Banking and Financial Fraud Archives

New legislative powers to strengthen UK banks in the fight against fraud

Posted on November 5, 2024 by Caitlin Duncan

The recent announcement by HM Treasury and Economic Secretary to the Treasury, Tulip Siddiq MP, signals a significant step forward in consumer protection efforts.

Extension of payment delays

Currently, banks must either process or refuse a suspected fraudulent payment by the end of the next business day.

Under these proposed new laws, banks will have the authority to extend the delay for payments that they suspect may be fraudulent by a further 72 hours. This change is critical, as it provides financial institutions with the necessary time to conduct thorough investigations into suspicious transactions.

An increased verification window is not just a procedural change; it’s enhancement of the banking sector’s ability to safeguard consumers. It gives banks the leverage to “break the spell” that fraudsters cast over victims – to use the words of Tulip Siddiq. The government’s targeted approach comes in response to the estimated £460 million lost to authorised push payment (APP) fraud in the past year.

Siddiq’s statement is echoed by Lord Sir David Hanson, Minister of State with Responsibility for Fraud, who underscores that fraud can affect anyone and have devastating consequences. By equipping banks with these new investigative powers, the legislation aims to act as a critical deterrent to the most common form of crime in England and Wales.

Focus on scams

A category of bank transfer fraud that comprises a vast number of the fraudulent payments that this law will target are ‘romance scams’, also known as ‘romance fraud’.

This is where scammers use deceitful tactics such as creating fake profiles on dating sites or social media, pretending to care about an individual and entering into a romantic relationship with them to build trust, all in an effort to get the victim to transfer them money or obtain the victim’s financial details. This type of scam particularly preys on the vulnerable by manipulating emotions to extort significant sums of money.

Unfortunately, love really can be blind, but the extension of the investigation window is specifically geared towards combatting this type of deception, allowing banks sufficient time to examine new payees or flagged fraudulent accounts.

The evolving crime landscape, characterised by the prevalence of purchase scams and these insidious romance scams, demands a robust response.

Industry support

The initiative has garnered support from various stakeholders within the financial sector. Rocio Concha, Which? Director of Policy and Advocacy, heralds this as a “positive step in the fight against fraud”, emphasising the importance of banks being empowered to take action against suspected scams without impacting the majority of everyday payments.

From the industry body perspective, UK Finance’s Managing Director of Economic Crime, Ben Donaldson, welcomes the prospective law as an alignment with the prolonged requests from firms for such protective measures.

UK Finance has been long-standing advocate for the introduction of such legislation, marking this a commendable step forward by the government and HM Treasury.

Nonetheless, to optimise the law’s impact, its implementation should be coupled with a strategic enhancement of public awareness and education regarding the risks associated with making these types of payment in the first place. It is well understood that the foundation of effective risk management lies in prevention – a far more advantageous approach than relying solely on detection.

Within the last few years, banks have added extra security checks for people making payments, with prompts and banking fraud warnings that force the customer to categorise where the payment is being made and why. This new legislation is a significant addition to that potentially vital security check.

Operational implications for banks

Currently obligated to either authorise or decline a transaction by the end of the next business day, banks now have the latitude to apply scrutiny to payments for an additional 3 days. Financial institutions are tasked with communicating to customers the reasons behind any delayed payment clearly and providing guidance on steps consumers can take to resolve the issue.

Protection and compensation for consumers

While the primary drive of this legislation is to protect consumers from banking fraud, the government are also cognisant of the inconvenience that delayed transactions can cause. Therefore, banks will be mandated to compensate customers for any financial penalties accrued due to delayed payments, such as interest or late fees, strengthening consumer financial security and trust in the banking system.

A collaborative approach

It is critical to note that these measures require careful implementation and should be utilised in a precise and targeted manner.

Banks must commit to sharing intelligence with one another while maintaining close collaboration with law enforcement to pursue and dismantle the criminal networks benefiting from these fraudulent activities.

This new legislation is not a magic bullet, but a step in the right direction.

As with every preventative measure implemented, fraudsters will adapt to more ruthless ways of working, thus financial institutions must remain vigilant and ensure all their procedures and technology remain relevant and watertight.

Financial fraud advice and support

If you need advice on any aspect of financial fraud – from fraud prevention to the recovery of funds lost to fraud – please get in touch with Ali Twidale, Banking & Financial Fraud Consultant. Ali is a Certified Fraud Examiner, and she will be happy to review your situation and put in place a bespoke plan of action to address your needs.

