Oral evidence: Treatment Of Financial Services Consumers: Cybercrime and Fraud, HC 631Wednesday 5 November 2014
Oral evidence, 5 November 2014.
Witnesses
Simon Fell, Acting Head of External Affairs, CIFAS, Donald Toon, Director, Economic Crime Command, National Crime Agency, Andrew Archibald, Deputy Director, National Cyber Crime Unit, National Crime Agency, gave evidence.
Chair
Thank you very much for coming to give evidence this afternoon and you will have heard the evidence from the preceding panel. Could I ask each of you in turn whether there is anything of substance that we have heard that you would want to qualify or seriously take issue with? Who would like to go first?
Andrew Archibald
I am Andy Archibald, Deputy Director in the National Cyber Crime Unit in the NCA. There were a number of interesting discussions in that last session, particularly around cyber. I think the last question related to what advice we would give to the general public and to members of the community: it is very much about reinforcing the message through whatever channels we can, and there is a range of different channels to do that. It is about reinforcing the message about protecting in computers those parts in your life that you value, such as your financials, your photographs, all those aspects that are now online. It is about taking steps, using antivirus and protecting your computer.
Chair
The key message we have just heard from that session is that fraud is on a much larger scale than it appears from the official statistics and, indeed, they give only a very dim idea of the full scale. Are any of you, from your professional standpoints, taking issue with that?
Simon Fell
I completely agree with that position. Our view is that we see an awful lot of fraud. As an organisation we report it to the National Fraud Intelligence Bureau so that police forces can take action, but it does not appear in the official crime statistics. We are reporting 1,000 cases of fraud a day to the NFIB, and that means people don't have an awareness of the scale of the problem that they face.
Chair
Nor do we from the information provided by banks on the scale of fraud they are afflicted by—correct?
Simon Fell
Correct.
Chair
Mr Toon, have you anything to add?
Donald Toon
I would generally say that fraud and economic crime in general are probably underreported. We have certainly seen increases in the level of reported fraud but we have no real basis to make an assessment of whether that is a significant increase in the fraud problem or an increase in the proportion that is reported. We have certainly seen—if you link in to the wider financial risk around money laundering—in the last five years a 50% increase in suspicious activity reports coming into the Financial Intelligence Unit. That would indicate there is probably a significantly larger problem in that space. However, frankly, we have a very limited intelligence picture of the scale of the problem around most economic crime.
Chair
That is an extremely concerning but important piece of evidence.
John Mann
Many banks have been prosecuted for illegalities; do you have proper access into the banks to find out what you need to know about the level of risk as well as about the specifics? I am talking about banks operating in this country.
Donald Toon
That is quite a complex question to answer. There is absolutely a genuine issue for both banks and banking customers, whether they be corporate or individual, about providing access to customer data. There is an absolutely clear issue for us around being able to obtain access through production orders or customer information orders where we need to be able to go in front of a judge and seek authority. There is a good relationship certainly with all the major banks on providing information that is essentially maybe non-specific, slightly anonymised from individual customers, looking at trends, looking at types of problem, development of risks, but when we get to the point of customer data that is a hugely sensitive issue. It does require legal governance and that legal governance is in place. We are absolutely working closely with the banks. The Home Secretary and the Governor of the Bank of England and the Chair of the Financial Conduct Authority brought together a meeting with all the bank chief executives earlier this year. As a result of that there is now a financial sector forum between law enforcement, the Home Office and the banks. That is doing quite a lot of work now on information sharing. We see certainly an improvement in the relationship but it is a sensitive and difficult relationship. The banks are naturally cautious about any risk of providing information inappropriately or inaccurately to law enforcement.
John Mann
Is there a big variety between the attitude and aptitude of the banks in relation to that?
Donald Toon
We have been working with all the major banks in the UK. All the major banks have been very keen to co-operate as far as the law will allow.
John Mann
How many cases of cybercrime against financial firms and customers did the NCA investigate last year?
