Credit Reference Agencies & CIFAS Markers: Challenging Inaccurate Records

A wrong entry on a standard credit file and a CIFAS fraud marker are two different problems with two different legal routes. Confusing them, or reaching for a court claim before exhausting the proper complaints process, is how a legitimate grievance turns into an expensive and, in the case of CIFAS, potentially sanctioned mistake.

Two Different Problems

Individuals and small business owners often use "credit blacklisting" to describe two genuinely distinct situations, and the correct legal route depends entirely on which one applies. The first is a straightforward factual inaccuracy on a mainstream credit reference file, such as a debt shown as unpaid when it has in fact been settled, a default recorded against the wrong person with a similar name, or an account shown as still open after closure. This is addressed through the statutory correction mechanism in s.159 of the Consumer Credit Act 1974. The second is a CIFAS fraud marker, an entry on a specialist, cross-sector fraud prevention database, recording that a member organisation believes the individual has committed or attempted a fraud-related act. This is a different database, a different legal basis, and a materially more serious allegation, requiring its own distinct challenge process described below.

Correcting an Inaccurate Credit File: s.159 CCA 1974

Section 159 of the Consumer Credit Act 1974 gives an individual the right to require a credit reference agency to correct information it holds that the individual believes to be wrong. Having identified the inaccuracy, typically by obtaining a copy of the file, the individual gives notice to the agency setting out the entry in dispute and why it is wrong. The agency must, within 28 days, either correct the entry and notify anyone who received the incorrect information within the previous six months of the correction, or explain to the individual why it is not prepared to do so, or notify the individual that the entry has been removed. Where the individual remains dissatisfied, whether because the agency has refused to correct the entry or because the correction does not fully resolve the concern, a notice of correction of up to 200 words can be required to be added to the file, ensuring anyone consulting the file in future sees the individual's own account alongside the disputed entry. If the agency fails to comply with these obligations, the matter can be referred to the Financial Conduct Authority, which regulates credit reference agencies as designated bodies, or a complaint can be made to the Information Commissioner's Office regarding the accuracy obligations under data protection law, with either route capable of resulting in an order requiring compliance.

What a CIFAS Marker Is

The National Fraud Database, operated by CIFAS, a not-for-profit fraud prevention membership organisation, is a shared, cross-sector database into which UK financial institutions, telecoms providers, insurers and other member organisations file information about individuals where the member has identified conduct meeting CIFAS's fraud-related categories, including application fraud, identity fraud or impersonation, facility misuse, first-party fraud, and suspected money mule activity. Other member organisations can then see the marker when the individual applies for a new product or service elsewhere. CIFAS itself is the data controller of the database and carries its own direct data protection obligations independent of the filing institution, which matters when deciding who to complain to or make a data request of.

Not every marker carries the same weight or consequence. The most consequential, and most commonly disputed, category is first-party or application fraud, where the member believes the individual themselves provided false information or acted dishonestly. This is quite different from a victim of impersonation marker, filed to protect a person whose identity was used fraudulently by someone else, or a protective registration marker, a voluntary self-registration made after a data breach or similar heightened risk, neither of which carries any suggestion of wrongdoing by the individual concerned. An adverse marker is not itself a mainstream credit reference agency record, but in practice it is a powerful red flag to other member organisations, frequently resulting in automatic application declines, account closures, and difficulty obtaining credit, insurance or new accounts elsewhere for as long as it remains filed. Industry guidance is nonetheless clear that no application should be refused automatically on the strength of a marker alone; the receiving member is expected to make its own proper checks, including verifying the applicant's identity, before declining.

The Fair Processing Notice

CIFAS requires every member organisation to give individuals notice, at the point data is collected, that information may be shared with fraud prevention agencies and used to prevent fraud and verify identity, and that a positive fraud finding could result in refusal of services, finance or employment. This is typically delivered as a short notice at the point of application, such as near a signature box or an "I agree" button, with a fuller notice available on request covering matters such as the categories of data processed, the legitimate interest basis relied on, the six-year retention period, any automated decision-making involved, and the individual's rights to object, seek erasure, correct the record, access their data, and complain to the Information Commissioner's Office. Obtaining the exact wording actually shown to the applicant at the point of the transaction in question, rather than relying on the generic template, is worth doing early: a genuine mismatch between what was required and what was actually displayed is independent evidence of a compliance failure, separate from the merits of the underlying fraud allegation itself, and a complete absence of any notice at all is a real and checkable compliance gap.

