HOUSE OF COMMONS TREASURY SELECT COMMITTEE:
INQUIRY INTO ECONOMIC CRIME

Memorandum from the City of London Police
Submitted by the Office of the City Remembrancer

Introduction

1. The City of London Police are responding to this inquiry as the National Police Chiefs’ Council Lead for Economic Crime.  The City of London Police operates Action Fraud, which is the national reporting centre for fraud and financially motivated cyber-crime. As the National Lead Force for Fraud, The City of London Police also investigate serious, complex and cross-border fraud which is beyond the scope of local policing.

Nature and scale of threat

2. Centralised national reporting of fraud (and cyber-crime) has significantly improved accessibility of reporting for victims, resulting in a detailed understanding of the national threat. Aggregation of crime reports, which are matched against other national datasets, has resulted in increased matching of networks and identification of organised crime groups, and has created stronger investigative leads and evidence against criminals involved in fraud. However, reporting of other types of economic crime, in particular money laundering, corruption and intellectual property crime, remains fragmented and inconsistent across law enforcement. A single reporting channel for all economic crime recording would improve the evidence base in respect of the scale, threat and harm from economic crime.

3. During the period April to September 2017, 341,155 crimes were recorded by Action Fraud, Cifas and UK Finance, with the majority of the reports being made to Action Fraud. Approximately a third of reports were from individual victims.  The highest fraud type by volume was cheque, plastic card and online bank account fraud (112,000) followed by application fraud[1] (45,000). The highest fraud type by value was fraud by abuse of position of trust (£113m) followed by mandate fraud[2] (£70m).  Investment fraud, dating fraud and door to door sales / bogus tradesmen are other crimes frequently reported that significantly impact victims.

4. From analysis of reports to Action Fraud that contain information indicating the crime has been committed by a suspect living outside the UK (14,000), the most commonly stated suspect’s location was Europe, followed by Africa, North America and Asia.  Based upon IBAN (International Bank Account Numbers) references reported to Action Fraud, the UK is the most commonly reported country for bank accounts receiving the proceeds of fraud. This is followed by Spain, Italy, Germany and Poland[3]. Obtaining evidence from abroad remains time consuming and bureaucratic, limiting the effectiveness of investigations and the ability to keep pace with the movement of criminal proceeds.

Enablers of fraud

5. Personal data and identity theft are key enablers of fraud. Identity theft is not a criminal offence and understanding of this crime is under-developed. People who have had their identity stolen are not classified as victims of crime and often do not receive a service from policing or victim support. Theft of identity should be a criminal offence (as it is in other countries including Australia, the USA and France). Recording it as a crime would mean victims will be supported, the threat can be better understood, and future fraud prevented through targeted interventions.

6. Public/private data sharing and creation of a central database of stolen and fraudulent identities (with facial recognition), accessible by law enforcement and industry, would prevent fraud facilitated by use of fraudulent identities. It would also improve identification of offenders involved in a range of different crime types, including fraud. Regulation and standards for data storage, with more intrusive due diligence by the Information Commissioner’s Office on information security standards of companies operating in the UK that collect the personal data, would help to prevent theft of data and reduce fraud.

7. The majority of instances of fraud within England and Wales do not discriminate by geographic location of the victim with most first contact methods reported (telephone, email, web pop up and websites) able to originate from any location. The City of London Police have issued over 170,000 requests to partner bodies to close bank accounts, websites and phone numbers suspected of facilitating fraud. 

8. A third of fraud is facilitated by telephone. Due diligence on telephone account holders, banning unsolicited calls and implementing systems to verify legitimacy of telephone contact with the public, by banks and other companies would significantly reduce the effectiveness of this as a means of committing fraud.

9. The introduction of controls and due diligence on email accounts would further reduce the amount of fraud facilitated through email (over 10% of fraud reports). Installation of new counter fraud and cyber technologies such as Quad 9 (which blocks domains associated with botnets, phishing attacks, and other malicious Internet hosts) and DMARC (an email authentication technology that prevents email spoofing), would contribute to a more secure society.  Anti-virus software at point of manufacturer should be mandatory, rather than an optional add-on.

10. Fraud is also enabled by the internet. The current process for removing a website suspected of facilitating fraud takes 7-21 days. The registrar of the website or the top-level domain for the jurisdiction which provides the platform for the website are the bodies currently able to remove websites.  While this is a robust way of closing the site, most action is limited to UK based websites (co.uk for example) and action against internationally hosted websites is limited by the legal framework and cooperation of other countries. IP blocking which prevents the suspect website being broadcast should be explored and this is a method used in other countries. There are also technological solutions that could be implemented to fast track website takedowns linked to phishing, physically preventing the transfer of information from potential victims.

The legislative and regulatory framework

11. The Fraud Act 2006 is effective and has resulted in an increase in fraud prosecutions since its introduction. Some elements are under-used, for example, fraud by abuse of position (section 4). The introduction of the new Criminal Finances Act will create new opportunities for recovering proceeds of crime and disrupting criminal activity. A key area for harmonisation is civil asset recovery powers which vary significantly between law enforcement agencies.