Andrew Archibald
In terms of how many we investigated, there is a differentiation between cybercrime and cyber-enabled crime such as cyber-enabled fraud. We have a number of investigations ongoing at the minute from the National Cyber Crime Unit perspective that are principally against some of those high-end cases—those that develop malware exploit kits and intrude onto those systems in the financial sector, for example. Malware such as Gameover ZeuS and Shylock have had a lot of media attention recently. Our investigations have focused on those particular aspects of cybercrime. For attacks on the financial sector and intrusions into the networks, it is the motivation that changes it into the fraud aspect: cyber-enabled, manipulative access of systems and theft and harvesting of personal data to commit fraud.
John Mann
How many are we talking about?
Andrew Archibald
In terms of the fraud side, we have around about 40-45 cases against high-end malware and developers and those deploying systems against banks and communities.
John Mann
Just to follow up on that, what is the timescale for you to thoroughly investigate? Are we talking weeks, months, years?
Andrew Archibald
If you are dealing with cybercrime, it is a global problem and the solution is international, so it is multiple jurisdictions. It is not bilateral investigations. Every investigation we have ongoing involves a number of international partners and the reason for that is the threat comes from overseas. That is from those who develop the malware, those who sell the malware on criminal-hosted sites in another country. Multiple countries are involved. Some of the investigations or all of the investigations we have involved relationships with a number of countries, 10, 11, 12 countries and that is a real challenge because of different cultures, different values, different judicial systems. All of those are quite challenging. Investigations can last anything from three months to 12 months or beyond. It depends on the scale of the threat, how many countries are impacted by the same threat, the ability to share intelligence and information with those countries and to agree among 10 or 11 countries, 15 or 16 agencies, the best approach to arrest or disrupt or take other intervention steps.
John Mann
You are doing 45-50 at the moment?
Andrew Archibald
Yes.
John Mann
What is the capacity you have?
Andrew Archibald
I would say we are at capacity currently.
John Mann
You are at capacity?
Andrew Archibald
We are at capacity currently, yes.
John Mann
What happens if more comes in?
Andrew Archibald
We then go into the process of prioritisation. That then gets to what is the report, what is the threat? We speak regularly, and Donald touched on a number of forums, we have regular meetings with the banks through a virtual task force that is an operational group. We meet regularly with the British Bankers Association one-to-one, but if the banks were to come to us, we ask the banks, “What is it you are seeing attacking the banking sector currently? What is your gravest threat?” and we then prioritise that as investigations we would take forward with partners overseas. If the banks came to us and said, “This is now a massive threat because it has just recently emerged” we would have to re-prioritise some of them.
John Mann
What about consumer fraud?
Donald Toon
If you are talking about fraud in the round then the figures would be relatively similar. Consumer fraud is not a term that I would use generally. Our primary interest as an agency is around serious and organised crime, so serious and organised fraud. The number of cases across economic crime would be very similar to that for Andy for pure cyber. The length of time would be very similar as well. You are talking months generally for intervention, usually because they are international.
John Mann
Are you at capacity?
Donald Toon
Yes, we are at capacity. Across economic crime in the round, yes, we are at capacity now.
John Mann
My final question: A “yes” will do. Is the trend of this kind of crime upwards? Are there more every year?
Andrew Archibald
I think what we are seeing is our situational awareness is improving, so we are seeing more reporting, more information being shared through—I don't know if anyone has mentioned the cyber information-sharing partnership. We are seeing more information intelligence coming to us that perhaps was not previously shared. My sense of things is that this is increasing.
Donald Toon
On the wider economic crime environment, I would say the same, absolutely. Certainly we are seeing our knowledge is improving, our picture of what is going on is improving. As a result of that we are identifying more criminality.
Jesse Norman
How many prosecutions have you brought on these issues in the last 12 months?
