alexskopje - stock.adobe.com
Know Fraud database became backlog dump
Reports to Action Fraud handled by City of London Police’s National Fraud Intelligence Bureau were quarantined as security risk, finds HM’s Inspectorate of Constabulary and Fire and Rescue Services
Reports made to Action Fraud and handed to the City of London Police’s National Fraud Intelligence Bureau (NFIB) had been languishing in a database until recently.
The issue came to light in a report from police watchdog Her Majesty’s Inspectorate of Constabulary and Fire and Rescue Services (HMICFRS), published on 24 October.
The incident reports were lodged in a database, called Know Fraud, and then quarantined as a security risk. According to The Guardian, the problem occurred as part of a system update that, said a City spokesperson, resulted in the “removal or disabling of some rules, causing a high number of reports to be rejected”.
The spokesperson cited by The Guardian said it was working with supplier IBM to “review the security protocols” that caused the problem, adding: “Reports which are a security risk will continue to be quarantined but are actively monitored, for example to ensure that reports from vulnerable victims are prioritised and acted on.”
HMICFRS looked at how the police and the National Crime Agency deal with cyber crime and those who perpetrate it, including organised crime groups and states.
The HMICFRS report, Cyber: Keep the light on – an inspection of the police response to cyber-dependent crime, reported: “As of July 2019, up to 6,500 fraud and cyber crime cases were being held in quarantine within the National Fraud Intelligence Bureau’s database, Know Fraud.”
And it recommends: “With immediate effect, City of London Police should provide the Home Office with details of how the force intends to address the issue of reports being held in ‘quarantine’ within the Know Fraud system. Furthermore, the force should also identify its proposals to prevent a reoccurrence.”
Know Fraud system?
The National Fraud Intelligence Bureau processes information received by way of the Action Fraud agency on the Know Fraud system. When the bureau thinks that an investigation is viable, it is given to a police force or other law enforcement agency to investigate. Neither the bureau nor Action Fraud is responsible for investigating offences.
When someone is a victim of “identity theft”, as in an instance of credit card fraud, they are encouraged to report the matter not to the police directly, since it is not considered a crime, but to Action Fraud, run by the City of London Police.
Read more about Action Fraud
- Cyber fraudsters are registering domains that appear to belong to UK universities so they can defraud supply companies, according to Action Fraud, the UK cyber crime reporting centre.
- UK businesses reported losses of £1,079,447,765 in 2016, according to figures released by Get Safe Online and the UK’s national fraud and cyber crime reporting centre Action Fraud.
Action Fraud will then tell the victim that: “An example of a situation in which we could record a crime would be where details were used to obtain credit, the use of which left the provider of credit with a financial loss. In these circumstances we would record a crime for the provider of the credit.”
Action Fraud will then add, in its standard email consequent to a report of card fraud: “Whilst we have not recorded this matter as a crime, we will still make use of the information you have provided. Information reports are utilised to enrich the overall intelligence picture which assists with the formulation and refinement of prevention strategies.”
Fraud victims mocked by staff
In August 2019, an undercover investigation by The Times revealed that fraud victims were often mocked by Action Fraud call centre staff as “morons”, “screwballs” and “psychos”. Now it seems victims reports were quarantined and built up in a backlog.
Inspector Matt Parr, the inspector of constabulary said, in respect of the new report: “The prevalence of digital technology has enhanced our lives and interactions in many positive ways. Unfortunately, however, it has also led to an increase in cyber-dependent crime. It is estimated that this type of crime costs the UK £1.1bn each year.
“The police have had to find ways to combat this new threat. Our inspection found that many of these measures are successful in tackling these offences. We found that the response to cyber-dependent crimes was often of a good standard.
“We do, however, believe that the current 43 force model is not an effective way to tackle cyber-dependent crime. Preventing and investigating these types of crime requires a joined-up, coherent response across regional boundaries. Having 43 individual forces, often with different structures and responding to different demands, does not readily allow for the level of consistency and flexibility needed.
“As such, we have recommended that the government should consider the establishment of a national policing response, with regards to cyber-dependent crime.”
A 2017 National Audit report into online fraud also advocated a more urgent, joined up response. The NAO’s report said police forces take different approaches to tackling online fraud and for some it is simply not a priority. Only 27 out of 41 police and crime commissioners had referred to online fraud in their most recent annual police and crime plans, at that time.
