How to get a CIFAS marker removed

Who can remove a CIFAS marker?

Cifas does not file markers. A member organisation does. Cifas says that if the firm that registered the warning upholds a complaint, it can remove your details from the Cifas system. That is why the process starts with the firm rather than with Cifas.

To read more on what a marker is and who files one, see what is a CIFAS marker.

What standard of proof does a firm have to meet?

The Financial Ombudsman Service sets out the test for firms. There must be “reasonable grounds to believe that fraud or a financial crime had been committed or attempted”, and the evidence must be “clear, relevant and rigorous”. When it looks at a complaint, the Ombudsman considers whether the firm can show the customer met the test set by the fraud prevention agencies, whether the information on the database is accurate, and whether any mistakes were made in recording it.

Two published Ombudsman decisions repeat this test and add that the firm must have more than a suspicion or a concern that the customer was involved, and should give the account holder an opportunity to explain what was going on (DRN-5890520 and DRN-6114852).

The route to challenge a CIFAS marker, step by step

1. Find out what is recorded

You can ask Cifas for a copy of what it holds on you with a data subject access request (DSAR). Cifas says this is free of charge and that it must respond within one calendar month of receiving a fully completed form and supporting documents. Cifas also says that if you receive the results and want to dispute the information, you can use its complaints process. Our guide on how to check if you have a CIFAS marker covers this step.

2. Complain to the firm that filed the marker

Cifas says you must first contact the organisation or organisations that registered the warning and follow their complaints procedure. You can ask them for a Final Response, which Cifas describes as confirming that they have investigated and are rejecting your complaint. Cifas says members can take up to 8 weeks to look into your request and provide a final response.

3. Ask Cifas for an independent review

Once you have the final response, Cifas says you can share it and it will conduct an independent review on your behalf. It says it aims to resolve all investigations within one month, although some can take longer. Cifas states that it does not have the power to recommend financial awards.

4. Take a bank or lender complaint to the Financial Ombudsman

If you want to keep disputing the case, Cifas says the next step is the relevant regulator or complaints scheme, and that in most of its cases this is the Financial Ombudsman Service.

The Ombudsman says it cannot look at complaints against fraud prevention agencies themselves. It can look at complaints about financial businesses that reported information to them. It asks you to complain to the business first. It says that for most complaints a business has up to 8 weeks to consider it, and that you must bring a complaint to the Ombudsman within 6 months of the date on your final response. If the Ombudsman upholds a complaint it directs the firm to put things right, which may include compensation for distress or inconvenience. Our guide on complaining to the Financial Ombudsman about a fraud marker covers this step in detail.

5. Complain to the ICO about data protection failings

A marker is personal data. Under the UK GDPR, individuals have the right to have inaccurate personal data rectified, and the ICO says organisations must respond without undue delay and at the latest within one month. Under the Data Protection Act 2018, data is inaccurate if it is “incorrect or misleading as to any matter of fact”.

If an organisation refuses a request, the ICO says it should give its reasons and tell you about your right to complain to the ICO and to seek a judicial remedy. The ICO generally recommends that you raise the concern with the organisation first and give it a chance to put things right.

6. Court

The Data Protection Act 2018 allows a data subject to apply to court for a compliance order where the court is satisfied that their rights under the data protection legislation have been infringed. The order can require the controller to take, or refrain from taking, specified steps. Section 168 separately provides for compensation claims under Article 82 of the UK GDPR and says non-material damage includes distress. Court action is a legal process, so it is a point to get advice, not something to attempt from a guide.

What do Financial Ombudsman decisions show?

The Ombudsman publishes its final decisions. The three below are illustrations of individual cases, not rules, and each turned on its own facts.

• DRN-4936783 (Monzo). The ombudsman upheld the complaint and directed Monzo to remove the marker and pay £350. The decision records that the bank had not asked the customer about the payments before recording the marker, and found the evidence was “not clear and rigorous”.
• DRN-5890520 (Monzo). The ombudsman directed removal. The decision says suspicion that the customer may have known what was going on is not sufficient to show he knew or was involved, and that the marker did not meet the criteria set by Cifas.
• DRN-6114852 (Starling). The complaint was not upheld. The ombudsman found the customer had given inconsistent explanations about a payment and concluded the bank had acted properly, so it would not be fair and reasonable to direct removal.

Taken together they show the same test being applied to different evidence. They do not show how any other complaint will turn out.

Getting advice

If your case is complicated, or you are considering court action, you can find a solicitor in our directory. FraudMarkers is independent and is not affiliated with any firm listed.