Donald Toon
It is a very hard question to answer in terms of these issues. For economic crime we are talking everything right across from money-laundering, corruption, sanctions evasion as well as fraud. The total number of people prosecuted as a result of those investigations certainly from our side would be round about the three figures, round about 100.
Jesse Norman
Approximately 100, right?
Donald Toon
About 100 in the last 12 months, yes.
Jesse Norman
This is related to cyber stuff, not obviously other serious organised crime, with a cyber-angle to it.
Donald Toon
Virtually everything we are talking about would have a cyber-angle to it of some form.
Jesse Norman
On the other side?
Andrew Archibald
On the other side, having mentioned organisations being in existence 12 months, having described some of the processes, we are involved in prosecutions both in the UK and overseas. There are some other operations, but we have about three or four or five high-level cases that are going through the criminal justice process at this stage. We have also co-ordinated other work with policing and regional resources.
Jesse Norman
I understand the difficulty of bringing and investigating cases here. You have described it, and also, of course, the difficulty of knowing what the activity is. But nevertheless, we seem to be in a situation where there are hundreds, perhaps many hundreds of serious attacks and a relatively small number investigated at one time, given the resources that you have, and a relatively smaller number being brought to trial. Is that fair?
Andrew Archibald
It is and, given the nature of the criminality we describe, it may not always be possible to arrest.
Jesse Norman
You mean it may not exist in a way that allows you to bring a prosecution?
Andrew Archibald
If you are measuring success, because of the challenges we have heard described earlier, some of those who are attacking us are in countries where we don't have a particularly good relationship, so part of it is about how we disrupt them, how we work with international colleagues who we may then share our intelligence with so they can perhaps take executive action. It is about a truly global response.
Jesse Norman
It does not feel to me as though there is a very strong deterrent that comes from law enforcement at the moment, given the number of cases there are and the number you are able to prosecute and investigate.
Andrew Archibald
At the high end.
Jesse Norman
At the high end. Okay, that is helpful. The next question, if I may, have you guys done any kicking of the tyres on the Bank of England’s defences to cyber threat and the strength of the monetary system?
Andrew Archibald
What I can say is I have had several meetings with the Bank of England and I know they are going through a process of recruitment in developing their capability in that area, so I know that they recognise the threat. I think they understand the risk and where the threat comes from in terms of who might target then. They are therefore improving their capability. They have asked for advice and support on how they do that and I am part of an advisory panel that sits to assist them with that, so they are taking it seriously and they are improving their capability.
Jesse Norman
Thank you, and then the final question: you will be aware that a recent report found that we in Britain have suffered more sophisticated cyber attacks in the first half of this year than any other state in Europe and the Middle East. That is the one by FireEye, and I wonder why that is and whether that means that the UK is more vulnerable or is it that the returns to potential attacks are higher because so much of the financial banking system is in this country?
Andrew Archibald
I think it’s the last point you made there. That is why I think we are a target.
Jesse Norman
The criminal world is getting smarter about focusing on places where they think the loot is and they focus on this country.
Andrew Archibald
Absolutely.
Jesse Norman
Thank you very much.
Chair
The companion question on the Bank of England’s efforts is a similar sort of question that might be asked about the FCA. Mr Fell has written to this Committee on that subject in the past. Are they giving it the right priority? How are they doing? Would you please mark their prep?
Simon Fell
I would probably rather not mark it out of 10, but I think they are doing some good work at the moment. We have found them to be a very good partner in looking at some of the issues that enable fraud and drive fraud.
Chair
They are getting on top of it?
Simon Fell
They are producing research now, so they have just come out, for instance, with a piece of research that looks at how the over-55s are particularly susceptible to certain cyber attacks. That can then drive work that we do in industry and the banking sector to help drive prevention as well.
Chair
Would you be inclined to take off the table what you told us three years ago where you said, “The already muddled crime prevention landscape is having another player added to it”?
Simon Fell
I would be very happy to take that off the table.
