, Protective Registration is requested by the person it protects and is designed to slow down and verify applications rather than to record suspicion. It can cause genuine applications by the registered person to take a little longer, because the extra verification applies to them as well.
The registration usually lasts for a set period, commonly a year, and can be renewed. For victims and potential victims of identity theft, it provides an added layer of defence that works alongside, rather than instead of, reporting fraud to the bank and to Action Fraud.
Frequently Asked Questions
What is a CIFAS marker?
A CIFAS marker is a record held on the National Fraud Database, which is run by the fraud prevention service CIFAS and used by member banks, lenders and insurers. It flags suspected or confirmed fraud, or in the case of Protective Registration a voluntary alert requested by someone at risk of identity theft. It is separate from your credit score and can affect applications even when your credit file looks healthy.
How do I find out if I have a CIFAS marker?
You can find out by making a Subject Access Request directly to CIFAS, which is free under UK data protection law. CIFAS must normally respond within one month and will tell you whether any markers are held against your details, when they were added and which member organisation placed them. This is the most reliable way to discover whether a fraud marker is behind a refused application.
How long does a CIFAS marker last?
CIFAS markers are not permanent and are removed at the end of their retention period, which is up to six years depending on the type of marker. Protective Registration is a voluntary marker that usually lasts for around a year and can be renewed. Markers connected to confirmed fraud generally carry the longer retention periods, while the impact of any marker can lessen as it ages.
Can I get a CIFAS marker removed?
You can challenge a marker you believe is inaccurate by contacting the member organisation that placed it, because that organisation is responsible for the data and decides whether to amend or remove it. If it is not resolved, you can use the firm's complaints process, escalate to the Financial Ombudsman Service where applicable, or raise a data concern with the Information Commissioner's Office. Markers caused by genuine identity theft can usually be removed with evidence of the fraud.
