Strategies for Financial Crime Prevention

Authorised Push payment fraud (APP) happens when criminals trick victims into authorising a transfer of funds to an account controlled by the criminal/s. There are two types of push payment frauds:

• Malicious payee - where the victim expects to receive goods or services in return for payment.
• Malicious misdirection – where the victim believes they are paying a known and legitimate payee.[1]

The payment systems regulator responding to the consumer group Which?[2]2016 super-complaint estimated 85-95% of APP scams use malicious misdirection. This takes many forms (including but not limited to)[3]: fake investments,[4] [5] fake romances [6] [7] and Impersonation attacks.

During an impersonation attack, a criminal impersonating an official, often from the bank or police aims to dupe the victim into transferring funds to a ‘safe’ account that the criminal or a ‘mule’[8] has control over. Criminals may call use Caller ID spoofing[9],[10] imitating a trusted number[11] and a pretext like fraud on the victims account, adding urgency. UK Finance advise hanging up if suspicious of an ‘official’ caller and contacting the police on 101 or your bank using the number on the back of your bank card, and that banks and the police will never ask that people move funds to ‘safe’ accounts.[12]

Criminals may support their endeavors with information harvested via social media profiles or via data breeches (such as at Capital one[13]) or malware attacks[14].

Once basic details are acquired criminals use deception and social engineering techniques such as pretexting, quid pro quo,[15] smishing[16] and vishing[17] to enter into dialogue with victims, gain information; building rapport and a victims trust.

A gang that stole millions of pounds by hacking into email accounts via malware, contacting its victims via email and duping them into redirecting payments was recently sentenced. The police advise the public to ‘always verify the bank accounts they are sending money to, by contacting the intended recipient and taking precautions to ensure the money is going to the right place’[18]

They also advise to visit https://www.met.police.uk/advice/advice-and-information/fa/fraud/ and https://www.actionfraud.police.uk for further information on fraud prevention and reporting.

Unathorised frauds occur when criminals obtain sensitive details such as banking credentials and passwords, allowing them to complete a transaction without an account holder’s authorisation.

Social engineering attacks such as baiting,[19] phishing, email hacking and contact spamming[20] may prompt a victim to provide/allow a criminal to access sensitive details via computer infection with malicious software like a key logger[21]. A criminal may then make unauthorized purchases online using the stolen data, known as card not present fraud.

Insiders[22] or cyber attacks on business may cause data breeches. Raiding of bins, intercepting post and robbery are more traditional ways in which details can be compromised.

Stolen data or cloned cards may be sold before use,[23] a victim is often unaware of loses from their account until they check their bank statements.

An Internet search for ‘fullz’ shows various ‘carding’[24] sites supporting both authorized and unathorised frauds.[25] On the surface, deep and dark web[26] transactions take place alongside forums, chat rooms and the sale of items like remote desktop protocol access[27] and phishing kits[28] such as copycat websites.[29]

Criminals can encode card details onto blank cards using software and hardware such as ‘Exeba’[30] and the MSR206,[31] both available online.[32] 

In 2019 a gang of fraudsters containing a bank insider who passed on account details allowing others to make transfers and withdrawals were sentenced to over 9 years in prison. A number of ‘money mules’ were involved by facilitating the movement of funds to their accounts and withdrawing the money.[33]  Banks advise consumers to regularly check statements for irregularities

Criminals may also use techniques such as skimming[34], card entrapment[35] and physical or video shoulder surfing[36] at compromised ATM’s and points of sale.

A recent trend has seen Criminals posing as traffic wardens and directing victims to parking meters to pay for non-existent traffic offenses. Criminals shoulder surf for the pin whilst the meter retains the victim’s cards.[37]

Action Fraud reiterated advice to always shield pins from view, be cautious of officials and verify them with the appropriate authorities. Contact the bank immediately if bank cards are retained by ATM’s15

Regulated financial firms should follow FCA 3.2.6 guidance, taking reasonable care to establish and maintain effective systems and controls for compliance with requirements to counter financial crime risks.

The need to prevent financial loss from these types of fraud has never been greater, a well-managed strategy along with proven tools will aid in the fight against fraud. Banks need to be aware of reports such as the UK Finance report3 and have robust systems and controls to detect fraud-taking place in real time. They also need to continue to educate their staff and customers of existing and emerging trends.

