Understanding facility takeover markers

A Facility Takeover marker is filed when an organisation believes an account or financial facility was accessed or controlled by someone without proper authority. With over 38,000 cases annually, this is the second most common marker category on the NFD.

Common causes include SIM swap attacks, phishing scams, social engineering, and account compromise through data breaches.

The victim misclassification problem

The most significant issue with Facility Takeover markers is that victims are sometimes incorrectly classified as suspects. If your account was taken over by a fraudster, you are the victim — but some institutions file the marker against you as if you were involved in the takeover.

This is a clear filing error. CIFAS requires that victims be recorded as victims, not suspects. If you have been misclassified, the complaint should focus on reclassification and removal of the adverse marker.

Evidence that strengthens your case

• Police or Action Fraud report reference number
• Evidence of how your account was compromised (SIM swap confirmation, phishing emails)
• Proof that you reported the compromise promptly
• Records showing the fraudulent activity was not authorised by you
• Communication with your mobile provider about SIM swap (if applicable)