Chair
I just feel it might be helpful.
Steve Baker
In the earlier evidence, we heard about the range and scale of cybercrimes and also the potential difficulty of detection. Mr Archibald, how do you categorise and prioritise cybercrimes?
Andrew Archibald
The key to us is, again, to firstly assess what the threat is: what harm is it doing within the UK? Principally, from a cybercrime perspective, it is against the financial sector and it is financially motivated, so we are interested in the scale of that threat, whether losses are attached to that threat, how many individuals, perhaps, are affected by that threat. Where are the actors and which other countries where our international colleagues are also suffering and have investigations into the threat? It is very much malware and the deployment of malware, and then the manipulation of the computer network they have intruded on and the harvesting of personal data that then leads to fraud.
Steve Baker
That sounds very economically focused, but in the earlier evidence, I asked, “Could we have a catastrophic attack on the financial system and not be able to detect who had carried it out?” I am a bit sensitive about how I ask this question, but to what extent do you work on that problem, the issue of financial stability and the difficulty of detection?
Andrew Archibald
We do. We do work hand in glove with other agencies in the UK who have that as a priority.
Steve Baker
But your own priority is to concentrate on fraud and individuals.
Andrew Archibald
It is the cybercrime element and there is the other aspect that may be a nation state that is handled by other agencies, but we are linked with them closely and share in an appropriate way.
Steve Baker
Thank you, that is very helpful. I notice just looking back at your CV, Mr Archibald, you previously led operations for Special Branch nationally, so I feel sure you are familiar with some of the nastiest people we have to deal with. Are those same people involved in cybercrime and to what extent?
Andrew Archibald
It would be difficult to assess that. I think if you are involved in serious and organised criminality then part of your organisation and your criminal infrastructure will involve someone who understands how to hack into and intrude on a computer system. I am pretty confident of that.
Steve Baker
The range of people we are talking about when we discuss cybercrime will be everything from what is euphemistically called script kiddies, teenagers who have downloaded a kit, through to the most serious criminals internationally.
Andrew Archibald
Yes.
Steve Baker
What do you think is the origin of the most serious threat we face?
Andrew Archibald
I think Russian-speaking.
Steve Baker
Russian-speaking organised crime.
Andrew Archibald
Yes.
Steve Baker
Thank you. What kinds of crimes are occurring in the highest volume?
Andrew Archibald
I think we are seeing the harvesting, through the employment of malware and intruding into what they are discovering, of financial detail. It’s then the creation of sites where we then see those credit cards and debit cards then being sold and bought and used across the world to commit fraud.
Steve Baker
How seriously do you take this idea of spearfishing, the idea that a lot of that stolen data is used to dupe people more effectively?
Andrew Archibald
Yes, absolutely, it is a real threat and it is commonly used and is a tactic that cyber criminals use every day and I would see it as a tactic they would use, yes.
Steve Baker
Mr Toon, do you agree or would you add to what has just been said?
Donald Toon
I would absolutely agree with what Andy says. I do have a concern, perhaps, to an extent that it is possible to see cyber as the only issue here when there are a number of broader issues around cyber-enabled or cyber-linked fraud. But there is criminality that risks undermining the credibility of the UK financial sector that has little or nothing to do with cybercrime. That is when you are into areas around economic crime that are about the provision of the capability to launder money in bulk as a service by the UK financial sector and by related professions. I worry a little that an over-focus on cybercrime may reduce the level of focus on that broader threat, some of which is a traditional threat. Often for banks and other companies, yes, they have a significant concern around cyber and hacking. But, of course, they have a significant concern also about the so-called human factor: the insider threat, the disaffected member of staff who downloads customer data and walks out with it on a stick.
Steve Baker
Without wishing to put words in your mouth, what I think I am hearing is that we should be concerned about the change in the modus operandi of quite traditional crimes over the hype around some of the more exciting sounding crimes.
