Fighting fraud in times of crisis

Coro­n­avirus has coursed through every facet of our lives, and soci­ety and busi­ness have already paid a colos­sal price to restrict its flow. We will be count­ing the cost for years, if not decades. And while peo­ple have become almost anaes­thetised to the enor­mous, unprece­dent­ed sums of sup­port mon­ey admin­is­tered by the gov­ern­ment, it was still painful to learn, in Octo­ber, that tax­pay­ers could face los­ing up to £26 bil­lion on COVID-19 loans, accord­ing to an alarm­ing Nation­al Audit Office report.

Giv­en the like­ly scale of abuse, it rais­es the ques­tion of how author­i­ties should go about elim­i­nat­ing pub­lic sec­tor fraud? Could arti­fi­cial intel­li­gence (AI) fraud detec­tion be the answer?

Admit­ted­ly, the rapid deploy­ment of finan­cial-aid schemes, when the pub­lic sec­tor was also deal­ing with a fun­da­men­tal shift in ser­vice deliv­ery, cre­at­ed oppor­tu­ni­ties for both abuse and risk of sys­tem­at­ic error. Fraud­sters have tak­en advan­tage of the coro­n­avirus chaos. But their nefar­i­ous­ness is not lim­it­ed to the pub­lic sec­tor.

Ryan Olson, vice pres­i­dent of threat intel­li­gence at Amer­i­can multi­na­tion­al cyber­se­cu­ri­ty organ­i­sa­tion Palo Alto Net­works, says COVID-19 trig­gered “the cyber­crime gold rush of 2020”.

Indeed, the lat­est crime fig­ures pub­lished at the end of Octo­ber by the Office for Nation­al Sta­tis­tics show that, in the 12 months to June, there were approx­i­mate­ly 11.5 mil­lion offences in Eng­land and Wales. Some 51 per cent of them were made up of 4.3 mil­lion inci­dents of fraud and 1.6 mil­lion cyber­crime events, a year-on-year jump of 65 per cent and 12 per cent respec­tive­ly.

Cybercrime gold rush – counting the cost

Jim Gee, nation­al head of foren­sic ser­vices at Crowe UK, a lead­ing audit, tax, advi­so­ry and risk firm, says: “Even more wor­ry­ing­ly, while the fig­ures are for a 12-month peri­od, a com­par­i­son with the pre­vi­ous quar­ter­ly fig­ures shows this increase has occurred in the April-to-June peri­od of 2020, the three months after the COVID-19 health and eco­nom­ic cri­sis hit. The size of the increase need­ed in a sin­gle quar­ter to result in a 65 per cent increase over the whole 12 months could mean actu­al increas­es of up to four times this per­cent­age.”

In terms of elim­i­nat­ing pub­lic sec­tor fraud, Mike Hamp­son, man­ag­ing direc­tor at con­sul­tan­cy Bish­ops­gate Finan­cial, fears an expen­sive game of catch-up. “Exam­ples of mis­use have increased over the last few months,” he says. “These include fraud­u­lent sup­port-loan claims and cre­ative scams such as crim­i­nals tak­ing out bounce-back loans in the name of car deal­er­ships, in an attempt to buy high-end sports cars.”

AI fraud detec­tion and machine-learn­ing algo­rithms should be put in the dri­ving seat to pump the brakes on iniq­ui­tous activ­i­ty, he argues. “AI can cer­tain­ly assist in car­ry­ing out basic checks and flag­ging the most like­ly fraud cas­es for a human to review,” Hamp­son adds.

John Whit­ting­dale, media and data min­is­ter, con­cedes that the gov­ern­ment “needs to adapt and respond bet­ter”, but says AI and machine-learn­ing are now deemed crit­i­cal to elim­i­nat­ing pub­lic sec­tor fraud. “As tech­nol­o­gy advances, it can be used for ill, but at the same time we can adapt new tech­nol­o­gy to meet that threat,” he says. “AI has a very impor­tant part to play.”

Teaming up with technology leaders

Tech­nol­o­gy is already vital in elim­i­nat­ing pub­lic sec­tor fraud at the high­est lev­el. In March, the Cab­i­net Office rolled out Spot­light, the gov­ern­ment grants auto­mat­ed due-dili­gence tool built on a Sales­force plat­form. Ivana Gor­don, head of the gov­ern­ment grants man­age­ment func­tion COVID-19 response at the Cab­i­net Office, says Spot­light “speeds up ini­tial checks by pro­cess­ing thou­sands of appli­ca­tions in min­utes, replac­ing man­u­al analy­sis that, typ­i­cal­ly, can take at least two hours per appli­ca­tion”. The tool draws on open datasets from Com­pa­nies House, the Char­i­ty Com­mis­sion and 360Giving, plus gov­ern­ment data­bas­es that are not avail­able to the pub­lic.