You can reach her at ali.twidale@esarisk.com, on +44 (0)343 515 8686 or via our contact form.

Charity fraud prevention and information security

Posted on November 29, 2023November 28, 2023 by Admin Admin

With charitable funds being raised to help the most vulnerable in society, the aftermath of fraudulent activity can be devastating. This makes the prevention and investigation of all financial crimes against charities crucial.

Charities will rarely have the expertise within their ranks to focus effort on prevention of fraud and financial crime. The reality for most of the 169,000 registered charities in England and Wales, along with the millions worldwide, is that they often have low levels of security to all the funds they hold, and little awareness or education on the preventative controls required to prevent fraud against them.

This is demonstrated in the statistic from Action Fraud that charity fraud figures had risen by 44% at the end of 2022 with a total estimated loss of £2.3 million and that’s only what has been reported.

There’s no getting away from it, financial crime in the charity sector is a serious problem and it is only getting worse.

Importance of information security in charity fraud prevention

As with all organisations, charities collect and store personal and sensitive data relating to a variety of stakeholders, such as donors, partners, employees, and volunteers. A data security breach instigated by cyber criminals can cost a charity dearly, both in financial terms and through the harm it can do to the charity’s reputation.

Investment in a charity’s information security should be seen as vital. However, with charitable activities being (understandably) prioritised for funding, that data security investment is often made as a last resort, if at all.

The importance of information security in charity fraud prevention cannot be understated. Imagine your charity is a house with wads of cash sitting inside and the doors have been left unlocked. From the outside, your house looks secure, but it isn’t. A fraudster is able to walk up, enter the house without issue and walk away with the money, by which time the damage is done.

If you do not have the appropriate security in place for your charity’s physical and digital systems, you are leaving your door unlocked. A failure to take the necessary steps to ‘lock up’ your charity’s information is a failure to secure the donations and data essential to your charity’s activities.

Information security best practice

To secure your charity’s money and data from fraud, it’s important to have multiple security processes in place. Alongside physical security measures, such as access control, CCTV and alarms, the following preventative measures should be implemented for any sensitive information stored within digital systems.

Encryption

If digital data is encrypted, then it remains secure even if it falls into the hands of cyber criminals. That’s because without the decryption key, it is practically impossible for them to read the data, rendering it useless.

Passwords

Most encryption systems require users to enter a password before their data can be decrypted so that it can be used. This means that encryption only provides security if the password is secure. A secure password is at least 12 characters, combines upper and lower-case letters, numbers and special characters, does not contain personal information and is unique to that account only.

Access to funds/payments

Ensure that only the people that require access to charity funds, and have the authority to make payments, have access to the data related to your charity’s or donor’s bank accounts, such as account numbers or PINs. If you store this data on a central computer network, access can be controlled by implementing permission rights, which determine what actions individuals are allowed to perform in relation to stored data or accounts.

Different control levels can also be put in place, e.g. having two signatories or approvers required to make payments and ensuring large payments/withdrawals are reviewed and approved by multiple personnel.

Use multi-factor authentication for added security

You can make it harder for hackers or other unauthorised people to access accounts and the data they contain by enabling multi-factor authentication (MFA), if it is available.

MFA systems add security steps to the login process after a password is entered, for example, by requiring users to enter an access code sent to their phone or a biometric measure such as a fingerprint. The most commonly used MFA system is two-factor authentication (2FA), which requires a password and one other security step.

Data loss prevention

It is not always possible to keep hackers out of computer systems, but a data loss prevention (DLP) system makes it harder for hackers to steal data if they do break in. A DLP system works by recognising certain types of data such as credit card numbers, or a particular file type such as a spreadsheet, and then blocking any unusual attempts to download large amounts of such data from your charity.

How ESA Risk can provide fraud prevention expertise in the charity sector

At ESA Risk, we have an experienced team of risk, investigations and consulting experts that are here to help any organisations in the charity sector with carrying out due diligence checks on donors, beneficiaries and local partners, and monitoring the end use of funds.

We can undertake financial crime risk assessments, advise on Know Your Donor and Know Your Partner procedures and help you set up and maintain a Suspicious Donations Log. ESA Risk can also assist with the reporting of any fraudulent activity to the Charity Commission. If you’re a charity trustee who is signing up to the Stop Fraud Pledge, we can support you with all six of the pledge’s steps: Appoint, Ensure, Consult, Create, Perform and Assess.

