Tameside MBC - NAFN Data and Intelligence Services
Tameside MBC – NAFN Data and Intelligence Services
NAFN COVID-19 Fraud Prevention and Recovery
Briefly describe the initiative/ project/service; please include your aims and objectives
In March 2020, a global pandemic resulted in a government imposed lockdown. During this time, organisations including local authorities (LAs) were forced to work differently causing significant disruption. At the same time, businesses closed and the country faced economic crisis. In order to drive cash back in to the economy, the Government charged LAs with administration of the COVID-19 Business Grant for small business, retail, hospitality and leisure at £10k or £25k dependent on the rateable value of business premises and other qualifying criteria. Within weeks of the announcement, LAs began to receive phishing emails, fraudulent applications, false retrospective registrations and doctored documents from fraudsters. Some appearing to be opportunistic and others clearly the activity of organised crime groups. Amongst these, were thousands of legitimate claims from local businesses in desperate need of financial assistance; some of which having their payments delayed as fraudsters had already made successful false claims in their name. Combined with our focus on recovery we developed the COVID-19 Business Grant Fraud intelligence alert providing a quick reference document accessible by all relevant departments at no cost. LAs needed a way to swiftly administer grants and carry out appropriate due diligence; simultaneously tackling fraudsters, supporting local business and saving the livelihood of local residents. This initiative was the answer and we developed the simple, free of charge check to support them to prevent losses, initiate further investigations and/or recovery action.
The aim of our NAFN COVID-19 Fraud Prevention and Recovery initiative was to facilitate the quick, lawful, secure and effective sharing of intelligence via intelligence alerts distributed in real time and data sharing with the finance sector. The alerts would provide an up to date list of all fraudulent applications, organisations, subjects, email addresses, bank account details and modus operandi as and when they emerged. Further to analysis, connections were detailed and linked incidents identified to assist investigations. Only known fraudulent data could be included. By consolidating all the information in to a single alert, highlighting in each issue the new and updated intelligence for ease of reference; LAs were able to share appropriately, run account details through their payment systems and cross check them against new applications. This aided in raising awareness within their organisations and preventing further losses – a simple but extremely effective initiative not only succeeded in its objective but has further enhanced fraud awareness in LA departments previously not involved in their organisation’s counter-fraud function.
A number of services had been developed both within NAFN and central government to support verification and validation of payment details. But what were LAs to do when the details failed the checks? To respond to this NAFN approached a partner organisation, National Hunter which has direct links to the finance sector. In view of the urgency, all parties considered if anew governance process was truly required. It was determined the existing data sharing agreement and process would allow us to pursue a new free of charge pilot project where we could capture the relevant information to approach banks for the holders of fraudulent accounts. The recovery initiative involved identification of fraud and secure transfer of data between the public and private finance sector. The banks were able to share (via National Hunter) the fraudsters details, whether the accounts had received payments from other LAs and also support freezing the funds in order to give LAs the opportunity to recover the monies. LAs would ordinarily seek production orders through the courts, which was further delayed due to closures as a result of the pandemic. This service had therefore never been offered before and was borne solely out of necessity during the national crisis with the aim to support LAs with recovery of previously lost funds.
All the intelligence received by NAFN was assessed, graded and given appropriate handling instructions. This ensures the intelligence is shared effectively and lawfully. It also allows each person in receipt of the alert to understand how to manage the content and make their own assessment to ensure the privacy of all parties is not breached. This particular alert was graded as lawful sharing permitted with conditions. LA recipients contacted NAFN frequently, prior to sharing with any party outside of their organisation. Our objective to support prevention and recovery was bolstered by our desire to show the effectiveness of local authorities. In the midst of unprecedented challenges LAs still recognised the need to share information securely outside of the public sector in order to recover public funds and pursue the perpetrators of crime.
What are the key achievements?