“Spot­light has proven robust and reli­able,” says Gor­don, “sup­port­ing hun­dreds of local author­i­ties and depart­ments to admin­is­ter COVID-19 funds quick­ly and effi­cient­ly. To date Spot­light has iden­ti­fied around 2 per cent of pay­ment irreg­u­lar­i­ties, enabling grant awards to be inves­ti­gat­ed and pay­ments halt­ed to those who are not eli­gi­ble.”

She adds that Spot­light is one of a suite of coun­ter­mea­sure tools, includ­ing AI fraud detec­tion, devel­oped with tech­nol­o­gy com­pa­nies, and tri­alled and imple­ment­ed across the pub­lic sec­tor to help detect and pre­vent abuse and error.

Besides, crit­ics shouldn’t be too hard on the pub­lic sec­tor, argues David Shri­er, advis­er to the Euro­pean Par­lia­ment in the Cen­tre for AI, because it was “under­stand­ably deal­ing with high­er pri­or­i­ties, like human life, which may have dis­tract­ed some­what from cyber­crime pre­ven­tion”. He believes that were it not for the con­tin­ued invest­ment in the Nation­al Cyber Secu­ri­ty Cen­tre (NCSC), the cost of fraud­u­lent activ­i­ty would have been sig­nif­i­cant­ly high­er.

Work to be done to prevent fraud

Greg Day, vice pres­i­dent and chief secu­ri­ty offi­cer, Europe, Mid­dle East and Africa, at Palo Alto Net­works, who sits on Europol’s cyber­se­cu­ri­ty advi­so­ry board, agrees. Day points to the suc­cess of the government’s Cyber Essen­tials dig­i­tal toolk­it. He thinks, how­ev­er, that the NCSC must “fur­ther spe­cialise, tai­lor its sup­port and advice, and strength­en its role as a bridge into infor­ma­tion both from the gov­ern­ment, but also trust­ed third par­ties, because cyber is such an evolv­ing space”.

The pub­lic sec­tor has much more to do in com­bat­ing cyber­crime and fraud pre­ven­tion on three fronts, says Peter Yapp, who was deputy direc­tor of inci­dent man­age­ment at the NCSC up to last Novem­ber. It must encour­age more report­ing, make life dif­fi­cult for crim­i­nals by upping invest­ment in AI fraud detec­tion and real­lo­cate inves­tiga­tive resources from phys­i­cal to online crime, he says.

Yapp, who now leads law firm Schillings’ cyber and infor­ma­tion secu­ri­ty team, says a good exam­ple of an ini­tia­tive that has reduced oppor­tu­ni­ty for UK pub­lic sec­tor fraud is the NCSC’s Mail Check, which mon­i­tors 11,417 domains classed as pub­lic sec­tor. “This is used to set up and main­tain good domain-based mes­sage authen­ti­ca­tion, report­ing and con­for­mance (DMARC), mak­ing email spoof­ing much hard­er,” he says. Organ­i­sa­tions that deploy DMARC can ensure crim­i­nals do not suc­cess­ful­ly use their email address­es as part of their cam­paigns.”

While such guid­ance is wel­come, there are poten­tial prob­lems with embrac­ing tech to solve the chal­lenge of elim­i­nat­ing pub­lic sec­tor fraud, warns Dr Jeni Ten­ni­son, vice pres­i­dent and chief strat­e­gy advis­er at the Open Data Insti­tute. If unchecked, AI fraud detec­tion could be block­ing peo­ple and busi­ness­es that are apply­ing for loans in good faith, or worse, she says.

“We need to watch out how the tech­nol­o­gy and AI fit into the whole process,” says Ten­ni­son. “As we have seen this year, with the Ofqual exam far­ra­go, AI doesn’t get things right 100 per cent of the time. If you assume it is per­fect, then when it doesn’t work, it will have a very neg­a­tive impact on the peo­ple who are wrong­ly accused or bad­ly affect­ed to the extent they, and oth­ers, are fear­ful of using pub­lic sec­tor ser­vices.”

There are cer­tain­ly risks with blind­ly fol­low­ing any tech­nol­o­gy, con­curs Nick McQuire, senior vice pres­i­dent and head of enter­prise research at CCS Insight. But the pub­lic sec­tor sim­ply must arm itself with AI or the cost to the tax­pay­er will be, ulti­mate­ly, even more sig­nif­i­cant. “Giv­en the scale of the secu­ri­ty chal­lenge, par­tic­u­lar­ly for cash-strapped pub­lic sec­tor organ­i­sa­tions that lack the resources and skills to keep up with the cur­rent threat envi­ron­ment, AI, warts and all, is going to become a cru­cial tool in dri­ving automa­tion into this envi­ron­ment to help their secu­ri­ty teams cope.”