6
FRAUD ISSUE 8 – NOVEMBER 2019 Insight AUDITONE SUPPORTING INTERNATIONAL FRAUD AWARENESS WEEK Internaonal Fraud Awareness Week (IFAW) runs from 17 — 23 November 2019. The week-long campaign encourages leaders and employees to proacvely take steps to minimize the impact of fraud by promong an-fraud awareness and educaon. It Is esmated that the NHS loses in excess of £2bn a year to fraud. It is important that everyone of us helps tackle it to ensure that valuable resources and spent on their real purpose paent care. Over the fraud awareness week you will see increased fraud awareness acvity including display stands, social media posts, newsleers and presentaons from counter fraud staff. Be a part of helping protect the NHS... ALERT: PROTECTING YOUR ONLINE ACCOUNTS A strong password is a good start, but it doesnt stop thereWhether its your Twier, Amazon, or Nelix account, the explosion in popularity of online apps and services means more and more of us have to remember an increasingly long list of passwords. Unfortunately, some of us cope with this challenge by resorng to pracces that leave our data, devices and money at risk - using the same password across mulple accounts, or by creang simple passwords that could easily be guessed by a fraudster. Bad password pracce is more prevalent than you might think. Data breach analysis carried out by the UKs Naonal Cyber Security Centre found that more than 23 million users worldwide used 123456 as a password. But lets say youre not one of those people, and you use strong, unique passwords for each of your online accounts. Thats a great start, but you could sll be vulnerable to phishing aacks or data breaches. Even the most complex password offers you no protecon if youve typed it into the passwordfield of what you thought was your banks genuine website, or if a plain- text version is leaked in a data breach. Thats why an addional layer of security is essenal to properly securing your accounts. If you care about it, put 2FA on it. Two-factor authencaon (2FA) is a way of strengthening the login security of your online accounts. It's a bit like how an ATM works. You need both your debit card (first factor) and your PIN (second factor) to get access to your account. The main objecve is beer security. If your card is stolen, they sll need your PIN. If your PIN is stolen, they sll need your card. Online accounts with 2FA enabled work in a similar way. They require you to verify your identy using your password (first factor), as well as a randomised code (second factor) thats delivered to your mobile phone. If your password is stolen, they sll need your phone. If your phone is stolen, they sll need your password. You should enable 2FA on all of your important online accounts, such as your email, or any account that holds your personal or financial details.

FRAUD Insight - NHS Hull CCG · 2019. 11. 11. · Data breach analysis carried out by the UK ... The NHS payment system showed that the invoice had been approved by Mr Inije,

  • Upload
    others

  • View
    1

  • Download
    0

Embed Size (px)

Citation preview

Page 1: FRAUD Insight - NHS Hull CCG · 2019. 11. 11. · Data breach analysis carried out by the UK ... The NHS payment system showed that the invoice had been approved by Mr Inije,

FRAUD ISSUE 8 – NOVEMBER 2019

Insight

AUDITONE SUPPORTING INTERNATIONAL FRAUD AWARENESS WEEK

International Fraud Awareness Week (IFAW) runs from 17 — 23 November 2019.

The week-long campaign encourages leaders and employees to proactively take

steps to minimize the impact of fraud by promoting anti-fraud awareness and

education. It Is estimated that the NHS loses in excess of £2bn a year to fraud. It

is important that everyone of us helps tackle it to ensure that valuable resources

and spent on their real purpose patient care. Over the fraud awareness week you

will see increased fraud awareness activity including display stands, social media

posts, newsletters and presentations from counter fraud staff.

Be a part of helping protect the NHS...

ALERT: PROTECTING YOUR ONLINE ACCOUNTS A strong password is a good start, but it doesn’t stop there…

Whether it’s your Twitter, Amazon, or Netflix account, the explosion in popularity of

online apps and services means more and more of us have to remember an

increasingly long list of passwords. Unfortunately, some of us cope with this challenge

by resorting to practices that leave our data, devices and money at risk - using the

same password across multiple accounts, or by creating simple passwords that could

easily be guessed by a fraudster. Bad password practice is more prevalent than you

might think. Data breach analysis carried out by the UK’s National Cyber Security Centre found that more than 23 million users worldwide

used 123456 as a password. But let’s say you’re not one of those people, and you use strong, unique passwords for each of your online

accounts. That’s a great start, but you could still be vulnerable to phishing attacks or data breaches. Even the most complex password

offers you no protection if you’ve typed it into the ‘password’ field of what you thought was your bank’s genuine website, or if a plain-

text version is leaked in a data breach. That’s why an additional layer of security is essential to properly securing your accounts.

