Oral evidence: The growing threat of online fraud, HC 399

Oral evidence, 18 October 2017.

Witnesses

Jane Vass, Stephen Jones, Brian Dilley and James Martin.

Chair

Welcome to the Public Accounts Committee. We are here today to look at online fraud. We have two panels and are working off some of the information from the National Audit Office’s excellent Report into this growing threat. We will later have Government figures who are helping to tackle this but on our first panel we have a mixture of people both representing consumers—I suppose, in a way, you all represent consumers—and at the forefront of tackling this. From my left to right we have Jane Vass, the chief executive of Age UK—

Jane Vass

Director of policy and research.

Chair

Forgive me; she is the director of policy and research at Age UK. I have a list that gives you different titles from those under your names; I will double-check it before we introduce you wrongly. We have James Martin, the crime and security adviser at the British Retail Consortium, Stephen Jones, the chief executive officer of UK Finance, and Brian Dilley, the group fraud and financial crime prevention lead at Lloyds Banking Group. Welcome to you all. We are aiming for this session to last about half an hour, so if you could keep your answers short and to the point, that would be incredibly helpful. May I start with Stephen Jones from UK Finance? One of the interesting things about this hearing is that we did not really receive any evidence from banks and financial institutions about the problem. I wondered whether there was a reluctance for them to admit any fraud that is going on that they are aware of, or do you think they just didn’t feel like submitting evidence?

Stephen Jones

I am sorry; I do not know why evidence wasn’t formally submitted, but it is a problem that the industry takes incredibly seriously. As you know, we currently publish the data on unauthorised fraud and are about to start publishing the data on authorised fraud in a manner that ensures that we can—

Chair

But that is published in aggregate, isn’t it, and not by individual banks?

Stephen Jones

It is not published by individual institutions at the moment. At the end of the day, I think seeing where patterns are emerging in aggregate is helpful from an industry perspective. There may be divergences between individual institutions; part of our job at the centre, as the trade association, is to try to highlight that and ensure that best practice is promulgated across the membership, in order to make sure that everybody is performing to the highest level, rather than the lowest level, frankly.

Chair

Mr Dilley, does Lloyds Banking Group publish any information as a group?

Brian Dilley

We publish information around our approach to fraud prevention. We don’t publish numbers.

Chair

Why not?

Brian Dilley

One reason the banks don’t publish individual numbers is because, if you could compare the numbers and see which was the weakest of the banks, that is where the fraudsters would go.

Chair

You might also lose customers.

Brian Dilley

You may do.

Chair

Is that a consideration?

Brian Dilley

It would encourage the fraudsters to direct their activities towards the weakest area. Each bank knows how they compare; they know their own numbers compared with the industry numbers. We know how we perform against others, and that is used internally to improve our processes.

Chair

So what is the biggest problem for Lloyds Banking Group? What is the biggest, latest issue that you are hitting?

Brian Dilley

I think the emerging threat is authorised push payments—the authorised fraud. As we improve our controls over unauthorised access and we improve those mechanisms, the fraudsters are moving towards scams. From our perspective, that presents itself as the customer asking to move the money.

Chair

Do you give the money back? Have you ever given money back to anyone who has been the victim of that sort of thing?

Brian Dilley

We do give money back in certain circumstances, but not in all circumstances, because there is a limit to what we can do to prevent that. There are plenty of examples of where we have warned a customer that we think it is a scam but they insist on us processing the payment. By law, we have to process the payment.

Chair

Are there many people who are warned by the bank that it is a scam?

Brian Dilley

It does happen surprisingly regularly.

Chair

Percentage-wise?

Brian Dilley

I do not know the answer to that, percentage-wise.

Chair

What about if I were to walk into a Lloyds bank—I am not picking on you, but you are here representing one institution—and suddenly say I want to withdraw all my savings, what would your staff do about that? The online bit might have happened, but the actual financial transaction may be a physical one.

Brian Dilley

Within the branch, we have a very good record of preventing those types of payments. We have spent a lot of time training our staff on what to look for. Where there are indications that somebody may be making a transaction under duress, or because somebody has told them to, there is an additional set of questions. I also think the banking protocol has been a very big success. That is where, in the branch, they can call the police, who will come around and who often arrest the fraudsters, if the fraudsters are with them, or stop the individual making a payment.

Chair

You say you are doing very well on that. Can you give me some precise examples or figures for how you can prove that you are doing very well?

Stephen Jones

The banking protocol is one of the tangible outputs of—

Chair

That is the protocol. I am talking about when you say you stop people coming in and doing a fraudulent—

Stephen Jones

I was going to give you the numbers from the banking protocol, which is the recent cross-industry—not just Lloyds bank—initiative.

Chair

The banking protocol is getting the fraudster in the bank, isn’t it? I was talking about when someone comes in to withdraw their life savings or some uncharacteristic transaction. Mr Dilley, you said—forgive me if I misunderstood you—that you had a good track record on dealing with that in branch. Can you give me some examples? When you say you have a good track record, how can you prove that? Can you give us some more examples about how you have done that and what numbers you have been catching in branch, relative to other banks?

Brian Dilley

I think the banking protocol is relevant to that, because it is about those situations. If you have a situation where somebody comes in to transfer their life savings, and the teller in the bank thinks there is something suspicious, they will phone the police at that point. Those are examples of preventing real fraud.

Chair

You say you are doing very well on that. Do you think you are doing better than other banks?

Brian Dilley

I do not have the split by bank.

Stephen Jones

We are in the middle of rolling out the campaign nationally. So far, it has been rolled out with the police across 22 police forces, about halfway across the country. It started at the beginning of this year; by August 2017, about 900 cases had been referred to the police and about £6 million of fraud prevented as a result of staff being given specific training to identify duress in customers approaching tellers, and of the tellers physically intervening and calling the police to prevent the customer from withdrawing the money, even though that was what the customer had expressly come into the bank branch to do.

Chair

People coming in under duress to take their money out is quite a small subset, isn’t it? What about people who come in without apparently being under duress, who have been scammed at an earlier point online and asked to take the money out?

Brian Dilley

We have a whole set of criteria that we train our bank staff to look for. It is not just whether they are under duress, but if they ask to empty their account, for example. I do not want to go through all the individual examples, because then the fraudsters will avoid doing those things, but there is a whole list of things that could give rise to additional questions, to the banking protocol or to warnings to customers that we think it might be a scam.

Chair

Mr Evans, do you want to pick up on this?

Chris Evans

I should declare an interest as a former member of staff of Lloyds TSB, as they were then. My question is quite straightforward. You are closing numbers of branches all over the country. You say that the branch network is a stop on potential fraud. As you move from a branch model into more of an internet-style model, which I can perhaps understand, how are you guarding against people being under duress online?

Brian Dilley

We are doing a number of things around identifying transactions that look like they might be suspicious. To give you two examples of what Lloyds have done, we have added a box on to the online banking that will tell you which bank it is when you put the sort code in. That has stopped a number of them, because often people say “Transfer it to another account at the same bank,” and this comes up and shows you that it is a different bank. This month, we are going live with some additional questions when you set up a new payee, which also have a number of educational aspects, saying, “If you have been asked these things, this might be a fraud,” and asking you to confirm that you have not done certain things. Behind the scenes we have analytical tools to try to look for transactions with certain characteristics that might indicate that they are authorised push payments.

Chris Evans

I know you have left the regulated market now, but there was a huge problem of fraudulent mis-selling. How have you clamped down on that in the years since I left the bank?

Chair

Please be very brief on this, because it is not quite the same question.

Chris Evans

I could give you a number of examples of where people were put into bonds that they were told were savings accounts, and things like that. How have you cut down on fraudulent mis-selling? If somebody is found to be fraudulently mis-selling, what punishments are available to you there, besides dismissal?

Chair

Mr Evans, you have made your point, but we need to move on. You can answer the question, but then we will move on.

Brian Dilley

That is not an area of my direct responsibility, but the whole—

Chris Evans

Perhaps Mr Jones has an idea on fraudulent mis-selling?

Stephen Jones

The fraud you are pointing to is fraud by bank staff themselves in mis-selling.

Chris Evans

Yes, mis-selling. There have been a number of—

Chair

That is not quite the same as online fraud, Mr Evans.

Stephen Jones

There is a huge issue. We could spend the whole Committee talking about it.

Chair

Yes; if you could just answer the question as briefly as you can, then we will move on.

Stephen Jones

There is significant effort being undertaken to prevent bank staff from undertaking fraud on their customers. A huge amount of the conduct agenda over the last 10 years has been focused precisely on that agenda, and there is a significant amount of time, money, effort and, frankly, passion and heart going into making sure that that does not happen in the industry.

