I remind hon. Members that there have been some changes to normal practice in order to support the new hybrid arrangements. Members need to clean their spaces before they use them and before they leave the room. I also remind Members that Mr Speaker has stated that masks should be worn in Westminster Hall throughout the debate.
Ruth Edwards (Rushcliffe) (Con)
I beg to move,
That this House has considered protecting consumers from online scams.
It is a pleasure to serve under your chairmanship, Ms Ghani.
Last year, my constituents Mr and Mrs Biggs came to see me at one of my constituency surgeries. They were asking for my help because scammers had stolen £30,000 of their savings. How had that happened? Well, a friend of theirs had spotted an advert on Google for a bond that, when compared with other products on the market, seemed to offer a reasonable rate of return over a three-year period. They called the telephone line provided to discuss the product further. The bond was being offered by a reputable firm, Goldman Sachs, and it was advertised on Google, which presumably had done its due diligence before accepting the advert, so my constituents invested. Only it was not Goldman Sachs that they had invested with, and the bond did not exist. Instead, Mr and Mrs Biggs, like many people up and down the country, had become victims of a very convincing clone scam. They had transferred £30,000 into the bank account of the perpetrators of that scam.
Clone scams exploit people’s trust in reputable brands by carefully mimicking their websites and online presence and even researching and impersonating their sales managers. When they also carry the stamp of an advert, be that on Google, Facebook or any other online platform, many consumers believe that the platform carrying the advert has checked out the company that posted it and that therefore it is an official advert from the company in question. But the truth is that that is rarely the case, because online platforms currently have no legal obligations to protect users against fake or fraudulent content, and that is the primary issue that I would like to address in the debate today.
In the last 18 months, we have been living through a public health emergency, but the pandemic has also had a really profound effect on the way adversaries operate online. We have seen everything: nation state espionage on vaccine programmes, the spread of misinformation and a huge increase in online scams. We have seen fake personal protective equipment, and phishing sites posing as councils giving out covid grants, or sending fake messages about parcel deliveries to try to download software on to victims’ phones or to direct them to give their bank details to scammers. It shows how sophisticated the world of online scams has become, how fast criminals can adapt to new situations and how easy it is for people to be taken in.
Action Fraud figures show that, in the year to June 2020, 85% of all fraud was cyber-enabled. Reports of clone scams increased by nearly 30% between March and April—just in the space of a month—last year. Victims lost more than £78 million to clone scams in 2020. It is hard to put those sorts of figures in the context of individuals, but the average loss for victims is about £45,000. That could be the deposit for someone’s home, the money that they were saving to start their own business or expand it, or savings for retirement or to pass on to their children. But it is gone, and often with no compensation.
I congratulate the hon. Member for Rushcliffe (Ruth Edwards) on securing the debate and on the powerful case she made. The Pensions Scams Industry Group estimates that 40,000 people, like Mr and Mrs Biggs, were scammed out of pension savings in the five years after the introduction of the pension freedoms and lost £10 billion between them. As she explained, losing pension savings after a lifetime of work is a devastating experience, and she is right that most of the problem is online. In September, Aviva told the Work and Pensions Committee that in the previous six months—since the start of lockdown—it had identified 27 fake websites purporting to be Aviva trying to defraud pension-age customers of their investments.
As the hon. Member said, the Government have the chance to tackle this enormous problem in the forthcoming online safety Bill, but it appears, extraordinarily, that financial harms are to be carved out of it. I hope that the Minister can encourage us that that might be reconsidered. We have heard a separate announcement of a consultation on online advertising, but that covers only part of the problem. A call for evidence on online advertising closed a year ago, but as yet nothing at all seems to have come out of that, and asking us to wait for yet further consultation before anything is done would be hopeless. The FSCS, the FCA and, I understand, the Governor of the Bank of England are urging that scams should be included in the online safety Bill, so I hope the Minister can encourage us on that.
It is, as always, a pleasure to serve under your chairmanship, Ms Ghani, and a real pleasure to respond to the debate. I congratulate my hon. Friend the Member for Rushcliffe (Ruth Edwards) on securing a debate on this important subject. I am delighted that the right hon. Member for East Ham (Stephen Timms) was able to contribute as well. First, may I say that our sympathies are with Mr and Mrs Biggs? My hon. Friend articulated all too well the losses that they have suffered. They have had to endure a terrible experience that, sadly, is experienced by many people, and we heard from the right hon. Gentleman the scale of some of these frauds.
