You apply for a current account. Everything looks fine on paper. Then comes the rejection with no explanation, no appeal process mentioned, and zero indication of what flagged you. What most people don’t realise is that behind the credit check, before the credit check, actually, there’s a parallel layer of UK fraud prevention databases quietly running your details through scoring logic you’ve never seen and were never told about.
I’ve spent a fair amount of time pulling apart how these systems work, and honestly it’s one of the murkier corners of UK financial infrastructure. Let me break down the three main players, what data they’re feeding on, and how you can use GDPR to pry your own file open.
The three databases doing most of the heavy lifting
CIFAS is the one people occasionally hear about. It’s a not-for-profit fraud prevention membership organisation, and its database holds marker records on people who have been identified as either fraudsters or victims of fraud. Members, which include pretty much every major UK bank, building society, insurer, and a growing number of telecoms providers, can query and contribute to it. A CIFAS marker isn’t a credit default. It’s a separate flag entirely, and it persists for six years. If you’re marked as a victim of impersonation, that’s supposed to protect you. If you’re marked for misrepresentation on an application, that’s the career-ending kind.
National Hunter is less well known and significantly more interesting from a data architecture perspective. Run by Synectics Solutions, it’s specifically designed to detect application fraud by cross-referencing data points across thousands of credit applications. It doesn’t just look at your name and address, it looks at every data field you’ve submitted across every application touched by a member institution. Inconsistencies between applications are what trigger it. Put a slightly different employer name on two applications, use a different middle initial, quote different salary figures to different lenders in the same month, National Hunter logs all of it and scores the discrepancy. The scoring logic is proprietary. Members don’t get a clean decision, they get a risk indicator that tells them to take a closer look.
SIRA (the Special Investigations Register and its associated National SIRA platform, also run by Synectics) focuses more on insurance fraud, though it’s bled into lending too. It holds records of suspected or proven fraudulent insurance claims, and insurers query it before underwriting. If you’ve had a claim disputed, or if a previous insurer flagged your claim as suspicious even without taking action, there can be a record sitting in there affecting your premiums or outright blocking coverage.
What data actually feeds these systems
This is where it gets uncomfortable. The inputs aren’t just things you’ve provided directly. UK fraud prevention databases ingest data from a wide range of sources: your electoral roll presence (or absence), your credit file application history, device fingerprints and IP addresses submitted with online applications, links between addresses and known fraud cases, and relationship graphs between applicants, things like shared addresses, phone numbers, or bank accounts with previously flagged individuals.
National Hunter in particular builds what amounts to an application history graph. Every time a member queries it, the query itself generates a record. Those query patterns, how many lenders have searched for you, over what timeframe, with what data, become signals in the risk model. A flurry of applications in a short period, even entirely legitimate ones, can push your risk score in a direction that’s hard to recover from without knowing why it moved.
The false positive problem is real and largely unacknowledged. There’s no public data on how often legitimate applicants are incorrectly flagged, because the databases themselves don’t publish that. The CIFAS membership agreement requires institutions to have reasonable grounds before submitting a marker, but “reasonable grounds” is doing a lot of work there. I’d argue the asymmetry is the real issue: it costs an institution almost nothing to submit a marker defensively, but it costs the individual significantly if that marker is wrong. The ICO’s guidance on individual rights under UK GDPR is clear that people have rights here, but exercising them requires knowing the system exists first.
How the scoring logic actually works (as far as anyone can tell)
None of the three databases publish their scoring methodology in full, that’s commercially protected. What we do know from subject access requests, ICO enforcement notices, and published court cases involving database markers is this: they’re not binary pass/fail systems. They generate a risk score or flag that the querying institution then weighs alongside their own internal logic.
National Hunter’s model is particularly opaque. Synectics describes it as a “consistency checking” system, but the reality is that it’s running anomaly detection across a population of millions of applications to produce a relative risk indicator. An application that looks statistically unusual compared to the population baseline gets flagged. What counts as unusual? That’s the bit nobody outside the organisation fully knows. This is relevant context when thinking about how financial institutions use AI-adjacent tools for fraud scoring, for an analysis of where that data pipeline connects to more modern AI security architecture, the team at dijitul.ai covers some of that infrastructure in depth.
CIFAS markers have defined categories, first-party fraud, third-party fraud, victim of impersonation, facility takeover, and several others, and each has a slightly different impact on how institutions respond. A “victim of impersonation” marker should theoretically trigger protective measures rather than rejection. In practice, some institutions still decline applicants with any kind of CIFAS marker and don’t always distinguish between the categories clearly.