Chris Evans

That is what I was looking for; thank you.

Layla Moran

Sticking with the theme of what banks can do more of, I will bring you in, Ms Vass. I understand that Age UK have suggested a league table of banks. Can you tell us why you have come up with that suggestion?

Jane Vass

We would certainly like to see more transparency. I think the main thing for us—as well as things like the branch protocol, which is valuable and important—is that banks look at helping people who might want to put restrictions on their bank accounts if, for example, their mental capacity is declining, to allow them to maintain their financial independence and do what they can; they are not open to major risk of losing huge amounts. That is really what we would like to see banks do. In terms of banking transparency, we want to see the banks do more and come up with many more suggestions like this that will meet the needs of vulnerable people. But obviously if there is not enough action—Which? has come out with its authorised push payment super-complaint—there is a strong case for greater transparency.

Layla Moran

So, for the vulnerable users of your banks, don’t you think it is only fair that they and their families have access to all data and that, if there were a league table of which banks are less secure than others, they deserve to have that?

Stephen Jones

If I could put it more positively than that, actually what we are doing is going across all the members in the industry to identify exactly the kinds of practices that Jane has highlighted: in particular, ironically, where you are withdrawing functionality from clients online because they are not confident that they need that functionality and they are concerned about their vulnerability if that functionality is left available to them.

Chair

This puts a lot of onus on the customer.

Stephen Jones

At the end of the day, it is possible that different products in an outright sense can be offered which are basic and simpler with less, but ultimately there is a discussion that needs to happen between the customer and the bank in terms of the level of service that they want, particularly where they have a particular level of concern about whether that exposes them to issues of vulnerability.

Chair

Mr Dilley, Ms Moran quite rightly pushed the point about transparency. Just to pick up what I was saying earlier as well, isn’t it possibly the point that if you were more transparent—[Interruption.] It’s the ghost of Gladstone. Sorry, I do not know why I got distracted by that. Isn’t it the case that, as I said and Ms Moran has highlighted, if you reveal more about your position, it is not for your competition in attracting customers and, in effect, it helps you by not being transparent.

Layla Moran

It is a race to the top, surely.

Brian Dilley

As I say, the unintended consequence is that you reveal to the fraudsters where they should go first, and the fraudsters will move in an instant. Yes, it would have some competitive impact, but we do monitor what our customers are doing. We monitor complaints, to see whether that is causing individuals a problem in terms of how they are operating the accounts, and I think the negative side in terms of indicating where the fraudsters should go to would outweigh the competition aspects, which we do partly through things like FFA UK—[Interruption.]

Chair

I think we are all going to have to speak up. I am sorry. It is very distracting. We are trying to get it sorted out. It is either the wind—

Stephen Jones

You talk about the race to the top—

Layla Moran

A race to the top for security and safety. I am worried, now. You know if my bank is safe or not, but I do not. Shouldn’t I?

Stephen Jones

The whole industry is increasingly built around the sharing of data and of risk across the industry and with the criminal agencies, the police force, the National Fraud Intelligence Bureau and our own Financial Fraud Bureau in order to ensure that where incidences of attack of fraud emerge, that data is shared quickly across the industry, the vulnerability that is being attacked is identified and it is stopped across the industry. That approach has demonstrated some impact: there was an 8% reduction in cases of unauthorised financial fraud in the first half of this year compared with the first half of last year. The number is still far too high, but there were 937,000 cases of fraud against 16.4 billion transactions. We monitor that very, very carefully and very closely, and we are seeking to share threats as they emerge, how they can be prevented and make sure that the prevention measures take place across the industry. It is in our view better that that activity takes place in private, not in public, for the reasons that Brian has highlighted. It is not because we are trying to hide from the spotlight. At the end of the day, in the case of unauthorised financial fraud, this is a cost to the banks—the customer gets the money back—and it is therefore in the banks’ interest to prevent this fraud as well. But that kind of triage involving the banks themselves and the criminal agencies sharing data and threat information is how we build defences to what is an ever increasing threat of fraud across the sector.

Layla Moran

Except we have just been told that consumers do not always get their money back.

Stephen Jones

In the vast majority of unauthorised financial fraud cases, customers get their money back. In the case of authorised financial fraud, where a customer deliberately makes the payment—does so intentionally—and the bank is therefore obliged to effect the customer’s instructions and make the payment, there are circumstances in which the customer does not get the money back, because all the bank has done is give effect to the customer’s wishes to make a payment to a third-party account that that customer has nominated.

Chair

Okay. People are very interested in coming in, so Comptroller and Auditor General Amyas Morse, Mr Day and Ms Keegan.

Sir Amyas Morse

To be clear about this, given that you say the lack of transparency about individual bank performance is not as a result of banks not wanting to help themselves competitively or anything like that, does that mean, if you were clearly advised by Government or the anti-fraud authority that more openness would help, you would go along with that?

Stephen Jones

If the Government or the regulators instructed the banks to publish individual data on fraud, we would argue that that is not a very good anti-fraud prevention measure, but if the Government insist on that, we would have to publish it.

Martyn Day

Mr Jones, on your comment about sharing of risk, when we see figures to suggest that, with the unauthorised push payments, perhaps as many as 7% of people do not get their money back, clearly at the moment the risk is with the consumer, the customer. May I give you an example from my own constituency casework of the complex nature of some of the frauds we are getting? I have a few examples. I should say that these were not elderly or vulnerable individuals who would have considered themselves at risk; they would never have thought that they were in the voluntary at-risk category. One young woman, who was an immigration case, received a call on her mobile phone that appeared to come from 999. She answered it and they pretended to be the police, knowing that she had an immigration case—she needed to send a payment because they had 72 hours to go through the Indian embassy and everything. They managed to trick her into logging on to her computer and using TeamViewer, and they transferred what she had in her bank account to themselves. In her case, she got the money back, but she got the money back because she had insurance. Surely that is another example of the risk being transferred to the consumer and you not being protective yourselves. How could you help people in that situation?

Stephen Jones

I hope I did not use the term “risk transfer”, because that is not the way we think about it. Every case of fraud is a personal tragedy and a case that we need—

Chair

Sharing risk, I think you said.

Stephen Jones

I also want to clarify: in the vast majority of cases of unauthorised fraud, money is returned to the customer. In cases of authorised push payment fraud, as the jargon goes, where someone deliberately inputs the instructions and says, “Please make the payment to this person”, for whatever reason—in the case of your constituent, unfortunately, she was led to believe by a 999 call that that payment was appropriate—not all proceeds are returned to the customer, because the bank has simply been acting on the customer’s instructions.

Martyn Day

In that particular case, the individual was referring to the TeamViewer person doing it, rather than doing it themselves. However, another example, which is more on the push payment approach, is Mrs Galloway, in my constituency—again, this was exactly the same kind of person, perfectly switched on; you would not identify her in any way as being vulnerable. She had a virus on her computer. She noticed that emails appeared to be coming in already opened. She contacted her net provider. They ran checks on her line and came to the conclusion that they could not see anything. Then she got a fraudulent call pretending to be from the internet adviser and getting her to run a piece of software, which obviously gave them more information. While she was on her computer, they transferred money between her own bank accounts, from her savings to her main account, and then she got the call to say there had been an erroneous payment into her account. She checked, and there was the best part of £4,000, which should not have been there. The people asked her to send it back to them. Of course, she then effectively authorised a push payment, lost all that money and did not get a penny back. That is a real problem in the real world. From the consumer’s point of view, their bank account has been tampered with, without them having made the transaction. Obviously, that was not the push payment transaction, but there was a still a transfer that they did not make, which then led them to believe there was a genuine problem. How do we help people in that position?

Stephen Jones

The first thing is education. Within UK Finance, we operate Financial Fraud Action UK. The Take Five campaign, which we run jointly with the Home Office and is funded largely by the industry, is entering its second phase.

Chair

Take Five was relaunched, interestingly, on 2 October.

Stephen Jones

It was, yes.

Chair

That was interesting timing.

Stephen Jones

Well, it was the timing that was agreed with the Home Office.

Chair

Okay. We did a little litmus test around the Committee Room. Perhaps we are not an average bunch of people—I don’t know. Probably not—we are a bunch of politicians, after all—but none of us knew what Take Five was. Could you tell us, Mr Jones—you’ve probably got it written down there—what the slogan is for Take Five?

Stephen Jones

Yes. “My money? My info? I don’t think so.”

Chair

Okay. I wonder whether anyone in the—well, I can’t really do an audience litmus test, because it is not that kind of meeting.