In sharing a single alert (now 20 pages) LAs were prompted to share further intelligence with NAFN which allowed us to identify cross border, multiple authority attacks on LAs by fraudsters seeking to illegally obtain public funds. This in turn supported the prevention of further losses. Where fraudulent payments were identified, our recovery initiative supported them to identify fraudsters, freeze accounts and recover funds. We have currently issued over 30 alerts and recorded almost 2kfraud incidents with a total prevention value of almost £16m; an amount which is likely to increase as more reports come in and the government support schemes continue. In addition, to this, we have supported recovery of funds and local authorities report recovery of £1.2m to date. The intelligence alerts successfully raised fraud awareness, not only amongst LA counter-fraud specialists but in all departments drafted in to support administration of the COVID-19 grants. Without the input of LAs feeding into this initiative, sharing intelligence regarding monies lost, recovered and prevented, many more LAs may have fallen victim and potentially millions in public funds lost to organised and opportunistic crime.
The initiative immediately yielded benefits for local authorities (LAs), particularly those with little or no investigation function. Our simple recovery support initiative used existing agreements and processes, which ensured made them accessible and efficient. Accounts listed in the alerts could also be checked in bulk or on a case by case basis against in-house systems and new claims. This saved significant internal resources at a time when much was diverted to other COVID challenges. LAs have shared how valuable the initiative is to them and attribute a great deal of the prevention and recovery to our initiative (some examples are below).
“This brings the total of attempt frauds against DCC linked to companies in the NAFN alerts to £620,000. Putting this against our paid Greggs Fraud of £150,000 it shows how valuable the alerts are.” Durham County Council
“The information that you sent out this week alerted us to an attempted, and almost successful, fraudulent application for£25,000 by “Barden Global LTD”. Although the NNDR account details were updated, the grant was not paid out.” Waverly Borough Council
The Department for Business, Energy and Industrial Strategy made contact to praise the initiative and its impact on prevention. We now have a fortnightly meeting and provide weekly reports for the Secretary of State showing the great preventative work being undertaken.
“We are preparing advice to senior officials and would like to make them aware of the invaluable work you are doing, starting with this alert. Prevented (fraud) keeps going up while losses are stable. The alerts you are putting out seem to be working” BEIS Counter Fraud and Investigations (Finance and Portfolio)
Further benefits of the initiative include:
– Stronger central government/finance relationships; expedited development of agreements whereby information can be shared with banks, the Insolvency Service and Cabinet Office. This brought key benefits for local authorities, as banks acted upon intelligence shared to freeze accounts and were able to identify where Bounce Back Loans had also been paid. We’ve also been able to link banks with LAs enabling them to issue indemnity documents to recover the frozen funds.
– The Insolvency Service opened investigations in to the fraudulent businesses/directors; 13 to date considered cases of interest.
– A national investigation in to the cross border multiple authority fraud was commissioned by BEIS to be led by the National Investigation Service, with which we are working collaboratively.
“My colleague and I were enquiring about how to receive NAFN alerts which we find helpful for fraud compliance.” HSBC Bank
“I have seen a couple of versions of the attached Business Grant Scams alert and I am in the process of preparing a communication to go out to our Lloyds Banking Group Local Authority customers to reinforce the need for extra vigilance. As the team who ensure that our Commercial and Institutional clients receive the essential information they need about fraud awareness, I thought it would make sense for us to also receive the latest intelligence and guidance from yourselves over the current Business Grant Scam.” Lloyds Bank
“Just to confirm our bank contacted us yesterday to say that the beneficiary bank returned £24,820.59 to our account on 02/07/2020 in respect of the £25,000 Retail, Hospitality and Leisure grant that was claimed fraudulently for a Caffe Nero shop. This is a really good result. Thanks for the work that you have done to pursue this.” Bolton Council
NAFN services are limited to members. In this case we believed the prevention of substantial losses during a time of crisis required removal of such restriction in the public interest.
What are the key learning points?