Using GDPR subject access requests to pull your file
This is the part most people skip, and they shouldn’t. All three databases are data controllers under UK GDPR, which means you have a right to request all personal data they hold on you. A Subject Access Request (SAR) costs nothing, must be responded to within 30 days, and if they hold data on you, they have to give it to you.
The trick is knowing where to send them. For CIFAS, you submit directly via their online portal or by post to their data subject team. For National Hunter and SIRA, you go through Synectics Solutions. Their contact details are published, though not exactly prominently. Send a clear written request identifying yourself (full name, date of birth, current address, and a couple of previous addresses) and state that you’re making a subject access request under Article 15 of UK GDPR.
What you get back varies. CIFAS will tell you whether a marker exists, what category it is, and which member submitted it, though not always the full reasoning behind the submission. National Hunter returns a summary of the application history records they hold, which is often eye-opening: you’ll see every institution that’s queried your details, when, and with what data fields. SIRA returns insurance-linked records if they exist.
If you find an error, a marker submitted incorrectly, a record with wrong data, or a case of mistaken identity, you have the right to request rectification or erasure under UK GDPR. If the database or the submitting member refuses, escalate to the ICO. It’s a slow process, but there are documented cases where incorrect CIFAS markers have been successfully challenged and removed.
The surveillance architecture you didn’t consent to
What’s worth sitting with is the scale of this. Every UK bank account application, mortgage, loan, credit card, and most insurance policies now run through at least one of these databases in real time. The data being ingested goes well beyond what you knowingly submitted. Device identifiers, behavioural signals, network connections between individuals, it’s a surveillance graph with direct financial consequences, run by private organisations with minimal public accountability.
For context, the same kind of hidden data pipeline problem shows up in other parts of UK infrastructure. The way crypto drainer scams disguise themselves as FCA-registered platforms exploits exactly this opacity, people don’t know what the legitimate data flow looks like, so they can’t spot the fake. And the NCSC’s vulnerability disclosure process faces the same institutional inertia when researchers try to surface problems in opaque systems that institutions have little incentive to acknowledge publicly.
My take: the UK fraud prevention database ecosystem does a real job. Fraud costs UK consumers and businesses billions a year, and cross-institution data sharing genuinely helps catch organised fraud rings that individual lenders would never detect alone. But the current setup has next to no transparency, inadequate error correction, and meaningful real-world harm when it goes wrong. Pull your SAR files. Know what’s in there. Don’t assume a clean credit file means you’re clear.
Frequently Asked Questions
What is CIFAS and how do I know if I have a marker?
CIFAS is a UK fraud prevention membership organisation that holds a shared database of fraud markers submitted by banks, insurers, and other lenders. You can find out whether you have a marker by submitting a Subject Access Request directly to CIFAS via their website, it’s free and they must respond within 30 days under UK GDPR.
How does National Hunter differ from a standard credit check?
A credit check pulls your financial history from credit reference agencies like Experian or Equifax. National Hunter is a separate system that checks for inconsistencies across multiple credit and loan applications you’ve made, looking for discrepancies in the data you’ve submitted to different lenders. A clean credit file doesn’t mean you’re clear on National Hunter.
Can a fraud database marker stop me getting a bank account?
Yes. A CIFAS or National Hunter flag can lead a bank to decline an application without explaining why in detail. Victim-of-impersonation markers are supposed to trigger protective measures rather than outright refusal, but some institutions treat any marker as grounds for rejection. If you believe you’ve been incorrectly marked, you can challenge this through the relevant database’s dispute process and escalate to the ICO.
How do I submit a Subject Access Request to SIRA or National Hunter?
Both SIRA and National Hunter are operated by Synectics Solutions. Send a written Subject Access Request to Synectics, including your full name, date of birth, current address, and a couple of previous addresses, stating you’re requesting all personal data under Article 15 of UK GDPR. They must respond within 30 days at no cost to you.
What can I do if my fraud database record contains incorrect information?
Under UK GDPR you have the right to request rectification of inaccurate data. Contact the database operator and the institution that submitted the record, explaining the error with any supporting evidence. If they refuse to correct it, you can lodge a complaint with the Information Commissioner’s Office (ICO), which has enforcement powers over all three databases.
Leave a Reply