Stephen Jones

That is slightly unfair, because you are highlighting a campaign that has been in action for two weeks. Even if you went to Procter & Gamble in two weeks, they wouldn’t have managed to—

Chair

But Take Five has been relaunched. It was around before. It is only a £3 million programme, isn’t it? How much of that was from the private sector?

Stephen Jones

Three point eight million pounds is being spent in the second phase of the programme. Most of that is from the sector. That does not take into account what individual banks are spending in order to promote the Take Five brand as a campaign within the institutions.

Chair

Right, Take Five the brand. So that £3.8 million was—

Stephen Jones

That is the central spend.

Chair

That is the central spend, and then—

Stephen Jones

Then each of the members is using Take Five as the collateral to support their anti-fraud education campaigns up and down the network. I think you will see significant activity over the next three to four months.

Chair

But how long has the Take Five brand been around? It has not been just two weeks, has it?

Stephen Jones

No, the initial campaign—Brian—was started 18 months ago.

Brian Dilley

Yes, 18 months ago.

Chair

It is interesting that none of us had heard of it. Okay, we are perhaps not a bunch of random people. I do not know whether we are a good litmus test, so it is perhaps not fair to highlight that. We have left Mr Martin for a little bit. Mr Martin, what is the scale of fraud in your sector?

James Martin

Thank you. One of the products the BRC produces annually is a retail crime survey.

Chair

Sorry, could you speak up? For a room built for speaking, it has terrible acoustics.

James Martin

Of course—I will try not to shout. Annually, we produce a retail crime survey, which looks at the experiences of crime among our members. This year, we surveyed something like 30% of the industry by turnover and employees. In terms of online fraud, the figure reported to us was around £100 million direct cost to retailers, which is quite significant.

Chair

Cost to retailers?

James Martin

To retailers. That is the cost they bear.

Chair

Do you measure the cost to customers?

James Martin

We don’t necessarily have that in our figures, no. It may not be reported in the same way, and it may be, of course, that the retailer does not actually know that. They are transferring the information in terms of the report, but they do not see the end result in terms of who is refunded by a bank, so it is not something they necessarily have. But that is the kind of scale that they see. What that does not take account of is the spending in terms of prevention and protection. Retailers take a very active role in this and deploy some fairly—[Interruption.] Sorry, it has started whistling again.

Chair

I don’t know whether that is an endorsement of what you are saying by the ghosts of the House of Commons or not.

James Martin

Retailers deploy some fairly sophisticated technologies to try to combat and root out fraud, and to stop fraudsters in advance.

Chair

What about information sharing? If I were to buy a knife, it would very quickly be recorded that I am a middle-aged woman with a track record that shows I am over 18. If my teenage daughter were to try to buy a knife, it would show quickly, through background checks, that she couldn’t do that. Do you have similar background checks and data sharing with various bodies, including Government sources, as extra insurance against fraud?

James Martin

Yes, of course. Without going into too much detail because of the risk of alerting people, there are all sorts of databases and systems that look at patterns of unusual transactions or transactions that use questionable information and will flag that so that they can potentially be stopped and investigated. I spoke to a room of our members, who include some of the biggest retailers, this week and pressed them pretty hard. They were comfortable that they stop something in the region of 90% of the attempts they see. That is purely online.

Chair

There is an alphabet soup of organisations involved in combating fraud. Do you feel the sharing goes wide enough? Are there any bits of Government or business that are not sharing useful information about known fraudsters or patterns of behaviour that you could easily do some checks on?

James Martin

The retailers are in a good position, and that is improving. We have a very good relationship with the Home Office. We sit on the Joint Fraud Taskforce, and we are being involved in developing some of those systems. There are some issues in terms of how reports can be made through the Action Fraud system and whether sufficient information comes back from that to retailers. That has been a reasonably difficult issue over a period of time.

Chair

Let me turn to Age UK. Do you think that there is enough information sharing? Do any of your members have any issues? For example, if they have been the victim of a scam, do you think enough is being done to prevent them being a victim in future?

Jane Vass

No. We think there is huge scope to do much more in this area. We have a number of projects going. For example, we have a project that is about to start next year, where we will receive referrals, working with Action Fraud, so that we can support individuals who have been victims in the past, to stop them becoming repeat victims.

Chair

How will that happen? Will Action Fraud alert you to individual named cases and you will refer that through your network?

Jane Vass

Yes, and then we will put them in touch with face-to-face befrienders, so that if the underlying problem is loneliness—if they are being groomed or whatever—you can go in and give that practical and emotional support. A number of local Age UKs also have programmes with scams hubs locally. That works well where victim, trading standards and police work together. Then they can, again, support people who have been repeat victims of fraud. Obviously, that is all after the event.

Chair

Absolutely. We should just highlight that the highest likelihood of being a victim is you are under 65, a professional with a degree.

Jane Vass

Yes.

Chair

You are here from Age UK but you are actually not representing the most likely victim these days, although people might be surprised to hear that. You have a national organisation. You talk about trading standards and that varies across local authorities. Police would really only get experience, as the Report highlights, in Sussex police and the City of London police, who are doing good work on this. What is your view? Is it as patchy as the Report suggests?

Jane Vass

It is extremely patchy. It depends geographically. In addition, we have talked to a number of individual banks and there has been action from individual banks but we would really like to see much more Government prioritisation of online fraud that would mean, for example, that where fraud is particularly targeted at vulnerable groups, it would take into account the impact on the victim, not just the amount of money. Because we have known cases where people have stopped using their computer, unplugged their phone and, in the worst case, may end up in a care home earlier than they need to.

Chair

Thank you. Ms Keegan.

Gillian Keegan

Having spent much of the 1990s in the far east sorting the chips for chip and PIN, I worked for both a bank and payment system. This is always an issue, to try to keep one step ahead of the fraudsters, and technology is a massive part of combating that. If I look at some of the ways that you use technology today, it is kind of low-tech, a lot of the stuff that you are doing, such as CVC numbers and that kind of stuff. What are you doing now to get ahead? This can only grow; you have got all of the ingredients for this to be massive. What are you doing in terms of technology and investment in technology to protect your customers?

Brian Dilley

Any awful lot of what we are doing is not visible to the consumer because it is the things we are doing using artificial intelligence, machine learning and so on, to try to look for patterns in the data and try to identify the suspicious transactions. Banks are spending tens of millions of pounds a year on these systems to try to do exactly that.

Gillian Keegan

They are not very successful then, are they?

Brian Dilley

We are succeeding, actually, because the total level of fraud has gone down 8% while transactions have been increasing. I would say we are succeeding. Is there more that we can do? Yes.

Chair

But it’s the largest growing area of crime, isn’t it? Like it or not, you and your competitors—the people that Mr Jones represents—are at the forefront of the largest growing area. You are effectively on the ground the buffer between the customer—

Gillian Keegan

And have enabled it in a way.

Brian Dilley

If there are transactions there are going to be fraudsters. If there is money there will be fraudsters. Absolutely, we are at the forefront of that.

Chair

Do you have an ambition about where you want to be? In your own bank, you won’t tell us how much fraud is going on—you could share it now, if you want. If you won’t tell us that, will you at least tell us what your ambition is and about how you are trying to reduce the level of fraud in your bank and by what percentage? Do you have a target every year or two years? I know it is a moving target but you must have some target that you are setting internally.

Brian Dilley

Yes. We measure ourselves on three factors. We measure ourselves on our market share of losses and the absolute value of those losses; the customer experience; and the efficiency of our operations. Those are our losses—what we pay out—but customer experience is very important to Lloyds as well, because, essentially, we could put lots of stops on lots on lots of transactions and intervene a lot more, but that will interrupt the flow of transactions and the flow of banking. Legislation and consumers want faster banking, faster payments and faster transactions. We are investing in tools that enable us to identify the riskier transactions, and we are looking for other authentication behind the scenes, which enables us to look at connections with trusted devices to blacklist devices that have been used for fraud and so on. All of those things are contributing to reductions in crime. You would not see all of those things as a consumer; chip and PIN is very visible to a consumer, whereas a lot of these things are behind the scenes.

Chair

Mr Martin, are retailers doing anything, technologically?

James Martin

I think it is a very similar pattern, in terms of how they operate. One thing to bring out is that they are not always passive or defensive; plenty of retailers operating with the authorities and, I am sure, other financial institutions, will seek to take down websites that are being used to effect and facilitate fraud. It is not just that they are trying to stop things as they enter their system. Once they spot these things, they will step out and try to find ways to stop that from happening in future. I think that is quite a positive role that they adopt.

Chair

Okay. We will have some quick-fire questions, because we only have about another five minutes. I will go to Mr Mills and Ms Keegan, and then I have two questions.