The Government absolutely recognise not only the scale and the impact that fraud can have and is having on victims, but the impact of bringing perpetrators to justice. According to the latest figures, fraud accounted for over a third of all estimated crime in the year ending September 2020 and, as my hon. Friend articulated all too well, behind the statistics there is the trail of misery that these losses can encompass. Victims suffer both financial loss and emotional harm. There can be consequences for their livelihoods, their homes and their families’ futures. We also know that the money that has been stolen from them can often go on to fund other serious and organised crimes.
As this year has demonstrated, more and more people are online at home, and we are acutely aware of the importance of staying safe in the virtual world. We are focusing the Government’s efforts on tackling fraud and online scams in three key areas: prevention; catching the criminals responsible; and supporting the victims of these despicable crimes.
Prevention involves not just victims, the industry and tech companies, but all of us. That is how we will be able to tackle these crimes. We must ensure the private and public sectors prioritise preventing these types of frauds. That is critical to preventing the harms that we have heard about and the economic damage to our businesses, and disrupting the organised criminals who perpetrate these crimes. To do that, the Government are taking steps to ensure that fewer people fall foul of these scams.
4:34 pm
Sitting suspended.
Fortunately, in the end, my constituents, Mr and Mrs Biggs, were compensated. That was not without a fight and the resulting stress and anxiety. Many other victims are not compensated. In 2018, The Telegraph, which has done some really excellent work on this issue, reported that, in the previous year, only 25% of the funds lost to authorised push payment or APP scams, in which the victim transfers money to the bank account of the criminal, were successfully returned to victims.
These figures are shocking, before we even take into account the immense psychological and emotional toll on victims and their families. Scammers take advantage of people’s fears, hopes and anxieties, and they motivate them to transfer large sums of money on this basis. Anyone who has helped a victim of these crimes knows how heart-wrenching the ordeal is for them. The feeling of anxiety and powerlessness experienced when pleading with banks and law enforcement to help recover life savings is a tremendous unseen harm caused by online scams.
Recent analysis by consumer champion Which? found that there are 300 to 350 fraud reports every week in which victims show signs of severe emotional distress. One such account from Which? details the case of an 80-year-old gentleman who could not sleep for weeks after losing his retirement savings to scammers. The person behind the scam pretended to be a real investment company, assuming the name of a real investment manager at that company, and ultimately stole £50,000 from the victim, even after he checked their credentials online.
This scam, like the others I have mentioned, began as an advert at the top of Google’s search results. TV, print and radio advertising are all governed by a comprehensive set of rules, yet very little exists to govern online advertising. The majority of people now go online to research and buy everything, from pensions to pet food, holidays to houses, shoes to savings products, but it is for each individual platform to decide what, if any, verification checks it wants to make on businesses taking out adverts on its service.
I do not mean to imply that platforms are doing nothing. Following ongoing discussions with the Financial Conduct Authority, Google, for example, has updated its financial services policy to make financial services advertisers subject to its business operations verification process. I followed the link that Google provided in its letter to the FCA to understand more about what the verification process entails. The policy states:
“Advertisers may be selected to complete business operations verification if, for example, the advertising behavior has been identified as unclear or their ad content is deemed as potentially misleading.
Advertisers whose accounts were suspended due to a violation of our Google Ads policies may also be requested to undergo business operations verification as part of the account suspension appeals and remediation process.
Advertisers who are required to complete business operations verification will be notified and given 21 days to submit the verification form. In certain circumstances, we may pause advertisers’ accounts immediately when business operations verification is initiated. This means that advertisers’ ads will not be able to serve until they are able to complete the program successfully.
Advertiser accounts may be paused if the advertiser’s business model is unclear and we suspect that their advertising or business practices may cause physical or monetary harm to users. Non-exhaustive examples include: misrepresenting yourself in your ad content; offering financial products or services under false pretences; or offering unauthorized customer support services on behalf of third parties.
Once the verification form is completed and reviewed by Google, advertiser’s accounts that do not meet the requirements of this verification program outlined below will be suspended with a 7 day notice period. Note that if any further clarification or information submitted to Google during this 7 day notice period is insufficient to verify the account, Google may suspend the account immediately.”
So, Google “may” carry out checks, or they may not. They “may” pause the adverts at the start of the verification process, or they may not. Advertisers “may” get 21 days leeway before proper checks are completed. Advertisers found not to meet the requirements of the verification process will have seven days to provide further information to verify the account. If they cannot provide that, Google “may” decide to suspend the account immediately, but presumably they also may not. I know politicians are often accused of using non-committal language and trying to evade a straight answer, but this is a masterclass. It might be time that we in this place send the strong signal that that approach is not enough to protect our constituents, who are definitely being scammed out of their life savings.