Please get in touch for an initial chat with our experienced consultants. You can contact Ali Twidale, Banking & Financial Fraud Consultant at ali.twidale@esarisk.com, on +44 (0)343 515 8686 or via our contact form.

This article was published as part of Charity Fraud Awareness Week 2023.

Investment fraud: An unregulated scheme

Posted on November 11, 2021January 7, 2025 by Admin Admin

The company in question – Dow and Jones Limited – was selling fine wine to members of the public as an investment opportunity, yet most orders were not delivered and even for those that were, customers would be unlikely to get their original capital back due to the inflated buying price of almost double the retail cost.

Alongside overcharging their customers and investors, the company told clients they had to buy more to bulk up their wine portfolios. The company accounts were reflective of their dishonesty; orders from as far back as 2016 weren’t completed and inaccurate accounts had been filed at Companies House.

Investment fraud is not uncommon. In this case, the methods used to convince customers to buy into the fraudulent scheme were outlined by Irshard Mohammed, Senior Investigator at the Insolvency Service, as “Similar to boiler room operations, Dow and Jones used sales scripts from previously failed companies, which assisted salesmen to convince people, including the vulnerable, to invest their money in unregulated investments.

“The courts recognised the unscrupulous nature of Dow and Jones when it wound-up the company and our advice is always to reject unsolicited investment offers that sound too good to be true.”

The Official Receiver appointed to this case revealed that third parties (claiming to work for The Insolvency Service) were contacting investors promising investment returns if money was sent to them during the phone call.

Scams in which criminals impersonate the Insolvency Service are known as ‘recovery room scams’. These are defined as “fraudsters approaching investors who have been scammed or had failed investments, offering to help them get their money back for an upfront fee”. They usually adopt the role of an Official Receiver and use methods such as sending fake letters with the Insolvency Service logo, or referring investors to social media accounts of actual Insolvency Service employees.

The Insolvency Service Official Receivers do not ask investors to pay upfront fees to recover lost investment. Being asked for to pay these fees to ‘get paid faster’ or ‘increase the likelihood of profits’ is one of the surest signs of investment fraud.

Advice from The Insolvency Service

“The Insolvency Service will always look to cooperate with other government agencies and prosecuting authorities when we’re made aware of recovery room scammers and investment fraud. You should report all fraudulent contact from individuals stating they can get your lost investments back for a fee. You can also report these approaches to Action Fraud.
The Financial Conduct Authority publishes a list of known fraudulent claims management companies, you can check online if a warning has been posted about the company that approaches you. Just because the company that has contacted you is not on this list does not mean that they are not attempting to scam you.
You can avoid many unsolicited telephone calls by registering your phone number with the Telephone Preference Service (TPS). The TPS is the official central opt-out register for people who do not want to receive unsolicited sales and marketing calls and is a free service.”

Protection against investment fraud

Banks have become progressively better in recent years in trying to prevent their customers falling for investment fraud scams by implementing monitoring systems that can detect when payments have been made to scam companies, but continual education and awareness will always be key to achieving higher prevention.

For advice and support on recognising and avoiding investment fraud, contact Ali Twidale, Banking & Financial Fraud Consultant at ali.twidale@esarisk.com, on +44 (0)343 515 8686 or via our contact form.

Money laundering and the charity sector

Posted on October 21, 2021July 13, 2023 by Admin Admin

Arguably, the effects of money laundering and financial crimes are even more devastating for charities, as their funds have been raised to help the most vulnerable in society. This makes the prevention and investigation of all financial crimes against charities extremely important.

The reality for most of the 169,000 registered charities in England and Wales, along with the millions worldwide, is that they often have low levels of security to all the funds they hold and little awareness of good money laundering and financial crime prevention controls. This is demonstrated in the distressing statistic from the Charity Commission, the UK charities regulator, that an estimated £8.6 million was lost in 2020. And that’s only what has been reported.

There’s no getting away from it, financial crime in the charity sector is a serious problem and it is only getting worse.

Money laundering is defined in the Proceeds of Crime Act as “the process by which the proceeds of crime are converted into assets which appear to have a legitimate origin, so that they can be retained permanently or recycled into further criminal enterprises” and the three main stages are Placement, Layering and Integration.

