The figures for online fraud are eye watering. In the UK, Action Fraud estimates that online accounts for 80 per cent of all fraud.
In England and Wales, fraud comprises 41 per cent of all crime against individuals, up from 30 per cent five years ago. It costs the national economy an estimated £190 billion annually. The bulk of that figure is derived from fraud online — 80 per cent of £190 billion is £152 billion.
The explosion of fraud is so severe that government ministers prefer to leave it out of the crime figures so they can claim crime is falling. That’s just the UK.
Worldwide, online fraud diverts vast amounts of money to organised crime, imposes a heavy burden on legitimate businesses and consumers, and undermines the trust which market economies need to function smoothly. It’s awful for the victims — not just the financial loss but also the shame and humiliation of being defrauded.
It’s a growing blight on lives everywhere, with authorities across the globe desperately trying to play catch-up but seemingly powerless to prevent its onward march. Something must change, and soon.
Consumer online fraud comes in many shapes and sizes — romance cons, cryptocurrency wheezes, rental scams, customer service impersonation, to name just a few. They share common features, but key to them all is usually some form of identity deception.
The successful digital fraudster must first convince their victim they are not in fact a fraudster — but a crypto expert, potential love interest, stranded family member in need of a loan, airline help desk requiring your credit card and passport details, or potential landlord who must have your deposit now if you want to rent their beautiful-but-non-existent apartment.
Increasingly, the best place to create a false identity and use it to identify, target and groom potential victims is on social media, via Facebook, Twitter and Instagram. In the US, the Federal Trade Commission says 27 per cent of all reported fraud is initiated this way, declaring social media to be "a gold mine for scammers".
Research by the UK watchdog, Ofcom, last year found that 23 per cent of adult internet users reported encountering a scam on social media. In other words, roughly a quarter of fraud, and therefore 10 per cent of all crime in the UK, is enabled by social media.
I’ve written extensively about the role banks play in enabling fraud and how bankers must face prosecution and even jail. Until that threat is real, I maintain, their behaviour will not improve. But at least the banks are often obliged to reimburse their customers. The giant social media platforms face no such duty — for them, fraud is someone else’s problem, someone else’s loss.
If governments want to attack online fraud, they should force the social media providers to do their bit, to step up and accept responsibility. Making it harder for scammers to create fake accounts, and easier for other social media users to spot them, would be a great place to start. Unfortunately, Clean Up The Internet, the campaigning organisation I support (declaration of interest, I sit on its Advisory Board) is warning while in the UK that opportunity presents itself with the government’s new Online Safety Bill, the draft legislation does not go nearly far enough.
The Bill does contain a “user verification duty” which would require platforms to offer their users an option of verifying — but the wording is too vague. For example, there’s no definition of verification or a requirement for Ofcom to set minimum standards.
The issue is one of many flaws that critics hope are resolved as the legislation makes its way through the UK parliament. The messaging platforms Signal and WhatsApp have come together to warn that the bill's provision on encryption "poses an unprecedented threat to the privacy, safety and security of every UK citizen".
Good government regulation is sorely needed. Recent events at Twitter highlight the concern. A “blue tick” on the internet has become a commonly understood, widely accepted symbol. Different online platforms had slightly differing systems, but if an account sported a blue tick, it meant the account was “verified”. We might not have been totally sure what process had been followed, nevertheless it was a fair bet that the account did belong to the person named at the top. That’s now changed — blue ticks are for sale for a small monthly subscription and already the criminals are moving in.
By the time a fake Twitter account, purporting to be Martin Lewis, the UK ‘Money Saving Expert’ and sporting a blue tick, was finally taken down after the real Martin Lewis raised a considerable fuss, it had accrued 23,000 followers. I dread to think how many of those were lured into the “crypto investments” the account was pushing, reassured by the fact they were endorsed by “Martin Lewis”, and reassured it really was the personal wealth guru, thanks to the blue tick.
With social media companies’ advertising revenues squeezed, and the “blue tick” a desirable status symbol thanks to its historic association with celebrity and fame, we can expect other platforms to start looking for ways to monetise it. They may not all be as haphazard as Twitter. The Facebook and Instagram owner, Meta, is currently piloting a pricey “Meta verified” service that does appear to include actual identity verification — but it seems as though it’s intended as a revenue raiser, not a safety feature.
Judging from pilot exercises in Australia and the US, Meta’s service looks set to cost more than £150 ($187) each for Facebook and Instagram, which will place it out of the reach of many.
For new social media verification systems to help drive down fraud, they must be robust and the verification needs to be accessible to all users, not just influencers who can tax deduct the subscription fees.
Clean Up The Internet’s contention is that we can’t assume this will happen unless the wording of regulation is tight enough to force them. This seems reasonable — after all, the verification systems right now manifestly aren’t up to scratch, and if we could rely on social media platforms to design fraud out of their platforms voluntarily, they wouldn’t be such crime hotspots.
When fraudsters used to operate door-to-door, a sound piece of advice was to ask to see ID before letting anyone into your home, and if in doubt call the company head office to check. It’s never going to be quite that straightforward online, but “check someone is verified” could become a powerful message to help consumers guard against online fraud.
Given the scale of the problem, we should be making urgent use of every potential tool in our armoury. In the UK, the Online Safety Bill is back in the House of Lords this week and Clean Up The Internet has suggested some amendments — let’s hope their Lordships pick them up.
Chris Blackhurst is the author of Too Big To Jail: Inside HSBC, the Mexican drug cartels and the greatest banking scandal of the century (Macmillan)
