Action Fraud & National Fraud Intelligence Bureau
User Guide Industry Sector:
Contents
Contents ...... 2
Background ...... 3
Police Forces and Action Fraud ...... 4
Fraud Types ...... 7
Reporting Tools ...... 7
Contact Details ...... 8
National Fraud Intelligence Bureau (NFIB) ...... 8
NFIB Scoring ...... 9
Post Reporting...... 9
Role of Tier 2 Support ...... 10
Quality Checking ...... 10
Evidence ...... 10
Complaints ...... 10
Hours of Business: ...... 11
Languages ...... 11
Reports from Outside the UK ...... 11
Background Action Fraud is the UK’s national fraud reporting centre where all fraud is reported. This provides a central point of contact for information about fraud and financially motivated internet crime. The service is run by the National Fraud Authority (NFA) – the government agency that helps to co-ordinate the fight against fraud in the UK.
The Action Fraud system is designed to receive and assess all reports of fraud across the UK as one central repository in order to facilitate the development of a better understanding of the national picture of fraud criminality.
Action Fraud reports are reviewed within the National Fraud Intelligence Bureau (NFIB), hosted by the City of London Police to make sure fraud reports reach the right place for enforcement, intelligence or disruption activity.
Within NFIB, the Crime Command reviews reports of fraud from victims and develops actionable packages for police forces and other law enforcement agencies. By absorbing fraud data from a range of cross sector partners they are able to enhance reports of fraud, identifying the most prolific and the most harmful fraudsters and their methods. Received reports are automatically scored and prioritised for assessment, so not all reports of fraud are manually assessed and disseminated for investigation. All reports are used to enrich the understanding of the constantly evolving fraud landscape.
If enforcement is viable the NFIB, will present a comprehensive case to the most appropriate police force or organisation to investigate. NFIB are not responsible for any subsequent investigation but only the assessment of the report and the dissemination to other police forces, if suitable. Were enforcement is not a viable outcome, other disruption or intelligence activity is considered.
The NFIB system, “Know Fraud”, ingests all data sent to the NFIB by Action Fraud. It links all common entities within its database, which also includes confirmed fraud from other partners, forming networks of linked crimes around suspect websites, bank accounts, telephone numbers, etc. The system assesses all networks for viability. This does not mean that single victims of low loss fraud crime do not receive a service; the scoring system looks only for viability and does not take loss into account, a single crime may well be considered viable.
If a crime or network of crimes is assessed as viable then it is manually reviewed by a Crime Reviewer. The Reviewer may conduct research across multiple indices, including DPA requests to banks, telecoms subscriber checks with service providers etc. They seek to identify the suspect(s) behind the fraud and ascertain who is the best placed organisation to conduct any enforcement action. As well as disseminating the crime package they will also
consider recording the identified suspects as an organised crime group for national aggregation and deconfliction. At all times the staff give due consideration to a holistic response to crime, looking to see what prevention, education or disruption outcomes should be considered and which partners to engage with to achieve that.
The NFIB proactive intervention team will also review all harmful entities and engage with service providers to suspend services abused by fraudsters to perpetrate their criminal enterprise.
Because the system will “rematch” all data every night, new crimes submitted may match with previously unviable crimes and bring in new key information which makes the whole series viable.
Police Forces and Action Fraud Action Fraud is now the primary portal for reporting fraud and internet crime. All Police Forces in England and Wales now report via Action Fraud, including British Transport Police.
The key benefits of one national system of fraud reporting:
- Front counters and police contact centre resources are released from time consuming reporting of fraud; - Police Forces will only receive reports from the NFIB that have viable investigative leads; - There will be a national figure for fraud as cases will not be counted against individual police forces; - Centralised intelligence; - Improved data quality; - Improved victim journey and experience; and - Adherence to Victims Charter.
A Call for Service is where “direct” police action is required. Calls where ”direct” police action or a dynamic police response is required should be reported directly to police by phoning either 999 if it is an emergency or 101 if the matter is non-urgent, they should not be directed to the Action Fraud call-centre or reported via the web reporting tool in these circumstances.
Police forces will still take fraud reports directly in the following situations where the “Call for Service” criteria are met. The definition of a call for service is outlined below which also highlights some useful examples.
Crimes which meet the “Call for Service” criteria:
Police will record all of the following fraud offences as though reported to Police by the NFIB:
Offences where offenders are arrested by Police; or Where, at the time of the call for service, the offender is committing or has recently committed the offence (all fraud types); or Where there is a local suspect.
”Local suspect” is where, through viable investigative, leads:
Police can or could locate a suspect with the details provided; or Have sufficient details to apprehend an offender.