Nigel Mills

How would the panel rate the performance of City of London police, which has lead responsibility for this, and Action Fraud? Do you think they do a good job, or do you think they could be a bit more useful and helpful in tackling this crime?

Stephen Jones

In UK Finance, we operate the dedicated card and payment crime unit. That is a joint venture between City of London police and the Metropolitan Police that the industry pays for. We have found that to be extremely effective in on-the-ground crime prevention, detection and prosecution. Obviously, the best practice that is developed within that unit is then promulgated up and down the 42 other police forces in the United Kingdom. City of London police are at the forefront of enabling that to happen. People have previously highlighted a patchy approach nationally, but having this central centre of excellence, with two police forces working together, is an extremely effective way of developing the best fraud detection techniques, which is what the unit is set up to achieve.

Nigel Mills

Ms Vass?

Jane Vass

The issue is not necessarily with City of London police, it is with pushing out that good practice around the country, so that we get action across the ground, rather than just depending on what happens to a report, which, at the moment, consumers and complainants don’t actually know. At the moment, people are reluctant to report fraud because they don’t think anything is going to happen, so you get a vicious cycle. We would like to see more consistent action, which is what older people tell us: they want people there with teeth who can act on their behalf.

Chair

Mr Martin?

James Martin

The key touchpoint with City of London for my members is Action Fraud. I suppose I would start by saying that there are a lot of really good-quality people doing some incredible work there that is very useful. However, there are also some pretty serious systematic failings, in terms of block reporting systems and the information flow that comes back, which I think have been catalogued over some time. I know that City of London police are taking significant steps to try to remedy those, but I think they are slightly delayed in an IT project. We wait with bated breath to see how that improves, because that is an area in which we would like to see improvement. Again, that is not to say that there are not some absolutely excellent people doing some superb work. Just to associate myself with the slight patchiness around the country once it has gone through Action Fraud, there are some examples of really good practice, such as Operation Falcon in the Met and so on, which do some really good things involving dedicated officers who are trained and deal with it properly. I know resources are very tight, but I suspect that those kinds of models could be spread a little bit more. One of the ways to do that may be to publish slightly more specific statistics and look at the standards and service levels and so on that are applied across the piece.

Chair

Mr Martin, you should be a member of this Committee; we love talking about transparency, statistics and data.

Gillian Keegan

It seems clear that, when the police start to roll out, the actual numbers are going to quadruple. That will mean that, once we have the numbers of how many people are actually suffering from this crime, your comments before about controlling it will be completely irrelevant. With that in mind, to give confidence and faith to consumers, you will have to be much more transparent with the actions and activities that you take, because this will balloon almost overnight.

Brian Dilley

To be clear, the numbers I was talking about were the ones that are within our control on transaction fraud. We know what those numbers are.

Gillian Keegan

As the payment technology providers, a lot of this is within your control.

Chair

Mr Martin, on that point of transparency, how much do retailers report on fraud in their area?

James Martin

In terms of individual retailers, I am not sure. We report an aggregate number, but the reason we are able to get a lot of the data, which is sometimes more business-sensitive, is that it is under some pretty strict confidentiality arrangements. There is also an issue in that retailers only see a small part of it, so it would be slightly misleading for them to publish bits of data over and above what they themselves pay out. It may be that the better way of looking at it is data from slightly further up the system; whether that is aggregated or not, I am not quite sure.

Chair

Everyone is reluctant to reveal their own data, it seems.

Shabana Mahmood

In terms of banks paying out where an authorised payment has been made—a much smaller proportion of those individuals get their money back—what are the criteria by which you judge whether someone will get their money back or not? Do you treat different types of scams differently?

Brian Dilley

For authorised ones?

Shabana Mahmood

Yes.

Brian Dilley

Each bank will have their own appetite for that. I can tell you broadly what we do. We look at whether the individual has taken reasonable steps. In the example we heard earlier, we would look at whether that individual had taken reasonable steps to verify who they were talking to, whether they had been reckless with their information and so on. We take into account vulnerability, so someone is far more likely to obtain a refund if a vulnerability has contributed to them being scammed. We look at a whole range of different criteria in terms of individual circumstances, to say, “Has the person acted reasonably?” and then, “Have we given them a warning?” As I said earlier, we often give people a warning but they insist on proceeding. All those things will be taken into account.

Martyn Day

My question is for Mr Jones and Mr Dilley. There is obviously a lot more that everybody could be doing in this whole process. Currently we estimate that the banks are sitting on around £130 million of unreturned funds that they cannot source. What do you think should happen with that money?

Stephen Jones

One hundred and thirty million pounds is an estimate of frozen funds that are believed to be connected to fraud or fraudsters where banks have identified through their controls a concern and started to investigate further, which causes the NCA or the police to freeze the money within the accounts. It is not for the banks to say what happens to that money, because it has been frozen by the judicial system, but clearly the Joint Fraud Taskforce provides a useful public-private sector area where we can discuss it. Part of it could be used to create a pool for reimbursement. Part of it could be used to provide more resources to fight economic crimes in ways that the public sector deems most appropriate in the circumstances. I actually think that £130 million is probably a conservative estimate of what is stuck in the system, but it is not because the banks want to hold on to that money—I want to make that absolutely clear. It is because the banks are not allowed to do anything with the money under the way the law is currently set up.

Brian Dilley

The £130 million is not necessarily fraud-related. It is related to suspicious activity that has been reported by the banks. That could be all sorts of different crimes, not just fraud, and sometimes it is not connected to an individual crime; it is just unusual transactions that have been reported. It is pooled money and then—

Chair

It underlines the need for transparency. If that could be broken down, it would be very helpful.

Layla Moran

We are about to talk to the Home Office reps. If there were one thing you could improve about working with the Joint Fraud Taskforce, what would it be? That question is to everybody.

Brian Dilley

We should recognise that the Joint Fraud Taskforce is a relatively young organisation. I would not disagree with the recommendation in the National Audit Office Report that now is the time to get some more formality to it, with some specific targets and measurements. I think it has achieved a number of good things, and it is time to move into a different phase.

Stephen Jones

A long-term goal is to take what has been a successful tactical association and affiliation to a permanent strategic public-private partnership. Public-private partnerships in this space are a really good idea. All stakeholders—retail, banking, representatives of the consumer and the vulnerable, the police, the National Crime Agency and the Home Office—working together on this problem is really important. Having long-term strategic goals would be useful.

James Martin

I think very similarly. It has clearly been a useful body and has come to a good point in its development. We now sit on it and have done for a few months, so I think they are probably thinking in the right way. We find that input very useful. I hope the Home Office does, but I’m sure that is not always the case. There is some really good co-working around things such as the implementation of the second payment services directive, which should give a really pragmatic approach in future.

Jane Vass

Public commitments to action, to which the committers can be held accountable.

Chair

That is what our job is, so thank you very much. I’m going to ask Mr Clifton-Brown to ask a last couple of questions.

Geoffrey Clifton-Brown

I have two very quick points. Mr Dilley, you have told us that all of your banks share the information. So is your bank, in proportion to its size, doing more or less than your competitors, and do you think your competitors could do more?

Brian Dilley

There is a range across different banks in terms of what the individual is doing. I tend to think that we punch above our weight. We do more than some others, but there are equally others around the table who are contributing a lot.

Geoffrey Clifton-Brown

So we shouldn’t just be praising the best; we should be getting at the worst. Finally, we all know from our own constituencies, particularly those of us who represent rural ones, that you have embarked on a round of rural bank closures. Because we all know that you have saved a lot of transactional costs through the move to online transactions, which has been considerable. Do you not think you could use more technology on the online transactions to try to tackle this problem more? For example, are all of the major banks now using changing numbers on their cards?

Brian Dilley

As I said earlier, we do an awful lot in terms of the transactional details. All the banks are not using changing numbers; in fact, very few are using changing numbers. If we did move towards that, it would need to be an industry initiative that everybody did at the same time. The reason I say that is because there is anecdotal evidence that, it you have a changing PIN on a card, then consumers will often use the card with the PIN that they can remember—the CVV that they can remember—rather than going to get the card with the changing number. There are some aspects of consumer behaviour that move towards that sort of thing. We have the same thing on 3D-secure, where you ask the additional questions. There are a number of dropped transactions when you come up with 3D-secure. Consumers often go, “I’ll use another card that does not ask me those questions.” So consumers often do move towards the less secure ones that are more frictionless.

Chair

You raise an interesting point about designing it out. If only we had more time. It has been a very interesting panel. Thank you very much for your time. The transcript of the whole hearing will be on the website uncorrected in the next couple of days. You will also be sent a copy. I urge you to send a correction if necessary. We had a report published today where a witness wrote notice yesterday that they did not agree with it, as it was about to be published, which was a bit late in the day. Do have a look at the transcript. Feel free to stay for the next session, if you wish. Could we change the witnesses and bring on the second panel, please? Examination of Witnesses

Witnesses

Richard Riley, Philip Rutnam and Ian Dyson gave evidence.