Greater collaboration between banks and law enforcement will make it more difficult for the fraudster. As well as developing card fraud transaction monitoring solutions, banks should harness the power of data analytics machine learning and neural networks (search goggle for particle swarm optimization card fraud) and should consider alternative solutions such as the iDEAL[38] (an online payments system in the Netherlands developed by a number of Dutch banks and now in its 14th year which eliminates the sharing of sensitive data between counterparties.) [39] 

Financial Flows from Human Trafficking

The Financial Action Task Force (FATF) report ‘Financial Flows from Human Trafficking’[40], a joint piece of work with the Asia/Pacific group (APG) on money laundering,[41] was published in August 2018. It ‘responds to a call from the UN Security Council to consider the links between human trafficking (HT) and terrorist financing.’[42] It aims to improve global understanding of financial flows associated with HT and considers the crime both as a money laundering (ML) predicate offence and as a source of terrorist financing (TF).

The project involved a number of organisations such as the United Nations (UNDOC[43] and CTED[44]) MONEYVAL,[45] Egmont group[46] EUROPOL,[47] INTERPOL[48] and international delegations.

Published three years after the start of the UN’s ‘Global action to prevent and address Trafficking in persons and the smuggling of Migrants,[49] and before the Global Compact for Migration[50] the report is aimed at national authorities, financial intelligence units and reporting entities. It updates the 2011 report ‘Money Laundering Risks Arising from Trafficking of Human Beings and Smuggling of Migrants’[51] Focusing on updating the HT element as specified in the United Nations Palermo protocol ‘to prevent and punish trafficking in persons, especially women and children’[52] The 2011 work on migrant smuggling still stands due to fundamental differences between the financial flows of the two crimes.

The report is split into 3 parts: 

• An overview of the scale and Scope of HT:

Considers one of the fastest growing forms of International crime, which has a massive human cost and generates an estimated USD 150.2 billion per year.

• HT case studies and associated money laundering analysis: 

Provides a context and focuses on indicators of HT divided between the three types of HT- Sexual exploitation, forced labour and for removal of organs.7

• Challenges and good practices in fighting money laundering from HT:

Builds on challenges identified in the 2011 report. It notes HT remains a hidden crime, risk assessments focus on crimes it could be ‘hidden within’ meaning appropriate controls are not being put in place and that domestic information sharing between those combatting HT could be better co-ordinated. 

Although not the only significant report on HT,[53],[54], best practices and indicators of financial transactions that highlight laundering of the proceeds of HT are contained within. Those combatting HT can adopt and refer to these to help fight the challenges of detection, investigation and prosecution of ML and TF from the heinous crime of HT that robs an estimated ‘24.9 million people of their freedom and basic human dignity.’ [55]

Professional Money Laundering 

During the fourth round of mutual evaluations FATF found that many countries were not ‘sufficiently investigating and prosecuting a range of money laundering activity.’[56] This included the activity of Professional money launderers (PMLs) who for a fee knowingly ‘enable criminals to evade anti-money laundering and counter terrorism safeguards and sanctions.’1

In July 2018 FATF published the report ‘Professional Money Laundering.’49 to assist authorities at a jurisdictional level to identify, understand, target, disrupt and dismantle PML’s and the structures they use to launder criminal proceeds. The report does not consider money-laundering vulnerabilities, which are covered in other FATF work[57],[58]

The report identifies techniques and tools used by PML’s, highlighting skills in hiding and moving criminal proceeds offered to clients such as organised crime groups and terrorists. It analyses the specialised services, roles and structures of PMLs, exploring differences between individuals, organisations and networks, which can span multiple jurisdictions.

Examples submitted by FATF members show how PMLs have, acted as nominees[59], facilitated movements of physical cash, engaged in trade based money laundering[60], recruiting/managed cash couriers[61],[62] and mules,[63]and provide a menu of other services. Further analysis on each scenario is provided to assist authorities law enforcement and the private sector.

Included in the non-public report FATF offer further tools to assist in investigation, disruption and dismantling of PMLs.

The report contains examples from the United Kingdom. One notes how a PML set up a parallel accounting system via online software outside of the financial system also known as an alternative-banking platform (ABP). This crossed four non-UK jurisdictions and was used to launder EUR 400 million in proceeds of VAT trading fraud on behalf of an Organised Crime group (OCG). 49

The UK’s National Risk Assessment 2017[64] noted concerns about ABP’s and that ‘the criminal exploitation of banks, professional and financial services and cash remain the greatest areas on money laundering risk to the UK.’[65]

The PML report emphasises that a more co-ordinated operational focus at national level, international co-operation and information sharing to combat adaptive PMLs who launder funds using cross border and transnational networks is needed. It also shows that PMLs use a wide range of tools and techniques which authorities and investigators should be aware of in the fight against individual criminals, OCGs and terrorists.

