A total of £503.4m was stolen by criminals through authorised and unauthorised fraud in the first six months of 2018, according to new data from the trade body UK Finance. During the same half year, the finance industry prevented £705.7m of unauthorised fraud, equivalent to £2 in every £3 of attempted unauthorised fraud.
Purchase scams were the most prevalent authorised push payment (APP) scam in the first half of 2018, accounting for almost two thirds of reported APP cases with a total of £19.4 million lost. In these scams the victim pays in advance for a product or service, such as a car, electronics or a holiday rental, which is never received or does not exist. It often takes place online, through auction websites or social media.
The finance sector suggests that social engineering, in which criminals groom and manipulate people into divulging personal or financial details or transferring money, was the key driver of both unauthorised and authorised fraud losses in the first half of 2018. Data theft also continues to be a major enabler of fraud and contributor to fraud losses. This occurs particularly through third-party data breaches, but also includes mail intercepts, malware and phishing.
UK Finance has published a 16-page report on fraud threats and what the industry is doing.
The trade body saw a total of 3,866 reported cases of impersonation scams in the first six months of 2018. In these scams the criminal purports to be from the police, bank and other organisations and tricks the victim into transferring money, often claiming there has been fraud on the account. The nature of these scams means the victim is often persuaded to transfer a significant sum, with an average loss in a police and bank impersonation scam of £11,402 and in other impersonation scams of £7,504.
Katy Worobec, Managing Director of Economic Crime at UK Finance, said: “Fraud and scams pose a major threat to our country. The criminals behind it target their victims indiscriminately and the proceeds go on to fund terrorism, people smuggling and drug trafficking, whether or not the individual is refunded. Every part of society must help to stamp out this menace, especially by stopping the data breaches which increasingly are fuelling fraud.
“The finance industry is committed to fighting back, investing millions in security systems and cyber defences to protect customers. We have brought in new standards to ensure scam victims get the help they need from their payments provider; we are supporting law enforcement in disrupting the criminals and freezing stolen money; and we are assisting the government in improving intelligence sharing to extinguish the threat.”
A total of £145.4m was lost due to APP scams, split between personal (£92.9 million) and non-personal or business (£52.5 million) accounts. In total there were 34,128 cases of APP scams, split between personal (31,510 cases) and non-personal (2,618 cases) accounts. Financial providers were able to return a total of £30.9 million of the losses in the first half of 2018.
In an APP scam, the account holder is duped into authorising a payment to be made to another account. If a customer authorises the payment themselves, current legislation means that they have no legal protection to cover them for losses. UK Finance has been working with consumer groups and the Payment Systems Regulator on proposals to tackle these scams and to establish an industry code which clearly establishes the circumstances in which APP scam victims will be reimbursed by their payments provider.
UK Finance began collating data on APP scams for the first time last year. In the first half of 2017 there were 19,370 cases of APP scams reported, with £101.2 million in losses. However, the data published today is not directly comparable with the 2017 figures. At the start of 2018, new industry guidelines2 were introduced which have improved the identification and reporting of APP scams. Four additional banks also began reporting the data to UK Finance this January. In context, there was a total of over 4.2 billion bank transfers made in 2017.
