Action Fraud & the NFIB DS Martina MCGRILLEN
2006 - The Attorney General and Chief Secretary to the Treasury s Fraud Review 2009 - The development of Action Fraud and the NFIB 2014 - The transition of Action Fraud to the CoLP
NFIB in Operation City of London Police is the National Lead Force for Economic Crime in the UK. The NFIB are responsible for the assessment of Action Fraud reports to ensure they are reviewed and allocated to the correct police force or partner agency. The information is stored on our database, and the intelligence will continue to aid future reports and disruptions.
Action Fraud: What is it?
Online - Crime and information reporting functionality and source of information on fraud Contact Centre Dedicated trained Advisors for over the phone crime and information reporting and source of information on fraud Post reporting fulfilment, referral to Victim Support charity Vulnerable Victim Referral Process Signposting Social Media Facebook, Twitter, YouTube
CRIME REPORTS NFRC Reference Password issued Will be manually reviewed if scores above the viability threshold Reports can only be made by the victim, or a person reporting on their behalf INFORMATION REPORTS NFRC Reference No password Will not be reviewed unless linked to a crime report Can take reports from third parties without permission
Fraud Procedure Model Each crime is scored based on information. Common threats are identified and crime networks generated.
Cyber Crime Desk Volume Crime Desk Mass Marketing Desk Banking & Corporate Desk Investment Fraud Team Disruption & Prevention
Action Fraud: Report Journey
Viability is derived from: Name (Business or Personal) Date of Birth Address Bank Account details Phone Numbers Email Website
Know Fraud automated review process The system automatically scores each report based on the amount of information provided and viable lines The information is scored automatically and placed in the appropriate teams queue. Reports will typically be reviewed by a crime reviewer if they score 15+ or more. Vulnerable victims and high losses of over 100k will automatically be reviewed as a matter of course.
The Home Office Counting Rules Rationale for Dissemination The principles for case allocation. It is only when a principle cannot be achieved that the next will apply 1st - The police force covering the location of the operation or suspect address. 2nd - The police force area with the greatest number of usages or offences 3rd - The police force area where the first offence was committed 4th - The police force area where the victim resides. 5th - In the event it is impossible to determine a force area the NFIB will decide.
SUMMARY Dissemination Example Example of a case disseminated to a Police Force for further enquires. Each force has a fraud SPOC who will review all NFIB disseminations for investigation. NFIB Reference Number: NET ******** Police Crime Reference Number: TBC Number of Action Fraud reports: 1 Number of other confirmed fraud reports (CIFAS/UK Payments): 625 Cifas reports Total Reported Loss: 180,000 This is in relation to a CEO mandate fraud. An unknown suspect made contact via email with an international agency, purporting to be their CEO. The suspect asked their finance team to make a large payment into a UK bank account. Victims transferred funds into this account, however they later discovered this request was fraudulent. The email used was similar to the legitimate email address of the CEO, and an extra digit has been added to the email address. The domain for this address has been purchased using false details. Some of the funds are available for recovery, however the majority of funds were withdrawn at ATM machines or transferred into a secondary account. The account has been opened using false ID.
Know Fraud Networks Suspect Bank Account Grey icon shows there are further reports linked to account Victim Action Fraud Report Suspect Address Suspect Telephone Suspect Email
Know Fraud Networks Suspect Bank Account When you spider this grey icon it shows 10 more reports
Example demonstrating how different suspect entities can link together
Dissemination Example The network highlighted over 625 reports which linked to contact details for identity fraud. This demonstrates the importance of reporting intelligence to Action Fraud and sharing information.
NFIB Statistics The NFIB receive over 20,000 reports of fraud and 12,000 information reports per month. Review circa is approximately 7,000 reports. 9% 12% Enforcement 17% 59% Prevention Filed Pending 3% Intelligence Not viable
JFT (Joint Fraud Taskforce) Op Arches (NFIB Collaboration-Investment banking) JMLIT(Joint Money Laundering Intelligence Taskforce) MLTM (Money Laundering through Markets) NOT PROTECTIVELY MARKED
Collaborate and Inform: JFT Five strands: 1. Understanding the Threat 2. The Collective Response 3. Victims and Vulnerabilities 4. Behaviour Change 5. Tackling Systemic Vulnerabilities NOT PROTECTIVELY MARKED
Op Arches Purpose to build a greater common understanding of priority fraud risks affecting non-retail banks Work in partnership in line with 4 P s To inform the work of the JFT To create a 2 way flow of information/intelligence. NOT PROTECTIVELY MARKED
Prevention Method Industry Alert Prevention CEO Problem Profile Media Broadcast Engagement and Intelligence
Organised Crime Ringleader of Organised Crime Gang was jailed for Cyber Fraud Group targeted UK banking customers in one of the largest cyber frauds seen in UK history. Network of mules were used to disperse cash, before laundering the funds in Dubai and Pakistan. The scam was brought to an end after police raids in Glasgow and West Midlands in 2015. The gang were able to take 113m from victims, and 47m has been recovered through Asset Recovery. Action Fraud reports and intelligence assisted in bringing the group to the attention of police.
Overseas Organised Crime Nigerian male known as Mike arrested in Nigeria linked to 45 million pound CEO Fraud Nigerian male behind scam totalling over 45 million pounds and involving hundreds of victims worldwide. Group used malware to carry out fraud, and hired overseas money laundering services. Emails were compromised and messages were sent asking victims to pay funds into a controlled account. The success of this case was due to intelligence and cooperation between INTERPOL and EFCC.
PROTECT - INTERNAL USE ONLY
NOT PROTECTIVELY MARKED
NOT PROTECTIVELY MARKED
NOT PROTECTIVELY MARKED
0300 123 2040 Report and advice over the phone Report 24/7 & Web chat Secure online reporting and advice on avoiding the latest scams Social networking File classification: NOT PROTECTIVELY MARKED - NO DESCRIPTOR
Questions? Martina.McGrillen@cityoflondon. pnn.police.uk 020 7601 6824