Understanding Misuse of Facility markers

A Misuse of Facility (MOF) marker is the most commonly filed CIFAS marker type, with over 51,000 cases recorded annually. It means an organisation believes your own account or facility was used in suspicious or fraudulent activity.

Common triggers include receiving payments that the bank considers suspicious, account activity that matches known fraud patterns, and transactions flagged by automated monitoring systems.

Common scenarios that lead to MOF markers

• Receiving and forwarding funds at someone else's request (money muling allegations)
• Account receiving proceeds of fraud from other victims' accounts
• Cryptocurrency-related transactions flagged as suspicious
• Payments to or from sanctioned or flagged entities
• Account activity patterns matching known fraud typologies
• Third-party use of your account without proper authority

Why many MOF markers are challengeable

The CIFAS standard requires evidence of dishonesty — not just suspicious activity. Many MOF markers are filed based on automated system flags without investigating whether the account holder actually acted dishonestly. If you were deceived, coerced, vulnerable, or simply unaware that the activity was suspicious, the dishonesty standard may not be met.