Local has its everyday meaning and has been used to ensure that as for any other type of crime, where there are local viable investigative leads, police should consider the crime for investigation. This is intended to provide the same policing response as with other crime types. For example: If following an assault a suspect can be apprehended, police could respond to that policing demand. It should be the same for fraud offences.
Where this is not the case and the crime needs to be transferred, the crime should be passed to the NFIB or referred to Action Fraud if appropriate. The NFIB will then deal in the same way as with any other reported crime.
Example 1: A local business reports to the police that their accountant has been defrauding the company by falsifying their accounts.
The call for service criteria has been met.
Example 2: A department store phones police informing them that a suspect is at the till presenting a cloned credit card for payment.
In all the following circumstances the call for service criteria has been met:
- A suspect is arrested at the scene; - A suspect who has decamped is identified on CCTV; - After watching CCTV the suspect is seen but not identified; or - CCTV not available and the suspect has escaped before police arrival.
Example 3: Police are informed by a mail order company that goods purchased using a stolen credit card are going to be delivered to an address on their policing area.
The call for service criteria has been met.
Example 4: Police are called by a bank that a person seeking a mortgage is in the branch with a false application.
The call for service criteria has been met.
The venue of reported crimes will be:
- Offences where offenders are arrested by Police:
The venue where the false representation was made
- Where, at the time of the call for service, the offender is committing or has recently committed the offence (all fraud types):
The venue where the false representation was made. This is regardless of any address for the suspect being established through reporting or investigation.
- Where there is a local suspect the venue will be:
The police force area covering the location of the fraudulent operation/suspect’s address or for business related fraud the office address of the employee or if no office address, the Head Office of the company.
Goods ordered remotely: The delivery address to which the fraudulently ordered goods were delivered or are to be delivered.
Fraudulent applications: The venue from which the fraudulent application is sent shall be deemed to be the location. However if, as is commonly the case, the fraudster has arranged for a mail re-direction from the first address, then the ‘re- direct’ address shall be deemed to be the location.
If it is clear that an Action Fraud crime which meets this criterion has not been dealt with by a police force, then it will be passed to the relevant force for investigation.
Fraud Types Action Fraud reports fraud and internet crime as set out in the Home Office Counting Rules for Fraud and Forgery Recorded by NFIB. All fraud types use reference codes starting with NFIB, for example NFIB1A “419” Advance Fee Fraud, NFIB2A Share sales or Boiler Room Fraud.
For further details refer to (page 41 onwards): https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/177109/c ount-fraud-april-2013.pdf
Reporting Tools To meet the requirements of those reporting to it Action Fraud has numerous tools available to report fraud.
- Contact Centre – Trained and dedicated Advisors are available to those who are not confident reporting online or prefer to speak directly with an advisor; for example they are unsure if a fraud has occurred, feel vulnerable or unable to report online etc.
- Attempted Scams or Viruses – This reporting tool is available on the website under “Report Fraud” – “Report Attempted Scams or Viruses”. It is a short multiple choice questionnaire for spam email, phone calls etc. or malicious software where a fraud has not occurred. For phishing emails it identifies the organisation best placed to send specific spam email to. This ensures emails are forwarded directly to the right place not losing header information valuable for disruption activity.
- Main reporting tool – This reporting tool is available on the website under “Report Fraud” – “Report Financial Fraud”. It is a step-by-step reporting process and assumes the customer has a limited knowledge of fraud. It takes approximately 20 minutes to make a report and must be done in one sitting. There are 6 sections, of which section 1 is the most time consuming:
1. Identify if a crime or information report is required and fraud type; 2. Victim details; 3. Suspect details; 4. Money details; 5. Fraud evidence and enablers; 6. Fraud Impact and vulnerability.
- Business Reporting Tool – This reporting tool is available on the website under “Report Fraud” – “If you are a business with a regular requirement to submit multiple fraud reports click here”. It only takes crime reports and assumes a level of fraud knowledge; section 1 above is taken out as the fraud type is selected directly from a list easily halving the length of time it takes to report. Due to this requirement it is only available to approved businesses. It also has “copy” functionality when submitting multiple reports and avoids duplicate data entry.
- Bulk Reporting – Action Fraud are currently designing a “bulk” reporting functionality for large businesses to electronically transfer reporting data directly. Businesses will match a data extract file from their internal systems to a set template and thus avoiding data entry into the Action Fraud tools.
Contact Details Contact Centres (based at Manchester and Edinburgh) - 0300 123 2040, this is charged at a standard local call rate and included in many inclusive minute packages.
Online – www.actionfraud.police.uk; there is webchat functionality for a direct link to an Advisor.