Chair

Welcome back to the Public Accounts Committee on Wednesday 28 October 2017. Our hashtag today is #onlinefraud for anyone following on Twitter. This panel is people responsible for making sure that the country is trying to tackle this growing area of crime strategically. From my left to right, I am pleased to welcome Richard Riley, the director of serious and organised crime at the Home Office—welcome to you, Mr Riley. I am not sure if this is your first time in front of the Committee.

Richard Riley

It is my first time.

Chair

Welcome. We are a very friendly bunch, as you will discover. We have Mr Philip Rutnam, Permanent Secretary at the Home Office, who is a regular visitor; he is back again in a few weeks’ time. Welcome to you. We also have Ian Dyson, commissioner of the City of London Police. We do not need to highlight too much the growing issue of online fraud—the report highlights it very clearly. It is now the most common crime in England and Wales; there were about 2 million incidents in 2016 alone. So it is big, but about 80% is not reported to the police. There is a really big issue here. I’d like to start off with the Permanent Secretary. We heard quite a bit in that last session about the Joint Fraud Taskforce. It is a bit of a mystery to us—it’s a bit of a “here today, gone tomorrow” event. Yesterday, we didn’t have anything on it. At midday, suddenly up popped lots of minutes of meetings and so on. It was an unpopulated website until midday yesterday, and yet the organisation has been set up since February 2016. Do you take it very seriously?

Philip Rutnam

We take it very seriously. It is a very important innovation and a very important step forward.

Chair

Don’t you think it is important that the public knows what is going on, if it is such an important innovation?

Philip Rutnam

I think it is very important that the public know what is going on.

Chair

So why wasn’t the website working?

Philip Rutnam

I think with hindsight that information could in truth have been published rather earlier. Going forward, I would be very keen to see prompt publication of things like minutes of our oversight board and prompt publication to anybody who is interested of the very useful newsletters that come round. There is quite a lot we can do.

Chair

So it was not important enough for you to put information out there for the public to see. What happened? Was it an administrative glitch?

Philip Rutnam

I don’t—

Chair

It is just that you are responsible for the security of the nation, in a sense—if I wanted to give you a grand title—and yet you can’t make a website work.

Philip Rutnam

I think that is definitely over-estimating my importance. However, with hindsight, yes, there is more that we could have done to share that information earlier. In truth, we didn’t give quite enough attention to the importance of sharing some of that information. Not everything goes perfectly. I think that the fact that we have got this Committee hearing today has helped in truth to focus minds—

Chair

To get the website working yesterday.

Philip Rutnam

What I would say, most importantly, is that going forward, we will make sure that we are sharing information such as the minutes of oversight board meetings promptly. I would say that there has been an awful lot of work going on in the Joint Fraud Taskforce, and an awful lot has been shared around that, but not through the website.

Chair

I think that people who aren’t in those meetings but who are nevertheless interested, and organisations and individuals that have an interest, should be able to look that up. It was interesting that a few hours after midday, some of the documents that had been uploaded were removed. Sadly, we didn’t think to download them all because we didn’t think they would be up there one minute and gone the next. I don’t know if you know anything about why they would have been removed.

Philip Rutnam

You are ahead of me, Madam Chair. I have to say that I was not aware of that.

Chair

It just sounds a bit shambolic. This is a really serious issue and yet that simple thing of having that one website up and running—that one little bit of it—has not happened.

Philip Rutnam

I agree it is very serious.

Chair

Will you look into it?

Philip Rutnam

Of course I will look into that, and most importantly I would give the undertaking that going forward we will share the information that we can about the Joint Fraud Taskforce much more promptly.

Chair

There is a bit of a theme here—other colleagues will be picking it up—about how easy it is for people to get information online. One of the things to ask is who is ultimately responsible for making sure that consumers know what is going on. I have here a list of every organisation involved in online fraud. I haven’t added it up, but it is probably 40 or 50 organisations. Of all of those, you are sort of at the hub. Are you responsible for making sure that online fraud is tackled? Do you want to take on that mantle or is it someone else?

Philip Rutnam

I think in fact the true list of organisations that are involved in some way, or have some interest in online fraud, would be much longer than that piece of paper—

Chair

We are being generous to you.

Philip Rutnam

It would be an enormous list. That is because every retailer and every financial institution in the country has an interest in this and many, many other organisations—

Chair

They have an interest, but some people have a responsibility.

Philip Rutnam

Our Ministers and I see our role as providing strategic national leadership for the country in responding to this challenge. That does not mean that we do everything—far from it. It means that we have a critical role in making sure that there is a strategy that is prioritised and turned over time, in a suitably programmatic way, into action and results. We have a core role in relation to strategic leadership. As you say, we are at the heart—the hub, if you like—of the fight against this type of crime across the country.

Chair

You say that, but you have the misfortune of speaking in a room with two former Home Office Ministers, one of whom remembers the National Hi-Tech Crime Unit—that is Caroline Flint, who was there. Well, I don’t know whether you were actually there at that time, Ms Flint. Do you want to pick up that point? Why don’t you ask this question?

Caroline Flint

The National Hi-Tech Crime Unit was established in 2001, and it was merged into the Serious Organised Crime Agency in 2006—we have the National Crime Agency now—so this is not a new issue. I remember, having been the Minister for tackling organised crime, that part of the National Hi-Tech Crime Unit’s job was to tackle issues relating to online fraud, computers, telecommunications, carding and all those other things. It has obviously morphed along the way, but the National Audit Office Report seems to indicate the same problems: a lack of joined-up thinking, a lack of good communications and a lack of sharing of best practice. The question is, 16 years on from the establishment of that unit, why are we still having to discuss these basic issues about good delivery of a service?

Philip Rutnam

I can’t, in truth, speak to the past—certainly not with the same authority.

Caroline Flint

I always think that collective memory is a good idea.

Chair

I was the Minister responsible for identity cards, and part of my role was to look at online fraud. I had some good meetings with the City of London Police and others, and online fraud was launching about that time—2006, just before I became a Minister. There was lot of work and enthusiasm at the time, and it doesn’t seem to have led anywhere, from what we have seen in the Report.

Philip Rutnam

I really don’t think that is a fair characterisation of where we are now. As I say, I cannot speak to the organisational arrangements that have existed on this topic over the last decade or two.

Chair

But it is a growing area, and if we had been ahead of the curve—

Philip Rutnam

You are absolutely right that it is a growing area. That is one reason, together with the emotional harm it imposes on victims, the financial harm and the damage it does to confidence in our economic system, why we are taking it very seriously. It is unfair to say that we are not getting things moving in the right direction. That doesn’t mean we have achieved everything—far from it. There is an enormous amount to be done. The NAO Report itself recognises that, in the Joint Fraud Taskforce and the strength of partnership that now exists between the Government, the private sector and law enforcement, we have made a good start.

Layla Moran

Mr Dyson, why is there such a large difference between the number of people affected by these calls and the number of reports to the police force? What is going on there?

Ian Dyson

I would say that there are three main reasons that fraud is under-reported. First, in many fraud cases, there is a sense of shame and a sense of, “I’ve been foolish.” There is some research that says that the word “scam” makes people feel that they have been duped, and it is something they are embarrassed about. Secondly, there is the challenge, which we touched on with the previous panel, that people report the loss to the bank, and if the bank recompenses them for the loss, they often do not report it to the police. Thirdly, there are some challenges relating to the efficiency of the reporting process. We have plans in place to address that. Those are the three main areas we are looking at, and we have plans to look at all of them. Fraud is a modern crime type. It is global; it is big data. It is one of the few areas for which the significant amount of data is in the private sector, not in law enforcement. That is why the work that the Joint Fraud Taskforce is doing to encourage data sharing and intelligence sharing is so important. We have to move above thinking that we can enforce our way out of this problem. Enforcement is an important element—it is part of my role—but prevention and protection of the vulnerable are really important, too.

Layla Moran

Might I add that a further possible reason that people are not reporting to you is that they get the brush-off? I have got an example of a gentleman who had been scammed for the second time—this is the Microsoft scam, where they call you and say there is a problem with your computer. He had been caught out once. He knew that these guys were probably fraudsters. He called 1471 and in fact got the number. He then went to his local police station and tried to report the crime. They said that they absolutely could not take the report. He had to be turned away. They said, “Go and talk to Action Fraud.” He then tried to talk to Action Fraud, which was apparently not open on weekends. I myself tried over a weekend—it is true that they do not advertise it, although in the online chat I was then told that they are open on weekends. The thing is a mess. Why would he go and report to his police station if they are going to turn him away? Is that common practice? Is that what should be happening?