Money laundering is considered an ‘Achilles heel of criminal activity’[66] and the report considers the threats PMLs present to the financial system highlighting that the ‘dismantling of PMLs (will) impact operations of  (… and) can be an effective intervention strategy against numerous criminal targets.’49 

The National Crime Agency’s (NCA’s) mission is protecting the public by leading the UK’s fight to cut serious and organised crime (SOC).[67] SOC is estimated to cost the UK economy at least £37 Billion a year,[68] whilst the human cost can be devastating.[69]

The NCA and Home Office (HO) lead development of the ‘Serious and Organised Crime Strategy’[70]

The NCA are accountable to Home Secretary Priti Patel who is accountable to parliament.

Previous Home Secretary Sajid Javid promoted a whole-system approach to SOC involving multiple partners from the intelligence community, law enforcement, academia,[71] government, the voluntary sector and industry.

NCA Director General Lynne Owens has set NCA operational objectives targeting those exploiting the vulnerable, dominating communities, chasing criminal profits via supply of drugs and firearms using violence or criminal reputation and through criminality undermining the UK’s economy, infrastructure, integrity and institutions.[72],[73]

The NCA’s also has four priorities[74]:

• Producing and maintaining a national threat picture.

The National Targeting Centre and the developing National Data Exploitation Capability[75] help the NCA and partners to gather intelligence. Drawing information from the UK’s intelligence community, government departments, private and voluntary sectors building a picture of and horizon scanning[76] the nature and scale of threats the UK faces from SOC. Independent bodies such as the Investigatory Powers Commissioner’s Office and others oversee the data gathered.[77] 

The annual National Strategic Assessment of SOC provides an assessment of intelligence and high-level overview[78] of the police response. Through the National Assessments centre the NCA and partners strategically[79] deploy resources against the greatest threats and form a tactical[80] view of emerging threats and methodologies.[81]

• Investigating and disrupting serious and organised criminals who pose the greatest risk to the UK and communities.

Aligned to the Government strategy of ‘relentless disruption’62 of SOC. Targeted action at the high end of high risk aims to bring offenders to justice or disrupt by other means.

It’s estimated over 13,000 persons are held as slaves in the UK.[82] The NCA runs awareness campaigns such as the ‘Invisible People Exhibition’[83] that toured the UK with a photographic exhibition to widen public awareness of the issue. Support is provided to public initiatives such as The Church of England and Catholic Church’s app Safe Car Wash.[84],[85],[86] A modern slavery helpline exists for reporting suspected slavery (run by NCA partner Unseen).[87] When the NCA discovers victims (through in-house teams such as the Modern Slavery Human Trafficking Unit) they are taken to a safe place, informed of their human rights and provided with medical and psychological care[88] Work supporting victims is governed by the Ministry of Justice code of practice for victims of crime.[89],[90]

The NCA looks for partners’ world wide as SOC crosses borders and recently alongside long-term partner A21.org[91] was involved in promoting protection of children’s rights in Thailand working with the Thailand Institute of Justice amongst others.[92]

• Developing and delivering national specialist capabilities on behalf of UK law enforcement.

The NCA develops capabilities in specialist areas including (but not limited to) Major crime investigative support, serious crime and counterfeit currency analysis, intelligence collection and exchange of information on missing and fugitive persons.[93] It shares its expertise with police forces worldwide, government agencies (through the Government Agency Intelligence Network)[94],[95] and multiple partners.

The NCA will pursue and lead operational investigations when requested by the Independent Office of Police[96] conduct or by local police forces via the principal interface of Regional Organised Crime Units of which there are nine in England and Wales.[97],[98] In Scotland and Northern Ireland (NI) the NCA is a member of Scotland’s/ NI’s serious organised crime taskforces and operates in Scotland on authorisation from the Lord advocate and via co-operation with Police Scotland and in NI with consent of the Chief Constable.[99],[100]

The NCA Led the investigation into Silk Road 2.0 the darkweb site that traded around 96 million dollars in illegal goods, its expertise broke through anonymising software and via the Crown Prosecution service (CPS) (which prosecutes all NCA cases) jailed it’s creator. Work with US law enforcement partners[101] also saw further prosecutions.