Through this initiative we have been able to show local authorities the value of effective information sharing, not just in terms of building relationships and enriching intelligence, but the actual monetary value in terms of prevented losses. Their proactive engagement allowed us to build the alert and a central intelligence spreadsheet holding all the fraud incidents relating toCOVID-19 Business grant fraud. This intelligence is invaluable and will serve to support public sector organisations in future fraud prevention and investigations. In gathering and analysing the intelligence we were also able to identify the modus operandi. By sharing the key ways in which the fraud was being committed, this supported dissemination of information to officers outside of the counter-fraud function to understand on a basic level what to look out for in addition to checking bank accounts, emails addresses and company names. This has been built upon and incorporated into future alerts.
Whilst the handling instructions for the alert were extensively adhered to, we identified that additional training for officers outside the counter-fraud function regarding basic fraud awareness and intelligence sharing would be beneficial. Whilst we did not record any breaches, it is our aim to support all public sector organisations to share and handle intelligence effectively and with the confidence they are acting lawfully. Our work with central government (BEIS, Cabinet Office and Insolvency Service) has further enhanced the scope of support for LAs. Our shared focus was to support local authorities; however we did not liaise on this matter prior to the grants being administered and so it took some time at the height of the pandemic to develop a joined up approach whereby intelligence was gathered and analysed by NAFN, fed in to the investigation supported by Cabinet Office and NATIS and monitored and reported to ministers by BEIS. Our prevention and recovery initiative could have been improved had time allowed for a more co-ordinated approach. Whilst we cannot address the urgency at which processes were implemented, with these stronger relationships we can respond more effectively in future and can be more proactive in engaging central government to ensure our existing reach to LAs nationally and position as a central repository for their intel can be maximised.
Our work with banks highlighted the need to broker mutually beneficial data sharing agreements between the public and private sector, as some of the bank accounts pursued for recovery of business grants had also received bounce back loans. In spite of the successes, some banks were reluctant to share the information. We have raised this with UK Finance to aid standardisation across the sector. Some local authorities still choose to receive and utilise Intel but do not share their own incidents in spite of alerts being anonymised. In many cases this is due to a desire to protect their organisations and/or avoid criticism. Tackling this remains a challenge and we continue to urge organisations to share their experiences in order to learn, receive and share new and improved practices. Our standard Intel Alert service consolidates reports and is issued on a weekly basis. To respond to COVID-19, our initiative required that the alert be sent to over 10,000 users on a daily basis. We identified quickly that our existing system was not as effective when dealing with this volume and frequency of communications, which therefore increased the time required to send them out. Our technology, systems and software are in need of upgrade in order to deliver the very best service and ensure the limited time of our officers can be used more efficiently.
The challenge of ensuring appropriate governance and processes are in place prior to going live with a pilot was set to cause significant delay to the recovery initiative with National Hunter. Both organisations sought to break this culture and instead of beginning the process again, we reviewed the existing governance and processes. We concluded the same agreement and process could be used to facilitate the pilot, saving time, resource and improving efficiency. This is a key learning point for both organisations and one we will seek to replicate in future.
Additional Comments
As the intel alert has provided for such a large amount of intelligence we are now developing data sharing agreements with the National Fraud Initiative (NFI), BEIS, Police Scotland and Companies House. Our support of local authorities in terms of prevention and recovery has resulted in two of our Intelligence Officers being seconded to NATIS which has been commissioned by BEIS to investigate COVID-19 business grant fraud..
COVID-19 Response Recognition Award
We are a small organisation and much like local authorities nationwide, we were required to re-allocate much needed resource to respond quickly and effectively to the pandemic. Our initiative would not have been effective if there were significant delays in the assessment and distribution of intelligence submitted by affected organisations. The impact of the initiative was therefore enhanced by our ability to respond in real time and share Intel as and when received therefore enabling local authorities to prevent losses. One of our aims is to support organisations to protect the public purse. Billions of pounds have been used to boost the economy and support businesses to remain solvent during and beyond the pandemic. The millions of pounds saved and recovered as a result of our initiative will be placed back in to the economy to further benefit the public and businesses alike. The hardship caused by the national crisis cannot be disputed; however we have developed new relationships, data sharing agreements and a culture of expediting governance without compromising on due diligence. This has been identified by partners and stakeholders alike; there is a shared goal to continue and prioritise these practices beyond the pandemic.