Ian Dyson

In any call centre function, there will be a percentage of people who cannot get through—I will be absolutely candid about that. But let us look at this: Action Fraud operates 24/7. We moved to that in October of last year. It is, to our knowledge, the first and probably most comprehensive fraud and cyber-reporting capability anywhere in the world. Given that this is a crime type that is global in size and scale, that is really important, because the risk is that you would just get a very localised response that does not see the opportunities for the linkages of individual reports. The response from that local force was not the correct response. As a result of some of the work we are doing—we are going around doing peer-to-peer reviews of forces, and we have done 26 to date—which is to help them understand how to improve their response, we want them first to identify vulnerability at that first point of report, to see if any immediate action can be taken. They are expected to do that. If not, they should take the report and report it to Action Fraud, sending it to us so that we get the comprehensive picture. The example you described is not one that I would want to continue. With the Home Office, we are investing in a new system, which will be far more agile. It will have, for example, TrackMyCrime and a far more user-friendly and intuitive website. In the three years since we took over Action Fraud, we have shifted from 70% telephone reporting and 30% online to roughly 50% each now. We want to continue that channel shift so that we can provide a better service.

Layla Moran

Back to the scale of it, Mr Rutnam, when will you have better data on the costs of online fraud? We know that you make estimates, which we are working with right now, but what do you need in order to make this less of an estimate and more of a certainty?

Philip Rutnam

That is a really interesting and challenging question. I have only been in this role for six months, and I have been struck by the enormous range in estimates of the cost of fraud to the economy—between £10 billion and £144 billion—and very different methodologies as well as sources underlie those figures. I will pass this to Mr Riley, the senior official in the department directly responsible.

Richard Riley

You will have seen the work of the Joint Fraud Taskforce as five very clear work strands to address the problem. All of that is underpinned by a work strand about understanding the threat. What do we know now? We have a level of certainty about the data and the instances of fraud that come out of police recorded crime. That is a start. Over and above that, we know what the indications of the crime survey for England and Wales tell us—so we have some further data. We have further data from industry surveys and the intelligence picture that Commissioner Dyson and the National Crime Agency are pulling together. All of that is giving us a developing picture of the scale and nature of the threat. There are some big numbers here, but there are individuals—victims—on the end of it. I completely get that as an official, and other colleagues do as well. So however big it is, we think—genuinely—that we have some places to start on what the nature of the problem is now and what would make a strategic impact on it. Thus the work of the Joint Fraud Taskforce targeting those particular points. Apologies for my voice, Chair.

Chair

The ghost has gone for now.

Richard Riley

I have Strepsils.

Layla Moran

Mr Rutnam, we heard from the banks that, for various reasons, they are reluctant to report their own figures about how much they are losing. How can they get away with it, in your opinion? How is it right that banks cannot report on how much fraud is happening?

Philip Rutnam

The question is probably specifically about whether the banks are reluctant to release their own individual information about an individual bank’s performance.

Layla Moran

Indeed.

Philip Rutnam

The position at the moment is that there is not a legal requirement on them to report individually about the scale of fraud. There is very good industry co-operation, as I think you have heard. I think there are also very good signs of industry co-operation with Government. But there is not a requirement on them to disclose the level of fraud, for example, in their annual report and accounts or other piece of financial regulation. At the moment, it is not the Government’s policy that they should have to do that. Our policy, which we are working to and focusing on, is seeking to achieve results in the form of a significant reduction in the level of fraud over time, to deal with all the challenges we are talking about. We are seeking to achieve those results, most effectively by working first through voluntary means, the sort of partnership we have been hearing about.

Layla Moran

But if they are not reporting it, how do we know that is true?

Philip Rutnam

The banks do report frauds. They report very large amounts of information to law enforcement. That is information that we can access to produce—

Layla Moran

May I just clarify? It is not mandatory that they report this information; it is voluntary. Is that correct?

Philip Rutnam

Let’s distinguish. First, it is not mandatory that they report individually, nor to the public in relation to the level of—

Layla Moran

I am talking specifically about a referral of an individual case to Action Fraud. Do they have to do that?

Philip Rutnam

No, that’s not mandatory, either. However, there is a very strong expectation on them that they would do so.

Chair

Why is it a strong expectation? Why not mandatory? Why would they not do it?

Richard Riley

We heard an important point before about lessons from history. I wonder if I could give two from different periods.

Chair

Very quickly. Too much history takes us a long way down the track.

Richard Riley

I think it might be instructive. In 1992, the then Government published a car-theft index. You will remember that at the time there was distinct public and parliamentary concern about the level of car thefts. As a way of delivering changes into the system and getting the industry to take responsibility, which they then did, to target-harden cars, a car-theft index was published. That is one way of approaching the problem. The second one I would give you is the introduction of chip and PIN, which has already been mentioned. Chip and PIN was introduced industry-wide after some trialling in 2006. That was not on the back of an index of the worst card manufacturers or suppliers. It was an industry-Government level of co-operation. That is the approach, as the Permanent Secretary has said, that the Home Secretary has asked us to take: Joint Fraud Taskforce, co-operation, collaboration, with challenge in the system, not compulsion, at this stage.

Layla Moran

But wouldn’t the league table help?

Richard Riley

Brian gave you an indication about one of the unintended consequences of that. One of the others from our perspective is—and I’ll be honest—that the quality of the data that we would have for me to be able to advise Ministers to publish a table that looks like that, with the banks ranked, does not support that. The Government would presumably be open to quite significant legal challenge from the banks. Thus, the point about working hard at the data. Until we can do that, I don’t think we will be in a position.

Layla Moran

So, you are not ruling it out for the future. You just have to improve the data.

Philip Rutnam

It is not the Government’s policy now. That does not mean it is ruled out for ever. What we want to see, though, is results; we want to see outcomes. I would make another point. Mr Dilley mentioned earlier one reason, in relation to fraudster behaviour, for being cautious about publishing bank or institution-specific data. Another key point is that many of the solutions that we think need to be put in place are actually industry-wide solutions. They are things that need co-operation across much or all of the relevant players in the industry, such as the move to deal with card-not-present fraud. That is really only likely to be delivered effectively if we have industry-wide co-operation.

Chair

I think Ms Keegan has quite useful experience and has a particular question on this point.

Gillian Keegan

You use the analogy of chip and PIN, which I was heavily involved in. The difference between then and now is that the fraud that was being experienced at that point and the forecast of growth in fraud was being borne by the banks. It was the banks that were losing out. In this case, one of my concerns, and perhaps why this action and activity are a bit more passive, is that it is about consumers. The risk has spread and it is not sitting with the organisations. They are not even getting reported. Whether it is the banks, the bank accounts, the technology that is servicing that or the payments technology, they are not the ones wearing the risk and the cost in many cases, and that will change the activity levels, and I think that is what we are seeing.

Chair

Do you think that is the case, Mr Riley?

Richard Riley

I think we recognise the point about the spread of risk, so we are working with the Joint Fraud Taskforce. We are concentrating on five areas—Ministers have agreed this—to make a strategic impact on the problem. I will point out two of those areas. One is card not present fraud, as the permanent secretary said. That addresses the big bulk strategically of where the problem is now. That is why we are working with the industry on that. To the point on authorised push payments, that is why we have a whole strand of work on funds repatriation where we will be working with the banks to find technical and legal frameworks by which the banks themselves and law enforcement can work to address exactly the problem. We are addressing the problem that is manifesting itself now and a bit of the problem that Brian spoke about in terms of the future.

Chair

Can I just pick up on the legal framework before I go back to Ms Moran? Are you suggesting that new laws will be necessary to do this?

Richard Riley

In the work that we are doing on the funds repatriation point, we are looking at whether there is sufficient legal cover for the banks to repatriate funds to victims, where they can be identified. There are some questions.

Chair

So will there perhaps need to be new laws passed through this House?

Richard Riley

If there is a need for legislative change, we will be approaching the Home Secretary with an indication of what that might be.

Philip Rutnam

Can I just add that this is where the flow of funds is carried on through the banking system? It is where a bank has made a transfer to another bank. This question of unauthorised payments is where we think a funds repatriation solution could really—

Chair

That is a useful point to clarify before everyone thinks they are going to get their money back from every scam.

Philip Rutnam

Exactly.