Donald Toon
Yes, we should be careful of following the bright, shiny and new. Bear in mind that there are big, older, traditional crimes here, some of which are becoming more of a problem as the world becomes ever more connected, ever more online. Certainly if you look into the financial transactions world, if you look into things like international corruption, the ability to move money around in seconds in multiple transactions internationally, that is a huge issue. It is not cybercrime.
Steve Baker
We understand that one of the objectives is to disrupt the supply of so-called hacking software to criminals. As you possibly heard me say earlier, as a software engineer I look at these tools and think, “Well, this is just programming languages and knowing how to use them”. What is your approach to disrupting the supply of hacking software, and how can you possibly do it?
Andrew Archibald
I think the challenge in terms of disrupting the supply and the access to hacking software, which is available to download and to purchase, is that the sale of the malware is not always in an open and transparent way that you would readily find on the internet. It is in encrypted sites, it is in secure sites, and in the same way that criminals have always taken steps to secure their criminal enterprise, cyber criminals do likewise. What they do is they try to sell the products in a secure environment. Again, it is about us having access to information and intelligence about those, particularly those in the UK we have an interest in who have purchased a download and remote access tools in, for example, Blackshades malware—there was an operation against that where there were members of the public in the UK who downloaded that software. With our colleagues in policing and regional units, we arrested some of those, but we also contacted those who had purchased but had not deployed to give them warnings and dealt with them in that way. So I think there is a range of things we can do. One is about ensuring that those who are visiting those sites are absolutely clear about the nature of the sites they are visiting, a sense of the criminal activity that they are or could become involved in, and also to try to bring down those sites that function purely for criminal activity and for the sale of criminal goods. To do that, again because the infrastructure is not always in the UK, it becomes a global issue and an international challenge.
Steve Baker
I am concerned about something when I hear you say that. It sounds good. With something like a Linux distribution, like a Knoppix security tool’s distribution, you download it, you bang it on a CD and it is a very useful tool for legitimate purposes. I used to carry it all the time, at the risk of being arrested on the way out the door. If you are a software engineer, it is useful to have a CD with a range of ordinary software tools, which can have legitimate purposes, including testing security. Are we going to end up licensing software engineers to have relatively ordinary software tools?
Andrew Archibald
It always comes down in terms of the possession. Is the possession with criminal intent? That is the part we are interested in. There are a number of aspects of the cyber infrastructure that we are interested in, but some of that is legitimate. We are only interested in those who are motivated to have an intent to commit criminal activity. Sometimes it can be difficult to make that assessment but that can become apparent quite quickly as we do further investigations and monitoring.
Steve Baker
I am trying to understand how you distinguish the two. If a Linux distribution was a boot CD that happened to have a lot of security tools on it but it was freely available to download and quite public, you would not consider that criminal. But if somebody had securely encrypted a site, you had to pay for it and it became apparent that it was intended for malfeasance—
Andrew Archibald
We would be interested in what the motivation was. In terms of the possession, that in itself is not a criminal offence. What we are interested in is the possession and then the activity that then follows.
Steve Baker
Okay, so given that, how can you meet the objective of disrupting the flow of these tools?
Andrew Archibald
In terms of those particular tools?
Steve Baker
It is about the particular, it is about saying we want to disrupt a tool when it happens to be bundled with obvious malicious intent.
Andrew Archibald
If we return to the case of Blackshades, that is an example of a tool that was downloaded from some of those websites and not everyone went on to commit criminal acts with that. But part of the assessment of the investigation was about who has downloaded that software, what have they done with it, how have they used it and if they have used it, was it a criminal activity. There is a range of other tactics we can use in terms of interventions or establishing whether it is for legitimate use. The point you make about whether we would license software engineers is interesting. It is not an issue we have come up against as a problem yet.
Steve Baker
Just to be clear on the record, I am not suggesting it. I think it would be a disaster, but what I am driving at is the difficulty of distinguishing between legitimate software engineering and criminality. Thank you.