If a verification process is to be effective, it needs to take place before any adverts are served. Leaving them up for 21 days while checks are completed provides a free-for-all for scammers. An experiment undertaken last year by Which? shows why. It created a fake water brand, Remedii, and an accompanying online service offering pseudo health and hydration advice, called Natural Hydration. It advertised both using Facebook and Google. Which? reported that
“With barely any checking, Google promoted ads for our website and fake mineral water to users who searched for popular terms, such as ‘bottled water’. Our ads gained nearly 100,000 impressions over a month.”
That shows how fast fake ads can reach a wide audience. A lot of damage can be done in 21 days.
Just this week, in a user survey published by Which?, a third of victims who reported a fraudulent ad on Google said that the advert was not taken down by the search engine, while a quarter of victims who reported an advert on Facebook that resulted in them being scammed said the advert was not removed by the social media site. Those companies earn billions of pounds from advertising. Yesterday, Google’s parent company, Alphabet, reported record results, with a 163% increase in profits. Alphabet’s executives have attributed that rise to an increase in people using Google’s online services and interacting with their online adverts. I do not think it unreasonable to require those companies to spend some of their money on helping to protect people from the harm caused by fraudulent adverts, especially given that adverts are targeted at users based on their recent web activity and behaviour. Fraudulent ads, based on a user’s interests or concerns, are effectively pushed towards them by online platforms, which act as enablers for the scammers.
I will briefly tackle the issue of compensation for victims, which is, at the moment, a minefield. In my constituency, I have seen cases involving victims who have found it incredibly difficult to make their claim heard by their bank, prolonging the painful battle to recoup their losses. Those people are forced into a position in which the odds of a successful outcome are low, and they often emerge at the other end with a growing distrust for our regulatory system.
The Financial Ombudsman Service website puts it very clearly:
“When it comes to payments that customers have authorised themselves, the starting point at law is that their bank won’t be liable for the customer’s loss, even when it’s the result of a scam.”
We might say, “Fair enough. It is not the bank that’s at fault. They are merely acting on the instructions of their customer.” What about the companies who expose users to those fraudulent ads, however? Those companies actually target the adverts at users based on their interests, and make billions from doing so. Are we honestly saying they should have no liability, and that there should be no redress for users who are targeted with ads placed by criminals? How can that be fair?
We urgently need to tackle the issue of online financial harms. I asked the Home Secretary about this matter when she gave evidence to the Home Affairs Committee. She said:
“We are actually doing some work right now through the economic crime board that I chair with the Chancellor—I chaired it just last week. If you speak to many financial regulators and to the financial services sector, they are equally concerned about this. One of the key outcomes that we are now discussing and picking up across Government is: how are we going to make the online harms Bill much stronger, and how are we going to tackle many of these online advertising platforms that come up through search engines, social media and other forms of electronic communications?
We still have a way to go, but what I can say—and I am very grateful to colleagues in the Treasury on this as well—is that the level of focus and attention to this issue definitely means that it will be given a huge push, a significant push, because, quite frankly, economic crime is now becoming one of the most predominant challenges when it comes to law enforcement but also criminality.”
I could not agree with her more.
I would be grateful for an update from the Minister on how the Government propose to tackle the issue. Will financial harms become part of the online harms Bill as the FCA, the Financial Services Compensation Scheme and Which? are asking for it to be? If not, will she set out what they plan to do instead? In either case, can she go any further towards providing a timetable for action?
We have a really urgent problem affecting thousands of people every year. We must sort it quickly. I am confident that we can, because I know from knocking around the cyber-security industry for most of the past decade that the UK has always been a global leader in cyber-security and tackling cyber-crime. I have seen our strategy grow, mature and evolve as the threat has. Fraudulent online adverts are a real threat to all our constituents. It is not on the horizon; it is here already, and it has been for several years. The alarm bells are sounding, and the problem is growing, so let us grip it now and offer our constituents the protection they all deserve.
The National Cyber Security Centre has been at the forefront of that effort. Last year, it launched a new suspicious email reporting service, which makes it easier for the public to highlight suspicious emails and websites. The service has already led to more than 5.5 million reports, and more than 41,000 scams and 81,000 websites have been taken down.
Importantly, we also need to help the public spot these scams. We are working with banks and many other organisations to help people spot when a scam appears, a dodgy text message appears on their phone or an email appears in their inbox so that they can protect themselves. That is in addition to the wider work with the public and private sectors.