If you care about it, put 2FA on it.

Two-factor authentication (2FA) is a way of strengthening the login security of your online accounts. It's a bit like how an ATM works. You

need both your debit card (first factor) and your PIN (second factor) to get access to your account. The main objective is better security. If

your card is stolen, they still need your PIN. If your PIN is stolen, they still need your card.

Online accounts with 2FA enabled work in a similar way. They require you to verify your identity using your password (first factor), as well

as a randomised code (second factor) that’s delivered to your mobile phone. If your password is stolen, they still need your phone. If your

phone is stolen, they still need your password. You should enable 2FA on all of your important online accounts, such as your email, or any

account that holds your personal or financial details.

Page 2: FRAUD Insight - NHS Hull CCG · 2019. 11. 11. · Data breach analysis carried out by the UK ... The NHS payment system showed that the invoice had been approved by Mr Inije,

NHS FRAUDSTER GIVEN EXTRA JAIL TIME

NHS MANAGER ORDERED TO REPAY OVER £220K

An NHS manager jailed for fraud in 2018 has been order to repay the £220,431.48 he defrauded from NHS Newham CCG or face an extra three years in prison. Michael Inije was employed as the Deputy Accounts and Governance Manager at North East London Commissioning Support Unit, which provided services to a number of NHS organisations including NHS Newham CCG. In May 2017, a colleague noticed that a £18,536.95 invoice submitted for payment by a company called DAVII J SERVICES LTD was not clear about the services it had provided to NHS Newham CCG. The payment was withheld while extra checks were made which led to a fraud investigation being carried out on behalf of NHS England. The suspect payment was for claims support given to Continuing Healthcare (CHC) case assessments and reviews, services allegedly provided in March 2017.

A convicted NHS fraudster who was part of a criminal gang that stole £12m from the NHS and other public bodies has been jailed for nine years and eight months for failing to pay back what he owes. The fraudster, who was jailed for four years and six months in June 2017 after he admitted conspiracy to launder money. Following his conviction he was ordered to repay over £8m under the Proceeds of Crime Act (POCA) with over £4m to be repaid within three months.

In August 2019 he applied to the court for more time to repay the money. On 5 September, at Birmingham Magistrates’ Court the court affirmed that the confiscation order should be enforced. The Court heard that he had only repaid £212,000 and he had wilfully refused to engage in the process. Under POCA the balance of what is owed remains even after the sentence is served and interest on the balance continues to accrue.

Proceeds of Crime Act (POCA) 2002: POCA is a piece of legislation created to tackle organised crime, giving the power to seize cash and recover assets such as cars and houses bought by criminals through the proceeds of their crimes. POCA was designed to strike directly at the main motive for crime, deterring offenders, disrupting organised crime and showing the public that crime doesn’t pay.

PROCEEDS OF CRIME ACT CASES

The NHS payment system showed that the invoice had been approved by Mr Inije, who would not normally approve payments relating to CHC. Investigators found that the system had been set up so that all invoices from DAVII J SERVICES LTD were sent only to Inije for approval.

They then discovered that the company’s sole director was in fact Mr Inije, and that between November 2013 and May 2017 he had submitted and approved a further 24 invoices to himself - under the guise of DAVII J SERVICES LTD – worth a total of £382,519.

Inije pleaded guilty to Fraud by Abuse of Position in October 2018 and was sentenced to three years and nine months’ imprisonment, after which the POCA process commenced. Financial investigators from the NHS Counter Fraud Authority established that Injie has £220,431.48 in available. Assets, which will be returned to the defrauded health body.

The NHS estimates that it loses over £1.2bn each year to fraud.