Layla Moran

I totally take the point about fraudsters going after the weakest link in the chain—the weakest bank—but equally the purpose of this Committee is to champion the rights of the consumer, and there is a balance to be struck in holding them to account. Does UK Finance share the individual bank details with the joint taskforce? By that, I do not necessarily mean making it public so that fraudsters can get hold of it. Are you, Mr Rutnam, holding them to account for what they say they are going to do? Who is making sure that this is getting done?

Philip Rutnam

I am going to ask Mr Riley to answer.

Richard Riley

The short answer is that the Home Secretary chaired the latest iteration of the oversight board on 11 September, where she vigorously held MasterCard and other representatives of the private sector to account for delivering as quickly as possible a technical solution to card not present fraud.

Chair

Sorry, that is not at all an answer to Ms Moran’s question. Would you like to repeat the question, Ms Moran?

Layla Moran

My question was about the individual bank’s performances as a league table, or however else you wanted it to be presented. At the moment, all the knowledge is being held by the industry. Who is holding the industry to account to ensure that what we have is a race to the top in terms of safety? I appreciate that it might not be something that you want to make public, but do you not think that it is your job—

Chair

Do you see that data?

Richard Riley

I don’t see the data. I don’t see the operational data; law enforcement colleagues will. I am a policy official; I am not an operational leader. It is the job of the Joint Fraud Taskforce and me, as chair of that board—

Chair

So you do not. Commissioner, what do you see?

Ian Dyson

I see some data, yes. What I think I don’t know is what I don’t know. I get data into the National Fraud Intelligence Bureau from the banks through Cifas. It is known fraud that they have shared within Cifas, and then we get—

Chair

So you get the known fraud, but for individual cases, do you get an aggregate number for which banks have got more of a certain type of fraud than other banks in a league table?

Ian Dyson

I do not have that data, no. I also get data through UK Finance.

Chair

Is that data anonymised?

Ian Dyson

It will be trend data. It will have details about suspects and so on.

Chair

So it has data on individuals and trends. Does it say that bank X has a bigger problem with card not present fraud than bank Y, which is doing a good job on it?

Ian Dyson

No. What it would provide me with is intelligence from which I can look at action to be taken for enforcement or prevention or protection.

Chair

So even you as the commissioner for the police force responsible for this issue do not get to see the detailed bank data, even though, to be clear for the record, you would treat that confidentially, would you not?

Ian Dyson

Correct.

Chair

If banks were to share that with you, it would be used for tackling this crime and for no other purpose and it would not be released to anyone.

Ian Dyson

That is correct.

Layla Moran

I think that what this line of questioning perhaps shows is: where does the buck stop? Who is ultimately responsible for all the recommendations that you may or may not accept in the NAO Report? Now that we are in 2016, if we have recently published long-term goals from the joint taskforce, where does that buck stop? Is it with you, Mr Rutnam, or the Home Secretary?

Philip Rutnam

I think I have already tried to answer that question in describing the Home Office’s role, as we see it, as providing strategic leadership for the country in responding to the problem.

Layla Moran

Surely that is just a yes or no question.

Philip Rutnam

I was going to go on to add a little supplementary to that. What we have sought to do—what, in fact, we have done—is to turn that question of how you provide strategic leadership, into a series of actions that could actually make real difference to the problem. On dealing with card not present fraud, we have said that we want to see a very significant reduction in CNP fraud by 2019. That depends on action by the banks, and we will hold the banks to account in a constructive way for delivery on that. Similarly, coming up with a solution on funds repatriation, going back to the earlier point about unauthorised payments, would provide a very significant step forward in dealing with that. We have turned the question of providing strategic leadership into a series of big tasks for which we will hold individual sectors or organisations to account.

Layla Moran

But if they do not deliver, what happens then?

Philip Rutnam

We have already described our focus on results, outcomes, making a difference—

Caroline Flint

I do not understand how you can talk about outcomes making a difference if you have not got a sense of what the problem is. You have a situation, as has already been raised by yourselves and other witnesses, about where people go. If someone finds they are losing money, they are initially going to go to their bank. Before anybody else, they are going to go to who is holding the purse. If the banks are not saying to them, “By the way, you better report this to the police,” or passing that on to the police, you are basically being carved out of a huge amount of data that can help inform you about different types of fraud and how it is working. So tell me, Mr Rutnam, how can you be strategic and how can you deliver when you do not know the extent of the problems and where the weaknesses or the peaks in certain types of fraud are appearing?

Philip Rutnam

I think we do now have a pretty good sense of the scale of the problem. We now have national statistics, which are the first of their kind in the world, showing that there were over 3 million frauds in the last recorded year, of which just under 2 million were online fraud. How will I tell by 2020 whether or not we have made a difference? Is that number the same? Has it gone up? Has it gone down? That is a very high-level measure, of course. We continue to need to improve the evidence base, for all the reasons Mr Riley has identified, but we do now have some kind of baseline against which we can measure progress, and doing the things that we have—

Caroline Flint

What if the way you gather and collect the information at baseline is completely distorted, and you are therefore, I suggest, in a sense of false security about what the final outcome will be? Those net figures do not necessarily reveal the types of fraud or where the weakest points in that chain are, let alone being an accurate baseline figure.

Philip Rutnam

I do actually think the statistics that have been published will provide a good baseline—not a perfect one, but a good one, I hope. Those statistics were published by the ONS. Its approach to developing those statistics in this area began in 2010, it launched a major project on this in 2012 and a significant amount of work has gone into developing these statistics under the guidance of the national statistician. We now have a statistical evidence base, which should tell us in future years whether online fraud is going up, going down or staying constant. That will be a very important metric for us.

Layla Moran

But that is based on the 20% of self-reported crimes, which therefore means it is a biased sample. How can you be sure that you have an entirely unbiased sample unless you have mandatory reporting at key points in the system?

Philip Rutnam

That isn’t actually how that statistic is assembled. That statistic comes from the crime survey for England and Wales, which is based on a very large survey of households—something like 50,000—in order to assess their experience of crime. It is overall the best guide that we have to crime and crime trends. It is not perfect, there are some omissions from it, but it is not the 20% self-reported—

Chair

But, Mr Rutnam—and, in fact, Commissioner Dyson—you spoke earlier about the reporting rate of 250,000 a year, which given the scale is a very tiny proportion. Is it a problem of communication or capacity? You said it is a 24/7 service for online fraud. People can report it in, but they aren’t, are they? As Ms Moran says, without the data, how do we know we are making an improvement? Is it capacity or communication?

Ian Dyson

I think it is a combination of both.

Chair

You highlighted some of the reasons why people are embarrassed, and so on, but do you think there are issues to do with the system, rather than the individual reporting in?

Ian Dyson

As more and more of our business is done online, we are seeing that fraudsters have greater opportunities to commit fraud. We need to invest our time in prevention and the education of the public.

Chair

But people are not reporting it. Why is that? Are you happy with that number?

Ian Dyson

No, I am not happy at all. I think there are some constraints around the current reporting system, which I outlined.

Chair

I think Ms Moran did some mystery shopping, which threw up some problems.

Layla Moran

I did indeed. In fact, it was on behalf of the gentleman who contacted me about the Microsoft scam. I went online and tried to get in contact. There was a number, but it was made very clear that it was only for organisations. The only way I could talk to someone was on an online chat, which I imagine is an alien concept for some people. I then went on to the online chat and asked whether there was a number I could call, and I was told that, yes, I could. In fact, it was the number that was advertised, but they purposefully do not advertise when anyone can call it. I asked specifically, “Do you advertise when people can call?” and the answer was, “No, we do not advertise.” How are we going to encourage people? Earlier, you said that people are shifting to reporting online, rather than reporting on the phone. Don’t you think that is because they are told they can’t call in? That’s why there has been a move—they just don’t report it at all.

Ian Dyson

I will need to confirm that.

Layla Moran

I’ve got the transcript of the chat here.

Chair

We can provide you with all the documents.

Ian Dyson

I would be interested to see that. The headline for me is that Action Fraud is available 24/7, both for telephone reporting and online. You asked whether the shift is because people are fed up of reporting online or are being discouraged from reporting by telephone, but actually if you look at a lot of other industries, people are shifting their business online. We want to create the appropriate environment. Whether you wish to call by telephone or whether you wish to go online, we can provide that service. Yes, there are systemic constraints at the moment. The new system we will have online very soon will enable a much more fluid, user-friendly approach to that. The reality is that all call centres provide services based on the resources they have. That is one constraint. There are those factors, which I described earlier, about why people may choose not to report. I referenced the earlier conversation about the banks. Yes, people who experience fraud from their bank account will go to their bank first. We are talking with the banks about the prospect of them having a facility that they can immediately refer straight into Action Fraud, so they do not just advise people to report. That is a one-stop service.