The Evidential Standard for Filing a Marker

This distinction matters enormously in practice. An individual cannot always conclusively prove their own innocence of the underlying suspicion, particularly where the dispute concerns matters such as a disputed transaction or an identity question, but a marker can still be vulnerable to challenge where the institution's own file, once obtained, shows the decision to file was not properly grounded in the required standard of evidence. Obtaining the institution's actual investigation file, generally through a subject access request, is the most effective way of testing whether the filing genuinely met this standard rather than being a defensive or precautionary filing dressed up as a considered decision.

Challenging a Marker: The Routes, in Order

The correct sequence matters, both because most disputes are genuinely resolved at an earlier stage and because skipping straight to litigation carries real risk, described below.

• Complain to the filing institution first. Request the reason for the marker if it is not already known, and formally dispute it through the institution's complaints process, providing any evidence undermining the reasonable-grounds and clear-relevant-rigorous basis for filing.
• Complain to the Financial Ombudsman Service, where the filing institution is a regulated firm. Subject to the usual six-month time limit running from the institution's final response, the Ombudsman has in practice ordered removal of improperly filed markers in a substantial number of individual cases, and most genuine disputes are resolved at this stage or the institutional complaint stage rather than through reported litigation.
• Complain to the Information Commissioner's Office, where the dispute concerns the lawfulness of the processing itself. The ICO can investigate whether the legitimate interests basis was properly relied on and whether accuracy, necessity and proportionality obligations were met. Because CIFAS is itself the data controller, a complaint or data request can properly be directed at CIFAS directly, not only at the filing institution.
• Court proceedings, as a genuine last resort only. A civil claim in data protection or defamation remains available in principle, but should only be considered once the earlier routes are exhausted and with properly particularised evidence, for the reasons set out below.

The Litigation Risk: Abayomi v CIFAS

In Abayomi v CIFAS [2024] EWHC 3060 (KB), the High Court struck out a civil claim brought against CIFAS challenging a fraud marker, finding it disclosed no reasonable grounds for bringing the claim and certifying it as totally without merit. So far as the claim was framed in libel, the court found the substance of what was recorded to be substantially true, a complete defence under s.2 of the Defamation Act 2013, and held in the alternative that the honest opinion defence under s.3 would also succeed. The data protection claim failed because the filing and maintenance of the marker was found to be a proper exercise of the legitimate interests basis for processing under the UK GDPR, expressly recognised by Recital 47 as covering fraud prevention, with no proper evidential basis pleaded to displace it. The claimant's conduct across the litigation, including repeated applications later certified as totally without merit, led the court to escalate from a limited civil restraint order to a general civil restraint order lasting three years, together with an award of costs against the claimant on the indemnity basis specifically in relation to the CIFAS claim, a materially more punishing costs order than the standard basis that applies in most litigation.

The practical lesson is not that a marker can never properly be challenged, since the underlying evidential standard genuinely can be tested and markers genuinely are removed where institutions have not met it. The lesson is that a challenge must be built on specific, properly evidenced grounds, targeting the reasonable-grounds and clear-relevant-rigorous standard directly and displacing the truth, honest opinion and legitimate interests defences with real particulars, rather than a generalised sense of unfairness, and that the institutional, Ombudsman and Information Commissioner routes should be genuinely exhausted first.

Retention Periods

Most marker categories, including first-party and application fraud markers, are retained for up to six years from filing, after which they should be automatically removed absent a fresh filing, unless a successful challenge secures earlier removal. Victim of impersonation and protective registration markers, reflecting their protective rather than accusatory purpose, are generally retained for shorter periods.

Practical Steps

• Identify which problem you actually have. A mainstream credit file inaccuracy uses the s.159 route; a CIFAS marker uses the institutional complaint and, if necessary, FOS or ICO route instead.
• Get the file first. Request a copy of the credit file, or make a data request to both CIFAS and the filing institution for a marker, before deciding how to challenge anything.
• Use the 200-word notice of correction where a credit reference agency will not budge. It ensures your account is seen alongside the disputed entry even where outright removal is refused.
• Test a CIFAS marker against the two-limb standard specifically. Reasonable grounds to believe, and clear, relevant and rigorous evidence, not a general complaint that the allegation is unfair.
• Exhaust the institutional, FOS and ICO routes before considering court proceedings. Abayomi v CIFAS shows how comprehensively, and at what cost, a premature or weak claim can fail.

Frequently Asked Questions