Alok Sharma
Mr Archibald, you talked about the fact that you deal with or co-operate with 10, 11, 12 other countries. Can you tell us which organisations you are working with and how you work together with them? Also it would be really useful—we have had a lot of general discussions here—if you could give us a case study, obviously on a no names basis, where you have worked together with other agencies and you have achieved success?
Andrew Archibald
In terms of who we work with, I think the UK is in a fortunate position in terms of the international bodies we are involved with. I was in Vancouver last week and chaired the Five Eyes Cybercrime Working Group. I will be in The Hague on Monday chairing the Joint Cyber Action Taskforce in Europol. In that, for example, there are 12 European countries, three US agencies, EFP and RCMP, with staff on the ground in The Hague. So we work with them in a collaborative way and what we hope to get from that collaboration is the ability to—
Alok Sharma
Could I just ask you to expand on collaborative? What does that mean? Do you have members of your staff who meet with members of their staff every month, every quarter or whatever it is?
Andrew Archibald
No, they are in the same building, in the same office, in the same room with access to IT and connectivity back to our respective agencies. The key part is about deconflicting operations. So having an understanding that Shylock malware attacking the financial sector in the UK is also attacking Dutch infrastructure, Spanish infrastructure, US infrastructure and establishing what operational activity we all have in our respective countries and how we pool that together to have the greatest impact against that particular threat. We do that on a routine basis and we have a process for prioritising what the operational activity is we will do through there. We have had some success already with that. I mentioned Shylock—that would be one of the examples that we could point to. That was very much malware deployed against the financial sector in the UK suffering quite significant losses, also impacting on other countries and infrastructure in different locations around the world, with some of the key actors in different locations around the world. So what we had was a co-ordinated operational activity that resulted in arrests, which resulted in take down of the botnets that were distributing the malware and a successful operation. The key part, however, is how long does that last. So if we bring down and we are able to disinfect the malware and it reduces the threat in the UK, how long does that last before it re-emerges. That is a key point that we try to establish as well. We have around 16 operations being progressed through the centre we have in The Hague. I think we want to see that expand to have an engagement with the European financial sector as part of that arrangement as well.
Alok Sharma
Just so I do not misunderstand, that is 16 cross-border investigations that you are doing out of what, the 40 to 45 you were talking about?
Andrew Archibald
Some of those 40 I mentioned, those are in addition. So we will have—
Alok Sharma
What percentage of the cases that you have on your books currently have a cross-border dimension as opposed to not?
Andrew Archibald
Every one, but some of those might be with countries that are not necessarily involved in the take down.
Alok Sharma
Turning to where these cyber attacks are coming from on the UK, I think there was a discussion about Russia being one of the areas that—
Andrew Archibald
Yes, Russian speaking.
Alok Sharma
Russian speaking. Do you have your own internal league table by geography and then also by the type of organisation, whether it is quasi-government, individual or organised crime? Do you have those sorts of figures that you can talk to us about?
Andrew Archibald
We have a priority country matrix.
Alok Sharma
Which are?
Andrew Archibald
Sorry?
Alok Sharma
What are those priority countries?
Andrew Archibald
Some of them are the ones that would immediately jump out at you, Russia, China, Vietnam, Brazil, India. That is in relation to two things. First, it is in relation to some of the actors but the other one is in relation to some of the infrastructure that is supposed to be there. So, for example, the US also features on that as well. In terms of what our engagement was, that is where the critical infrastructure is, that is where the big global corporations are so, again, we see the benefits from the work within Five Eyes. We are doing a piece of work at the moment, which is across the Five Eyes, identifying sharing on priority countries and looking for duplication.
Alok Sharma
When you talk about these countries, you are not necessarily talking about government or quasi-government organisations that are doing this?