Last year, we launched a new gov.uk page to help keep the public safe online. I recommend it to colleagues, who can perhaps disseminate it through their constituencies. We know that, sadly, in the midst of the pandemic, with the enormous human cost that it has had for so many people, fraudsters are seeking to take advantage of even that. We have been working with partners from across law enforcement and health to track and mitigate the threat of fraud around the pandemic. That has included a series of public messaging campaigns to inform the public of fraudsters who are seeking to exploit the vaccine roll-out and tell them how we can all remain vigilant against such attempts.
We are working with industry to try to cut off these scams before they bear fruit on the internet. We have been leading work to develop bilateral fraud charters with our banking, telecommunications and accountancy partners. They will bring greater clarity, transparency and accountability to the actions that each sector will take to target harden their systems and protect their customers from fraud. An example of that is the specialist Dedicated Card and Payment Crime Unit, which is a police unit that targets and disrupts credit card fraud and demonstrates the collaboration between UK Finance, the City of London police, the Metropolitan police and the Home Office. It is also working to help online companies take advantage of its services, in particular on the pernicious ways fraudsters are opening up their fraud—for example, through the recruitment of young people to become money mules. There is another great piece of work with the telecoms companies, whereby if somebody receives a suspicious text, they can forward it to 7726, which will enable the telecoms companies to look at it and see whether it should be removed.
The response to online scams and all fraud demands a collaborative, innovative response to keep pace with the changing threat and new technologies. We continue to work closely with industry to drive progress.
My hon. Friend and the right hon. Gentleman understandably raised the landmark online safety Bill, and they asked whether fraud will be included in its scope. The new law will impose a duty of care on tech companies. Although some companies have taken positive steps already, the Government are clear that more needs to be done. In relation to the specificity of the online safety Bill, there are ongoing discussions.
Of course, what has been said in this debate will be listened to, and the concerns that have been raised will be reflected upon. However, in the more immediate term, my hon. Friend has chosen a timely moment in which to have this debate, because only tomorrow, my noble Friend Baroness Williams of Trafford, along with other ministerial colleagues, will meet with tech companies to discuss a voluntary set of principles for preventing fraud and protecting the public on their platforms. The Government are having productive—we hope—but also insistent conversations with the tech industry as to what it should be doing in order to protect members of the public. I listened to my hon. Friend’s deconstruction—I think that is a fair word—of Google’s policy with great interest, and I will commend it to my noble Friend the Baroness before she goes into tomorrow’s meeting.
We are committed to tackling the problem of online fraud, and are considering every possible approach, including legislative and non-legislative means. As has already been mentioned, the Department for Digital, Culture, Media and Sport is leading work on the online advertising programme, which will consider, among other things, the role of online advertising in perpetrating fraud. DCMS is also carrying out broader and longer-term efforts on digital identity and data protection, and as my hon. Friend has mentioned, in February this year, the Home Secretary chaired a meeting of the Economic Crime Strategic Board, which brought together people from across the public sector and industry. At that meeting, an ambitious new framework for a fraud action plan was agreed to drive forward and improve our collective response to these crimes. The full plan will be published later this year and will consider, among other things, how we can include all sectors to protect the public from fraud.
Law enforcement colleagues clearly play a crucial role in this subject, as do intelligence colleagues. We are considering all routes, including legislation, to give them the tools they need to go after fraudsters and protect those who are vulnerable to these harmful crimes. We have asked the Law Commission to review the existing corporate criminal liability laws for economic crime, including fraud, money laundering and false accounting, and we are hoping to hear from them next year. We will, of course, consider any findings that will benefit counter-fraud efforts, and we continue to work with regulators and industry to consider what more can be done.
However, as my hon. Friend has set out, this is about not just the financial impact on victims, but the emotional and other experiences that people have. We understand that reimbursement can be a key part of helping people deal with those experiences, and are working with the financial sector to ensure that as many victims as possible are either able to claim their money back, or are reimbursed. We are working particularly closely with the Treasury to explore what can be done to promote greater consistency across the sector. We are also working with national and local policing leads to support victims of these terrible crimes. The National Economic Crime Victim Care Unit, based within Action Fraud, is also supporting victims, helping them to recover and protect themselves against becoming victims again.
As this debate draws to a close, let me again thank my hon. Friend for having raised these important points in a timely manner. I very much appreciate the points that she and the right hon. Gentleman have made, both about tackling fraudsters and about supporting victims of these crimes. They have my assurance that the Government take these threats very seriously, and it is through working together and taking a collaborative approach—helping the public to understand where there may be a scam, but also working with tech companies to ensure that these adverts and other things that have been described are cut off at source—that we will help to stop these frauds from happening in the first place.