12. The register of persons with significant control of corporate and legal entities and the introduction of arrangements on the exchange of beneficial ownership information with overseas territories and crown dependencies is a positive step. Access to this information helps policing identify criminal proceeds and individuals seeking to hide their ownership or control of companies to facilitate illegal activities, such as use of corporate vehicles to commit fraud or money laundering. However, integrity of this data is paramount.

13. Improved due diligence by Companies House on information provided for company registration including identity and criminal records checks on directors will help prevent the use of UK companies to facilitate fraud and money laundering. It will also prevent disqualified directors and offenders who have been previously prosecuted for fraud to continue to register companies in their name and defraud members of the public.

14. Money laundering controls would be improved by regulating escrow agents and requiring them to undertake ‘know your customer’ due diligence.  Financial institutions have a responsibility to protect their industry and conduct effective know your customer due diligence. Correspondent banks that facilitate the flow of monies on behalf of overseas businesses that do not have a UK bank account are unable to verify the origins of the monies received or undertake effective ‘know your customer’ checks.

15. The move toward providing highly accessible and technologically focused services to consumers, combined with the recent EU regulations allowing all EU citizens a basic bank account, poses a potential risk to economic crime security. The ability to open accounts online and without UK residency makes it more challenging for financial services firms to perform effective identification, verification, know your customer and anti-money laundering checks. The ability to transfer money using just telephone numbers or email addresses could increase the anonymity for fraudsters receiving the proceeds of crime using this method.

16. A key area of reform required is in respect of information sharing by the private sector with law enforcement. Legal gateways for information sharing related to prevention and detection of crime should be harmonised (for example powers set out in section 7 of the Crime & Courts Act 2013 which are currently only available to the NCA). 

17. Analysts in the City of London Police review over 10,000 Action Fraud crime reports a month, many of which include suspect bank account numbers. Access to account holder information currently relies on timely cooperation by the banking sector and variable interpretations of exemptions under the Data Protection Act. The EU Fourth Anti-Money Laundering Directive was amended in 2016 to require all Member States to set up centralised national bank and payment account registers, and to make all information on the holders of bank and payment accounts available to governments. Implementing this in the UK and making it available to law enforcement would increase identification of fraudsters and money mules, secure evidence and victim monies and result in an increase in the pace of action against fraud reports.  Access should be fully auditable as with other law enforcement database checks (e.g. vehicle registration).

18. Further consultation on introduction of a corporate offence for failure to prevent economic crime is under review. It is City Police’s view that this offence would provide much needed encouragement for companies to take responsibility for protecting their customers and implement counter-fraud strategies, and would provide law enforcement with the necessary powers to prosecute those who do not.  City Police saw an unprecedented demand for training on bribery and corruption following the introduction of the Bribery Act offence of failure to prevent. It led to the development of the BS10500 Anti-Bribery Management Systems standard and ISO37001 International Standard (the development of which the City of London Police contributed to). Before the introduction of this offence, anti-bribery controls and measures would rarely have been on the agenda of executive boards. 

Fraud prevention and role of the private sector

19. There are key steps individuals can take to protect themselves. Greater public awareness of risks will help reduce fraud and the associated impact on policing. While there are hundreds of different methods of defrauding the public, the main routes for reaching potential victims and their information are the telephone (home and mobile), the internet (including email, websites and pop-ups), the letterbox (post) and the doorstep. The core protect message for all of these routes is to verify unsolicited contact and never assume any cold contact is genuine. 

20. The City of London Police provide crime prevention advice based upon the latest reporting trends. Advice is delivered across a range of media channels (print and online) as well as direct alerts tailored to individual preferences. National crime prevention messages and campaigns are disseminated through individual police forces and partners including the financial services sector, Age UK, Neighbourhood Watch, Citizens Advice and other partners.  The City of London Police have established ‘Cy-Fi Juniors’, a mini police programme intended to educate young people (8-11) on the risks associated with cyber and financial crime. This is being piloted in London and will be rolled out nationally.

21. Industry is a key partner in the fight against fraud, particularly in relation to fraud prevention through secure by design and dissemination of prevention messages to their customers. Financial institutions have a role and are very engaged with the counter fraud community. They are working with government and law enforcement to share intelligence, design out fraud, and develop and disseminate crime prevention advice. Through UK Finance, the banking sector provides over £2m per annum in funding for a City of London Police and Metropolitan Police Service taskforce (Dedicated Card and Payment Crime Unit) to tackle payment crime.

22. Other sectors also have an important role to play, particularly those regularly used to facilitate fraud such as telecommunications, retailers and online marketplaces, and internet service providers. For example, The City of London Police are working with the serviced accommodation and virtual office sector to identify and disrupt suspected boiler rooms (used for investment fraud). This initiative has resulted in a reduction in this type of reported fraud in the City of London.

23. Victims of fraud are often persistently targeted. The City of London Police’s Economic Crime Victim Care Unit is designed to identify vulnerability and support the unique needs of fraud victims.  It signposts victims to support services, provides tailored advice and prevents repeat victimisation. The roll out of this model is being piloted with police forces in Greater Manchester and West Midlands.

May 2018

Page 4