How are charities used to launder money?

In a charity sector context, a really simple example could be a large donation to a charity of ‘dirty money’ or proceeds of crime which is then layered in with legitimate funds that the charity holds. A fake beneficiary is then set up as a front which will receive the freshly laundered funds from the charity, all clean and appearing legitimate. Sadly, there are many more examples of how charities have been used and abused by criminals.

A bona fide charity may have criminal employees, funnelling off hard-won monies.

As well as the charities being victims of financial crimes themselves, the actual charity entity could be a sham. In the most shocking examples, fraudsters have taken to brazenly setting up fake charities and fundraising for donations which are then simply pocketed or used for other illegitimate activities.

Critically for non-criminal (i.e. most) charity employees and trustees: if they fail to report any suspicions of money laundering, then they could be liable to prosecution or a hefty fine.

Not only is the financial loss devastating for charities, but the next biggest impact is reputational damage. Imagine hearing that a major charity had been involved, or had been used, in vast amounts of money laundering of funds… You would probably think twice about donating to that charity – if they’ve lost money previously, what’s to say it won’t happen again? Charities hugely depend on funding from donors so if those sources of income diminish or dry up, it could signal the end of that organisation.

How ESA Risk can help fight money laundering in the charity sector

We can undertake financial crime risk assessments, advise on Know Your Donor and Know Your Partner procedures and help you set up and maintain a Suspicious Donations Log. If you’re a trustee who’s signing up to the new Stop Fraud Pledge, we can support you with all 6 of the pledge’s steps: Appoint, Ensure, Consult, Create, Perform and Assess.

Equally, we can carry out enhanced due diligence before you make a donation to an organisation (to avoid fake charities, for example).

This article was published as part of Charity Fraud Awareness Week 2021.

Data Management in Banking

Posted on October 6, 2021July 13, 2022 by Admin Admin

Effective data management in banking is paramount in protecting your information, to avoid data leaks and maintain customer privacy. When handling confidential client information, there are various safety measures and precautions that banks take to ensure it remains secure.

First of all, data management involves a structured process of collecting the data, ensuring each client’s information is efficiently processed and organised. The storage of data is paramount in maintaining successful data management in accordance with the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR) and this often involves the cloud or on-site servers that are equipped to store and segment data appropriately.

The digitalisation of information has made it much easier to manage client records, especially when it comes to monitoring online behaviour and keeping records of money going in and out. Through IT infrastructure, analytical models can be made to provide insight into market trends and customer behaviour. They can detect patterns of behaviour to predict future events, also, such as the likelihood of a customer to become overdrawn.

This aspect of data management takes on a practical approach and enhances customer service, as well as giving the bank more information on how best to allocate funds. Alongside data analytics, online reports and dashboards can also track the bank’s performance.

‘The secure management of all types of data remains one of the highest priorities for the UK banking industry, especially with the added pressures of exponentially increasing fraudulent activity and targeted scams that have been born out of the Covid-19 pandemic.”

Is your data safe?

Many people in the UK have concerns about their data being at risk due to hackers and fraudsters. Banks have a large task to avoid cyber attacks and fraud, create financial products and services tailored to customers, and pre-empt customers’ needs, all while storing and protecting vast amounts of data.

Data stores and legacy systems, although being hard to access, can be infiltrated, so banks ensure regular assessments and analysis of systems. Risk models can also be drawn up to create security plans in case something goes wrong, and banks can opt for more secure storage systems such as Apache Cassandra, which is a scalable, open-source database that enables lots of secure data to be stored at once.

“Data breaches create high-profile activity in the media and so the banks need to constantly invest and work even harder to protect their assets and reputations, which will ensure customer confidence is kept high.”

Customers are now able to request a copy of what personal information of theirs is stored by banks, although this can take up to 6 weeks. This is called a subject access request (SAR) and originates from the EU General Data Protection Regulation (GDPR), but it has remained in UK law under the Data Protection Act despite Brexit.

Banks work to provide trustworthy storage of customer funds alongside optimising their own revenue. By offering a positive customer experience and maximising the value gained from customer data, banks fulfil their role as an institution. Managing your data effectively is therefore in their best interest, not only to magnify their own revenue but also to maintain reliability as a business. But it is also important for us as customers to be diligent when it comes to storing our money and be aware of the risks that come with entrusting capital to a separate institution.

Tag: Banking and Financial Fraud