Cyber criminals are sharing tutorials on how to score quick cash through a Universal Credit (UC) scam they say is easier to pull off during the coronavirus pandemic. The cost of these tutorials can reach up to £120 – more expensive than tutorials targeting the welfare apparatus of other countries.
Cyber intelligence company IntSights, which has researched the phenomenon, says this indicates a higher potential return on investment. They discovered Telegram channels and dark web forums rife with criminals swapping tips on how to defraud the British state.
The scam targets the advanced payment feature of the UC scheme – where in the five weeks it takes the Department for Work and Pensions (DWP) to process a claimant’s information, they can be sent an advanced hardship payment of between £500 and £1500.
“The victim has no idea because the DWP does not reach out to the victim until a little bit later, when the victim will receive a physical mail saying ‘you have applied for this type of universal credit’,” says Etay Maor, CSO at IntSights. At this point, the person will realise they’re a victim of fraud, “but it’s too late, at that point the money is out”.
Last year, a BBC report indicated that tens of millions of pounds are estimated to have been stolen in similar scams. The scam has typically involved fraudsters phoning victims and posing as DWP officials to obtain their details and make a claim in their name.
But Maor found that criminals today say it’s possible to dispense with the social engineering element of the scam because there is enough personal data from UK citizens already on the dark web as the result of numerous hacks.
The coronavirus pandemic has also made the scam easier to execute, because the claims process is now conducted either online or over the phone. Maor says that dark web criminals are exploiting a time when security is more lax, due to the increased pressure on the welfare system and the imperative to process more applicants during the Covid-19 crisis.
The BBC reported in early May that nearly two million people had applied for UC since the government first instructed people to stay at home due to coronavirus – six times the normal rate. Because the IT systems were ill-equipped to process this surge in applicants, many encountered long waits as a result of bottlenecks.
Work and Pensions Secretary Therese Coffey said in May that more than 700,000 advance payments had been issued to claimants who said they couldn’t wait five weeks for the first instalment.
A March 2020 National Audit Office (NAO) report says that levels of suspected UC fraud began to increase shortly after the DWP made advances available online in 2018, peaking in July 2019 at around 15,000 suspicious claims in a month.
By the end of 2019, the DWP had detected around 100,000 claims where it suspected an advance had been applied for fraudulently, totalling between an estimated £98m to £147m.
New measures were introduced by the department last year to cut down on this kind of fraud. In mid-September 2019 the department introduced a requirement for claimants to undertake a face-to-face interview before receiving an advance. In response, to this and some other measures, the level of fraudulent claims had fallen by December 2019, to just over 2,000.
However, the coronavirus pandemic meant that the face-to-face step in the process was temporarily suspended.
A DWP spokesperson said: “The vast majority of claims to Universal Credit are legitimate and fraud and error in the benefits system remains very low with 96.5% of benefits paid correctly.
“We continue to monitor and investigate emerging fraud threats and pursue those seeking to rip off the taxpayer using the full range of our powers, including prosecuting and tough financial penalties.”
The DWP engages 600 trained fraud investigators as part of its Enhanced Checking Service, which helps guard against this type of fraud.
The DWP is also aware that techniques for carrying out UC fraud are shared on social media and has been working with social media companies since July 2019 to disrupt this activity. The partnership resulted in the removal of 269 social media pages by January 2020.
Maor suggests more security measures could help the government cut down on this kind of fraud, even in the current exceptional circumstances, “perhaps with an email, phone call or letter – some form of authentication before they send out the advanced loan”.
Another method could be to require a claimant to upload a photo of themselves with a driver’s licence, to see if the faces and the the card match. Maor said this additional step wouldn’t necessarily be completely full-proof but would add extra hindrances for criminals looking to snag low-hanging fruit. However, it would require the hiring of additional staff to validate the details and could make the process more cumbersome for people in dire need of quick cash.