• Enhancing the NCA’s capabilities in order to keep a pace with the evolving threat and maintain public trust.

This approach involves proactive leading, co-ordinating and sharing of capabilities, assets and intelligence across the UK and worldwide. The multi-agency National Economic Crime Centre (NECC) being an example.[102] Bringing together officers and representatives of the NCA, Serious Fraud Office, Financial Conduct Authority, City of London Police, HM Revenue & Customs, CPS and the HO. It also includes the Joint Money Laundering Intelligence Taskforce that further consists of over 40 financial, Cifas and the Metropolitan Police Service.95

The NCA hosts the UK’s Financial Intelligence unit (UKFIU). The Financial Action Task Force recognised the UK’s high quality asset denial and Money Laundering investigations. Further enhancements are being made via the Home Office Led Suspicious Activity Reports reform programme.67 NCA Head of the UKFIU Ian Mynot has welcomed the reform.[103]

As the UK heads towards Brexit and the changes it may bring the NCA forms a vital part of the UK’s fight against SOC. A further 20,000 police officers are being recruited. Home Secretary Priti Patel’s has said in her first interview are that she want’s criminals to ‘feel terror at the thought of committing offences’[104] how this will effect the NCA and help keep pace is yet to be seen.

Good Corporate Governance (CG) is a key driver in delivering outcomes and an indicator of a firms culture of compliance,[105] having the right corporate governance in place can maintain the long-term health of a company and underpin society and the economy by providing employment and creating prosperity.[106] A firm should have good leadership, a capable board, be accountable, sustainable and act with integrity.[107] These qualities will help the companies’ brand and gain trust from the public.

A regulated firm must comply with it’s regulatory and legal responsibilities such as, The UK Corporate Governance Code (UCGC), Senior Managers & Certification regime (SM&CR), acting in accordance with FCA’s Financial crime guidance[108] and rules on corporate governance[109] to maintain the FCA’s 11 principals of good regulation (particularly principle’s 1,2,3 and 11).[110]

UCGC

Financial Reporting Council (FRC) provides oversight98 of UCGC part of UK Law applying to all firms with a premium listing of equity shares in the UK such as those found on the London Stock Exchange.[111]

The code is also supported by a number of FRC Guidance papers at: https://www.frc.org.uk/directors/corporate-governance-and-stewardship/uk-corporate-governance-code/frc-guidance-for-boards-and-board-committees.[112]

UCGC98 covers 5 key sections:

1. Board Leadership and Company Purpose – The board should be effective and work towards the long-term future success of the company.
2. Division of Responsibilities – Responsibilities should be clearly organised and divided with no one person having sole authority for decisions at the board level. 
3. Composition, Succession and Evaluation – Appointments to the board should subject to a rigorous formal and transparent procedure ensuring diversity, of skills ethnic background, gender, experience and social backgrounds. The board should be regularly refreshed and a succession plan based on merit should be in place. 
4. Audit, Risk and Internal Control –The board should establish an audit committee made up of non executive directors to asses the risks the organisation is willing to take to meet long term objectives and those current and emerging risk’s faced who should review effectiveness of risk management and internal controls systems annually. Auditors both internal and external should be assessed for effectiveness, their independence and objectivity should be safeguarded. 
5. Remuneration – Remuneration should be transparent, have a simple structure, proportional, aligned with company values and risks such as target-based incentive plans should be considered.98

In the UK Directors have general duties under section 172 of the Companies Act 2006 including (but not limited to) promoting the success of the company and avoiding conflicts of interest. [113]  British companies with secondary listings in the United States must also comply with the Sarbanes-Oxley Act of 2002 (SOX).[114]

The US

The US follows SOX a similar code with one further requirement. Section 302 requires the chief executive and financial officers personally sign the company statements.[115] This is seen as ensuring the CEO and CFO take proactive roles and more confidence can be felt in the quality and reliability of the reports.

The Financial Conduct Authority

The FCA requires regulated firms to include a statement within its annual report setting out the code which it is subject to, where it is publicly available’98 and information about it’s practices above the national requirements.[116]

Firms must also explain parts of the code they do not ‘comply’[117] with.