Andrew Archibald
I am not in the examples that I have given, but there are some countries, of course, where if you are involved in cybercrime and you want to locate your infrastructure, you would choose to locate the infrastructure in a hard to reach place for colleagues and allies or you would put in a place where the framework is less well developed. So there are other countries.
Alok Sharma
Can I just go back to this point we discussed with the last panel on the number of individuals or organisations that are perpetrating all of this crime. I think there are various statistics about there only being around 100 cyber criminal kingpins. How do you quantify that?
Andrew Archibald
A colleague of mine, Troels Oerting, recently said that it was around 100. I would not put a figure on it. I do not think our intelligence is sufficiently developed to say with real confidence what that number looks like. It was interesting that one of the previous panellists referred to around 1,000. I think that highlights the challenge. I do not think it is a large number, it is a relatively small number. What I am speaking about when I speak about the kingpins are those that write the codes and the programmes, and those malware developers. Those are the kingpins, I think, but I would not want to say it is 100 or 1,000. I do not think our intelligence is sufficiently developed to be confident about that.
Alok Sharma
Whether it is 100 or 1,000, would you like to hazard a guess of the percentage of those that are based in China, Indonesia, basically the east and the Far Eastern countries?
Andrew Archibald
I would not like to hazard a guess. What I would say is many of them are in Russian speaking countries. That would be as far as I could go with any degree of confidence. Those skills will continue to develop and that may change, but that would be my pick.
Chair
Mr Archibald, do you bank online?
Andrew Archibald
I do.
Chair
Do you, Mr Toon?
Donald Toon
I do.
Chair
Mr Fell?
Simon Fell
I do.
Chair
Would you recommend it to those who are less financially sophisticated as consumers than yourselves?
Andrew Archibald
I would. I would say, however, listen to the advice and take up the opportunities that the banks give you when you do bank online about downloading the security and the protection that they offer. Although I enjoy banking online, I think my wife wishes I had never learned about banking online, it is too easy to access.
Chair
Mr Toon, Mr Fell, anything to add?
Donald Toon
Very similar position.
Simon Fell
The same from me. The only thing I would add is that from a fraud perspective we are seeing a growth in online fraud. More and more services are moving online and therefore that is where the fraud is going too.
Chair
That is what is being reported and, as a result, it is putting people off. But the message you are giving today is that it is safer to bank online, that is what it sounds as if you are saying.
Simon Fell
If you use it appropriately, it is certainly safe.
Chair
It is the “used appropriately” that is—
Andrew Archibald
I think that is the message we have to get across and we have to repeat that message as often as possible with some of the government initiatives around: streetwise, get safe online and others. We have to reinforce that if you are going to use those then protect yourself and take advice.
Chair
Mr Fell, your fraudscape report found that the level of fraud fell by 11% in the previous year but, as you pointed out yourself, the ONS concluded that it had increased 21% over the same period. What really went on? We do not know, do we?
Simon Fell
We are collecting the figures for this year and we are seeing it increase again. Fraud is not going to go away and we only see a small part of the picture.
Chair
But we do not know the answer, we do not have even halfway reliable stats, do we?
Simon Fell
No, and I think this is—
Chair
Do you not think we have to do more about that?
Simon Fell
I absolutely do and I think this is a big part of the problem. Going back to your question on online banking, one of the reasons people maybe do take risks when they use services like this online, is that they are not aware of the scale of the threat.
Chair
What are you as an organisation doing to collect more reliable stats?
Simon Fell
We are fed our information by our member organisations, so we are cross sector, which does include the banks. They are audited, we make sure the figures they give us are accurate but, again, that is only a part of the picture and we are aware that we are, as an organisation, only part of the picture for even just the fraud landscape in the UK. What we would like is to see our figures, and others, collected and put in the official crime statistics. That would allow law enforcement to properly direct resource. It would allow politicians to be able to put the appropriate pressure on organisations to focus on the issues that really affect consumers, and it would allow consumers to be able to look at their own behaviour and think, “Actually, there is a threat here and I need to change the way I am engaging with the online environment”.