Layla Moran

Could you give an estimate of the proportion of banking transactions that are reported to Action Fraud? Do you know, roughly?

Ian Dyson

I don’t have those figures to hand. Of the 500,000 reports we get a year, roughly half are received through Action Fraud reporting by individuals, and a similar figure comes from the data we get from UK Finance and Cifas. That enables us to—

Chair

Do you think that is the right proportion? I mean, the banks must be dealing with a lot more people than the individuals who consider hopping online.

Ian Dyson

UK Finance would say that they prevent, with the systems they have built in their banks, about £7 out of £10-worth of fraud—for every £10-worth of fraud, they reckon they prevent £7. Having seen the banks in action, I think they have invested significant sums in prevention methods, and I welcome the opportunity to work more with them. The challenges with data sharing were discussed with the Permanent Secretary earlier. We constantly work to try to improve that. Certainly, for example, we have tried and established methods with the banks requesting data or information on bank accounts that we wish to investigate. I am not sure we quite geared that up for a global and big-data—

Layla Moran

But if you had access to full individual reporting figures and could compare that with those you have got, surely that would give you a pretty accurate view of how much of it is actually getting through to you.

Ian Dyson

Yes, it would.

Chris Evans

I have a few quick questions for Mr Rutnam. You will know of copycat websites masquerading as Government websites: everything from car tax and passports to congestion charges and registering a bereavement. I had a Westminster Hall debate about this in 2014 and the Minister at the time said that the Government was stamping it out. It is still a major problem. There are people online at the moment talking about ordering European health cards, which can speed up the system. What is the Government doing about these? Because these are essential services.

Philip Rutnam

You are right that this is a material—a significant problem. I know of cases myself, as well, personally. I would relate this challenge to the Government’s wider national cyber-security programme which was launched last year—of course there was a cyber-security programme before that—with a very significant increase in the level of resource put into it. It includes the establishment of the landmark National Cyber Security Centre: a centre of expertise bringing together, again, Government, access to private sector, access ultimately to specialist resources deep inside law enforcement. One thing that is being taken forward in the national cyber-security programme is what is known as active cyber-defence, which includes methods of checking whether or not a website is genuine and methods of resisting fake emails which claim to come from a gov.uk website. So there is a whole strand of activity. In fact, the First Secretary of State, who oversees the national cyber-security programme, is making a speech today on this programme. Richard oversees our involvement in the Home Office and may want to add something.

Richard Riley

I want to add to that the work of the National Crime Agency in conjunction with the National Cyber Security Centre, so you get the protection but you also get the investigation. The National Crime Agency is explicitly set up to include cybercrime within their remit to look at the investigation about the perpetrators behind exactly the scams—

Chris Evans

The huge problem I came across when I looked into this subject in depth was that no one knew who to complain to. There is no point in complaining to the website owner because they will not respond. I would advise some people to complain to the Advertising Standards Authority, local trading standards or the Competition and Markets Authority. There were numbers of areas and different people would give different advice. If somebody is a victim of a scam where they have tried to pay the congestion charge and somebody has creamed off £2, who would you say they should go to? What is the official advice?

Philip Rutnam

This is a type of fraud. If they contact their local police force, they will be referred—I expect—to Action Fraud. One of the reasons why we need to improve Action Fraud—to significantly improve the way in which it interacts with the public and business—is to make it easier to report this kind of crime. So Action Fraud is the place to go.

Chris Evans

How many websites are you shutting down every week on this? At one point there were about six of these popping up when I was looking at this.

Philip Rutnam

I am afraid I do not have a figure for that. There is a very—

Chris Evans

But we are still shutting them down once they are discovered?

Philip Rutnam

I believe so. The commissioner may be able to speak on that. There is a very significant volume of what are known as disruptions, which come out of things that are reported to Action Fraud that go into the National Fraud Intelligence Bureau that sits behind Action Fraud. I think they undertake over 100,000 disruptions a year of various kinds.

Ian Dyson

Yes, that is correct. In an average year we will disrupt and close down about 180,000 a year. This figure includes bank accounts, websites and telephone lines that are associated with known fraud. In respect of your particular issue, yes, there are frauds that sit behind some of them. They are not all frauds. If somebody advertises that they will get you a visa to travel to the US through the US embassy, you get a price and they do it for you at a fee, and you receive the visa, that is the challenge. If you don’t get a visa, then there is a fraud involved, but if they do provide that service and you’ve paid—

Chris Evans

That is where the grey area is. If that happens to you, who do you complain to? You might go to the police and they ask whether you have received the visa, and you say, “Yes I have”. Or it might be the European health card, which is free, but there are people charging 20 or 30 quid for it. Where do they go from there? If someone says they have been a victim of fraud, and what they have been a victim of is false advertising, who would you send them to? That is clearly going to be a problem.

Ian Dyson

We have good links with trading standards and we would refer them to talk to trading standards.

Chair

That is interesting. We could have a look at trading standards, although it is a local authority issue. I am sure you would agree that there are big variations even between London boroughs about how much money is invested in trading standards.

Ian Dyson

Yes.

Geoffrey Clifton-Brown

Reading the NAO Report, I get the impression that you and your force is doing a good job, but there would seem to be very few other exemplar forces among the rest of the 42 forces, although Sussex is specifically cited. What is being done by your force as the lead force to disseminate best practice among the 42?

Ian Dyson

Policing is local and locally accountable, so the decisions on what a force will prioritise or consider to take action against is a matter that is locally accountable by the chief constable to the local police and crime commissioner. They are balancing the referrals that I send to them against all their other areas of vulnerability, including public protection, modern slavery and domestic abuse. So we have to work in that sort of landscape, where it is very much a local policing service. Having said that, we have and we are looking to work with forces. While it is true that the number that have fraud as a priority in their local policing plan was very low, 41 of the 43 forces have vulnerability and protecting vulnerable victims as a priority. That can include all sorts of different crime types; the victims are still very similar. We send out twice a year an infographic to each chief constable and each police and crime commissioner, which sets out very clearly what fraud has taken place and been reported to us that occurred in their force area, the breakdown of victims, the number of disseminations and intelligence and reports that we have sent to them in that year, and then their return rate in terms of outcomes. So it is very publicly available, and they can see what the performance of the local force is. We have also done peer reviews to assure ourselves and to look at how forces are dealing with fraud in their local area and giving advice based on our expertise. We have done 27 since June of last year and that is an ongoing programme. You may be aware that HMIC will be inspecting on fraud later this year or early next year. That is to get them to a good standard. I am pleased to say that 35 of the 43 forces have a degree of local fraud capability within them now, which is an improvement on what we saw three or four years ago. The ones that do not have relationships and linkages into the local and regional organised crime units, which have a fraud team. We also send out advice. We sent out 800 separate pieces of advice to forces on prevention and protection, which they can disseminate through their networks and community groups. We have best practice guides. We have worked with the College of Policing on training, so that fraud is a specific element of the national investigators programme. We have a national responsibility for training—we have an Economic Crime Academy. I have trained officers from 25 forces since March of this year. There are a whole range of things that I am doing, given that I cannot mandate to any other chief constable.

Geoffrey Clifton-Brown

Can I ask you about prosecutions? Can you give us any figures on prosecutions? Given the rise and the scale of this crime, we would expect a rise in prosecutions too.

Ian Dyson

The CPS reports that it has a 30% increase in the number of prosecutions for fraud and bribery over the last 18 months, I believe, but that is CPS data. In terms of our data, the number of prosecutions has actually dropped slightly. I have looked at the reasons behind that, bearing in mind that some cases can go on for years and that there is never a direct cause and effect of whether a court proceeding in one year will lead to a judicial outcome in another. But what I can say is that of the 240,000 crime reports, we disseminated to police forces for further action about half of them—about 127,000. That does not necessarily require an investigation per se. I go back to the fact that we are really emphasising the protection and prevention aspects in relation to this crime type, so it might be for additional support for vulnerable victims and so on. Of those 127,000, 70,000 were cases that we assessed as having a viable investigative lead that the forces could investigate. That goes into their local assessments and their local prioritisation task and co-ordination. There are outcomes both judicial and non-judicial from cases now. What we have seen over the last three years, on average, is that we have an outcome being recorded against 45% of those disseminations that we send out, and 13% of the crime reports that we send out. In terms of judicial detections, which I guess are at the heart of your question, 14% of the cases we send out for action have resulted in a judicial outcome to date. Compared with the total volume of crime, that is of course very low, but I would argue that what we are doing here, with a national lead force, is probably what we are not doing with a lot of other crime types, which is trying to focus our capability, our investigative resource, on those cases that have the best chance of getting a judicial outcome. The others—those 118,000—we use as intelligence to help to prevent and protect.