Cyber crime is fastest growing economic crime, says PwC report

Rise of cyber crime

Some 44% of UK organisations that experienced economic crime in the past two years were affected by cyber incidents, a jump of 20% from 2014 and 12% greater than the global response of 32%.

The rise of cyber crime, the report said, is in stark contrast with some of the traditional forms of economic crime, including asset misappropriation and procurement fraud, which have declined.

Just over half of UK organisations say they expect to be the victim of cyber crime in the next two years, suggesting it will become the UK’s largest economic crime.

However, only 12% of UK respondents believe that law enforcement authorities have the necessary skills and resources to investigate it, compared with 23% globally. Almost a third of UK organisations say they have no cyber incident response plan.

Falcon tackles online crime

The deputy head of the Metropolitan Police’s Fraud And Linked Crime Online (Falcon) unit Andrew Gould told the European Information Security Summit 2016 in London that police cyber crime fighting capability struggled to keep pace with the rate traditional crime, such as fraud, is moving online.

“That is why Falcon was set up 18 months ago,” he said, with the unit marking its first big successful operation after just six months.

“We made 25 arrests and have recovered £40m of the estimated £90m, which was stolen by organised crime families working together to trick people into revealing their online banking credentials,” he said.

Gould admitted there is still much to be done to improve police capabilities to deal with cyber crime, but described the operation as “a good first effort”.

Since it was established in August 2014, Gould said Falcon has recorded more than 1,000 arrests with a 25% charge and conviction rate, which he said is a “positive outcome”.

On a national basis, rapidly ramping up law enforcement engagement with business on cyber crime is a top priority for the National Crime Agency’s (NCU) cyber crime unit.

The NCA’s National Cyber Crime Unit (NCCU) is allocating more resources. This means training more people to engage with businesses to share information, best practice and expertise in combating cyber crime, the NCCU’s deputy director Sarah Goodall told Computer Weekly.

Most companies ‘unconcerned’ about intellectual theft

The fast take up of cloud-based storage and the growing prevalence of the internet of things (IoT) are some of the reasons for this year’s steep increases in cybercrime in the UK, the report said, leaving anything connected to the office network vulnerable to hackers.

Global corporate intelligence leader at PwC Mark Anderson said cyber attackers are now more ambitions than ever.

“Their aim goes beyond targeting financial information to include a company’s ‘crown jewels’ – customer data and intellectual property information, the loss of which can bring down an entire business,” he said.

“The threat of cybercrime is now a board-level risk issue, but not enough UK companies treat it that way.”

UK respondents say the greatest concern about a cyber attack is the potential disruption to services, with 31% saying it would have a medium to high impact.

Surprisingly, almost half say that cyber crime would have no effect on their reputation, and almost 60% are not concerned about the potential for theft of intellectual property.

Increase in corporate fraud by senior employees

The strong shift towards more senior and experienced employees carrying out corporate fraud in the UK should be of particular concern, the report said, because senior management fraud is often more difficult to detect and prevent, and usually has a much greater effect on an organisation.

While those in middle management remained the most responsible for economic crime (36%), half the instances committed by staff in the UK involved employees over the age of 40, and the number carried out by staff over the age of 50 tripled from 6% to 18%.

The survey found that 45% of internal fraudsters had worked for more than five years in the organisation they defrauded and 21% had more than a decade of service.  In contrast, the number of junior staff carrying out economic crime has fallen since 2014 from 45% to 28%.

Economic crime a ‘question of culture’

While the majority (86%) of UK organisations have formal business ethics and compliance programmes in place, far fewer (63%) back up these rules with regular training and communication.

Financial services companies are set to be the biggest spenders on compliance in the UK in the next two years, while compliance budgets for other industries are under pressure as they face demands to do more with less, according to the survey.

Tracey Groves, the head of ethics and compliance in PwC’s UK forensics practice said economic crime is a question of culture, not just compliance.

“Even the best compliance programmes will fail if a company’s culture accepts wrong-doing as a norm. While it is encouraging that so many UK organisations understand the value of having a code of conduct, it’s crucial to back it up through regular training and engagement with employees. Unfortunately, our survey shows this just isn’t happening enough,” she said.

The survey also found that 20% of UK organisations say they have never performed a fraud risk assessment, while 44% do so annually. Some 5% of respondents say they have been asked to pay a bribe in the past 24 months, while 7% feel they lost a business opportunity to a competitor who was willing to pay it.

More than a fifth of frauds were detected through suspicious transaction monitoring, 14% through fraud risk management, 8% through data analytics, 8% through internal audit and 8% through accidental discovery.