Action Fraud Public Enquiries – [email protected]
National Fraud Intelligence Bureau (NFIB) The National Fraud Intelligence Bureau is a police unit hosted by the City of London Police. The unit aims to tackle fraud strategically and tactically through its range of specialist staff and functions. The crime data from Action Fraud reports is ingested every night into the data warehouse where it is matched with data from other counter fraud partners, such as CIFAS and FFA UK. By matching fraud information the NFIB is able to identify the most prolific and harmful individuals and methods, as well as evidencing trends and themes of fraud to direct prevention activity. The NFIB produces three main outcomes, tactical packages for investigation, disruption of harmful entities and NIM compliant analytical products (Strategic Assessment, Problem Profile etc). The matching of fraud information is a key tool in identifying and disrupting organised crime groups and by collaborating with law enforcement partners we can evidence the fraud connections held by conventional “criminal” groups, providing further lines of attack.
NFIB Scoring All crime reports are matched overnight with all other data held in the database, in the simplest example if a mobile telephone number were present in two reports, this would be highlighted to users. All reports of crime are scored according to the viability criteria at a network level. The system therefore automatically produces a daily queue of crime networks (which can range from one crime to thousands) ranked for viability. The Crime Review team will review these networks, conducting desktop research alongside subscriber checks, DPA requests, etc. to identify the people behind the fraud and the most appropriate enforcement agency to deal with it.
The following criteria are used to allocate viable crimes:
1st - The police force area covering the location of the fraudulent operation/suspect’s address or for business-related fraud the office address of the employee or if no office address, the Head Office of the company;
2nd - The police force area with the greatest number of individual usages or offences;
3rd - The police force area where the first offence was committed;
4th - The police force area where the victim resides or works;
5th - The NFIB have determined the force area.
Scoring relies upon the data quality from the reporting person. It is of paramount importance that those reporting make use of the structured data fields, explicitly providing the suspects bank account, telephone number, address, registration, web address, full details etc. where available. This is fundamental both to the linking of harm as well as the scoring, and the identification of entities for disruption. If you are in any doubt then call the contact centre that can either put the report on for you or give you guidance.
Post Reporting Once a police officer begins an investigation, they have an obligation under the Victim Code of Practice to contact the victim and update them at various stages of the investigation. See below link for full details regarding this code:- http://www.victimsupport.org/~/media/Files/Policy%20and%20research/COPGuideforvicti ms.ashx
In practice all persons reporting crimes or providing information into Action Fraud are informed at the first reporting stage that they may not receive any further contact. If a crime is determined to be viable it is passed to the appropriate force under the criteria
listed above. The obligations under the Victim Code of Practice then transfer to the force where the crime is allocated.
Role of Tier 2 Support
Quality Checking
Evidence If you have evidence or witness statements in relation to the fraud you are reporting we advise you identify the information you have in the report you make to Action Fraud and keep it safe in case a Law Enforcement agency requires it.
If a police force is recording the fraud as a ‘call for service’ then it is a professional judgement call for the Officer as to whether they seize the evidence at that time or not.
Complaints Complaints about the conduct of an Action Fraud Advisor, or of problems experienced in reporting a fraud or a response given by Action Fraud should be referred to:
- [email protected], or - In writing to Action Fraud, National Fraud Authority, Home Office, 2 Marsham Street, SW1P 4DF.
Complaints about police response or the conduct of a police officer or a member of the staff of the National Fraud Intelligence Bureau (NFIB) or City of London Police should be referred to:
- [email protected], or - In writing to PO Box 36451, 182 Bishopsgate, London, EC2M 4WN.
Hours of Business: The Action Fraud website and web tools are available 24/7.
The Action Fraud contact centre’s hours of business are:
Monday to Friday 8am to 9pm Saturday 9am to 5pm Sunday 9am to 5pm
NFIB and Action Fraud staff at the NFA operates Monday – Friday 9am – 5pm
Languages The Action Fraud Contact Centre has access to a translator service should a customer require assistance in another language. When requested, or identified, a relevant translator is added to the call and the Advisor speaks through the translator to assist the customer. On the Action Fraud website, under both the ‘Report It’ tab, and under ‘Contact Us’ is a list of 25+ languages that explains the process for reporting fraud in their native tongue. Included in this list are Welsh and the ten foreign languages known to be most widely used in the UK at this time.
Reports from Outside the UK Action Fraud records crime and information reports from people outside the UK, if the victim suffered a fraud perpetrated from within the UK, we will record a crime report or an information report.
People reporting from abroad can do so online (www.actionfraud.police.uk) or can telephone +44 161 234 9230.