Firms which meet the definition of medium sized companies and groups as per the Companies act 2006 465 to 466100,[118] must also comply with further requirements found in Schedule 7 13(2)(c,d,f,h and i) ‘Matters to be dealt with in Directors Report’ of the 2008 Act - No.410[119] 

A description of composition and operation of the firm’s management, administrative and supervisory bodies and committees must be included.

Larger companies must publish diversity policies.

SM&CR

Under the senior managers & certification regime Senior management should be able to say to the regulator where and to whom responsibility falls for various elements of the organisations management.98 A senior manager must have the ‘overall responsibility for the firm’s policies and procedures for countering the risk that a firm might be used to further financial crime’ [120],[121]

The remuneration codes have the effect of deferring senior managements variable pay remuneration and allowing claw back and mauls if things should go wrong due to their doing.[122] It also encourages them to look at long-term goals for the organisation as opposed to just short-termism.[123]  This aligns with UCGC that sets out further high standards of internal auditing and regulates accountants, auditors and actuaries.[124]

Applying the rules and guidelines of good CG helps companies protect their employees and share holders by managing risk, fighting corruption, avoiding scandals, and damaged reputations. 

2019 has seen heavy criticism of the big four accounting firms and fines of £32 million levied[125] following the collapse of Patisserie Valerie, British Home stores and Carillion. In 2015 Warning signs were noted by the FCP at Carillion the second largest construction company in the UK, when Carillion collapsed in 2018 20,000[126] of its staff lost their livelihoods, shareholders lost money and it owed £1.5bn in debts.[127] Since the collapse the authorities have questioned stress testing procedures and unqualified audits that provided clear bills of health when it was not the case.

It is a matter of good ethics to get CG right and it is clear to see that when CG fails it can have a knock on effect to which effects many lives.

[1] https://www.psr.org.uk/factsheet-authorised-push-payment-scams-–-psr-led-work

Accessed May 24th 2019

[2] https://www.which.co.uk/news/2016/09/which-makes-scams-super-complaint-453196/

Accessed May 24th 2019

[3] https://www.ukfinance.org.uk/policy-and-guidance/reports-publications/fraud-facts-2019 Accessed May 24th 2019

[4] https://www.which.co.uk/consumer-rights/advice/how-to-spot-an-investment-scam Accessed May 25th 2019

[5] https://www.actionfraud.police.uk/news/over-27-million-reported-lost-to-crypto-and-forex-investment-scams accessed July 07th 2019

[6] https://www.bbc.co.uk/news/uk-england-manchester-47969165 Accessed May 25th 2019

[7] http://news.met.police.uk/news/romance-fraudster-is-jailed-for-defrauding-women-online-out-of-more-than-ps600000-367699 Accessed May 25th 2019

[8] https://www.financialfraudaction.org.uk/consumer/advice/money-mule-scams/

[9] https://www.spoofcard.com Accessed May 25th 2019

[10] https://www.financialfraudaction.org.uk/wp-content/uploads/2016/07/Dr-Paul-Breen-A-DANCE-OF-DECEIT-Final.pdf accessed May 24th 2019

[11] https://www.financialfraudaction.org.uk/publications/ https://www.financialfraudaction.org.uk/wp-content/uploads/2016/07/Dr-Paul-Breen-A-DANCE-OF-DECEIT-Final.pdf accessed May 24th 2019

[12] https://www.ukfinance.org.uk/policy-and-guidance/reports-publications/fraud-facts-2019 Accessed May 26th 2019

[13] https://www.cnet.com/how-to/capital-one-data-breach-what-you-can-do-following-the-banking-hack/ Accessed 03/08/2019

[14] https://www.zdnet.com/article/new-windows-malware-sets-up-proxies-on-your-pc-to-relay-malicious-traffic/ Accessed 03 August 2019

[15] https://www.tripwire.com/state-of-security/security-awareness/5-social-engineering-attacks-to-watch-out-for/ Accessed May 25th 2019

[16] https://www.getsafeonline.org/protecting-yourself/smishing/ Accessed May 25th 2019

[17] https://us.norton.com/internetsecurity-emerging-threats-what-is-social-engineering.html Accessed May 26th 2019

[18] http://news.met.police.uk/news/fraud-gang-jailed-for-more-than-43-years-368511 Accessed May 26th 2019

[19] https://www.tripwire.com/state-of-security/security-awareness/5-social-engineering-attacks-to-watch-out-for/ Accessed May 25th 2019

[20] Share this: Facebook Twitter Reddit LinkedIn WhatsApp