Chair
In the earlier session, Mr Clayton suggested that we should consider finding ways of encouraging banks to compete on minimising fraud, which would presumably require some sort of information in the public domain about the relative performance of each bank. Would you all support that? Would you support that, Mr Fell?
Simon Fell
There are two issues here. As a fraud prevention organisation we work on a non-competitive basis and we have done everything we can to take competition out of the issue of fraud because we know that if you collect more fraud data you can prevent more fraud from occurring. Prevention is better than cure in many cases. But then there is the other issue of keeping your consumers safe. That is providing them with the software and advice in order to keep their home PC or their mobile secure. I think that is an area that is ripe for competition.
Chair
Did you agree with the evidence that you heard earlier that it may be that not enough is being done in this field by the banks because banks do not have sufficient incentive to put the resources into it?
Simon Fell
They are certainly putting a lot of very good and useful information out there.
Chair
I am talking about the resources into tackling fraud, not the resources into telling the public about it.
Simon Fell
I could not speak for the industry but I think they are putting a lot of resource into it. They are doing their best to—
Chair
I am not asking you to speak for the industry, on the contrary, we have you before us because we want your view, not the industry’s view.
Simon Fell
I think they are doing an awful lot to mitigate the problem. As I mentioned earlier, we are increasingly moving our products and services online. That takes the threat online. If you look at how a fraudster, a cyber criminal, might attack an organisation now, 10 years ago if you were trying to undertake a 419 scam, you would have to buy envelopes and stamps. Now you can send a million spam emails. How many responses do you need back for that to be a profitable enterprise for you? Probably just one. This is a challenge on a scale that we have not seen before and I think banks are doing a pretty good job of managing that.
Chair
When you buy a motor car you can make up your mind, “Well, I would like to buy a fast car”, which may not be quite as safe as a Volvo or something, or at least the car manufacturers ostensibly—even if cars are nearer having the same level of safety than they might let on—are competing to some degree on safety. In the area of the safety of your bank account, customers are provided with virtually no information by which to make that assessment. Much less at any rate. That is the question that I am asking you.
Simon Fell
I certainly would not have a problem if that was an area they decided to compete on. Consumers might benefit from it.
Chair
That would not conflict with the objective of the approach you say you have been taking to try to take the competition out of this subject in order to secure co-operation?
Simon Fell
It is taking competition out of sharing information about fraud for the common good. I do not see that those two areas would necessarily conflict.
Chair
Mr Toon, do you want to add anything to what has been said in those exchanges?
Donald Toon
A couple of small points, perhaps. I would be very cautious about greater competition around security and fraud. One of the previous witnesses made the point that the banks share a huge amount of information because they are very conscious that competition around security could lead to significant problems simply because banks will not share information about risk. They will look for competitive advantage all the time. Ultimately that may be of benefit to consumers but it could certainly be a situation where a lot of consumers will be hurt in the process. It is something I would certainly take as a very cautious step.
Chair
The end point is that in all cases we are trying to maximise protection for the consumer. Mr Archibald, anything you want to add?
Andrew Archibald
As a consumer I would like to know that. If I was answering that as a consumer looking at which bank I would like to bank with, I think that would be really helpful and it would inform my decision. I would say, just finally if I may, I think the banks are collaborating and sharing a lot more information than perhaps they have in the past, and they are doing it through the cyber information sharing partnership posted within CERT UK, where all the major banks and a number of the other banks share details of attacks or of attempted attacks on their infrastructure, and share code and AMOs and other details that can benefit colleagues in other banks.
Chair
We have had a very interesting second session as well as first this afternoon. Thank you very much for coming to give evidence. We may trouble you with further requests for information in writing. We look forward to those exchanges. Thank you very much indeed.
Oral Evidence
Oral evidence: Treatment Of Financial Services Consumers: Cybercrime and Fraud, HC 631 26