Counter fraud specialists from across the country are actively

targeting those who try to steal from the NHS but we need

your help. If you suspect fraud is occurring, report it

Page 3: FRAUD Insight - NHS Hull CCG · 2019. 11. 11. · Data breach analysis carried out by the UK ... The NHS payment system showed that the invoice had been approved by Mr Inije,

NATIONAL CASE: STUDENT NURSE IN £60K BURSARY SCAM

A student nurse was sentenced to 10 months imprisonment (suspended for 18 months) and ordered to carry out 25 days of rehabilitation activities after she received £60,000 in NHS bursaries by falsely claiming to be a single mother when she was actually married. Annaliese Slater from Birkenhead, Wirral, was awarded the money while studying at three different universities over a decade. She received just over £111,000 in bursary payments, though a court heard that if she had been honest she would have been entitled to around half that amount. Liverpool Crown Court was told that when her dishonesty came to light, Slater denied the allegations before pleading guilty to nine offences of fraud by false representation. A spokesperson for the NHS explained in a statement that the NHS had lost a potential nurse and funded a place that could have gone to someone else, pointing out that there are only a certain number of nurses and bursaries available each year. After returning from maternity leave in January 2011, she transferred to a BSc degree course and continued to receive bursary payments for two years before applying to study at the Anglia Ruskin University in February 2015. Her bursary claims started legitimately but became fraudulent after her family's finances became desperate and she falsely claimed she was single. NHS fraud investigators became involved after the Royal Military Police contacted them about Slater and her husband being in the process of separation and divorce. Her then-husband told how they lived together in Army accommodation since 2009, apart from a short separation in 2009. When quizzed about this Slater claimed he was lying in his statement.

NATIONAL CASE: DOCTOR STRUCK OFF FOR FAILING TO DISCLOSE INFORMATION

A doctor who made £72,000 signing more than 400 bogus sick notes for his wife's legal firm has been struck off the medical register. Dr Zuber Bux, 47, filled in false illness reports from holidaymakers claiming compensation from travel firms through his solicitor wife Sehana's law business. Over four years Dr Bux, a GP from Blackburn, Lancashire, made about £72,000 writing more than 400 reports but did not inform holiday companies or the courts that his wife worked for AMS, the law firm that instructed him. A Medical Practitioners Tribunal in Manchester informed Dr Bux that his name has been erased from the medical register due to his 'dishonesty' and for the 'protection of the public'. Dr Bux was found to be at fault for failing to disclose his solicitor wife was a director for AMS, the solicitors firm which had commissioned him to act as a medical witness in county court claims.

We are aware of fake websites offering non-existent refunds. If you have been affected by the Thomas Cook liquidation, please only apply for refunds through: https://thomascook.caa.co.uk/refunds/. Members of the public have reported receiving calls and messages offering “refunds” by people purporting to be associated with, or acting on behalf of Thomas Cook. We would urge people to be vigilant of unsolicited calls, texts or social media messages that ask for personal or financial details, and not to automatically click on the links in unexpected emails. Legitimate organisations will never contact you out of the blue and ask for your PIN, card details, or full banking passwords. If you get a call or message asking for these, it’s a scam. Remember, your bank or the police will never ask you to transfer money out of your account, or ask you to hand over cash for safe-keeping. If you think you have been a victim of fraud, report it to Action Fraud on 0300 123 2040 or via our online reporting tool.

ALERT: THOMAS COOK REFUND SCAMS

Page 4: FRAUD Insight - NHS Hull CCG · 2019. 11. 11. · Data breach analysis carried out by the UK ... The NHS payment system showed that the invoice had been approved by Mr Inije,

ALERT: COURIER FRAUD SCAM

ALERT: AMAZON PRIME SCAM COSTS VICTIMS £400K IN 2 MONTHS

Courier fraud occurs when a fraudster contacts victims by telephone purporting to be a police officer or bank official. To substantiate this claim, the caller might be able to confirm some easily obtainable basic details about the victim such as their full name and address.

The caller may also offer a telephone number for the victim to telephone or ask the victim to call the number on the back of their bank card to check that they are genuine. In these circumstances, either the number offered will not be genuine or, where a genuine number is suggested, the fraudster will stay on the line and pass the victim to a different individual. After some trust has been established, the fraudster will then, for example, suggest:

• Some money has been removed from a victim’s bank account and staff at their local bank branch are responsible.

• Suspects have already been arrested but the “police” need money for evidence.

• A business such as a jewellers or currency exchange is operating fraudulently and they require assis-tance to help secure evidence.

Victims are then asked to co-operate in an investigation by attending their bank and withdrawing money, withdrawing foreign currency from an exchange or purchasing an expensive item to hand over to a courier for examination who will also be a fraudster. At the time of handover, unsuspecting victims are promised the money they’ve handed over or spent will be reimbursed. In reality there is no further contact and the money is never seen again.

How to protect yourself:

• Your bank or the police will never call you to ask you to verify your personal details or PIN by phone or offer to pick up your card by courier. Hang up if you get a call like this.

• If you need to call your bank back to check, wait five minutes; fraudsters may stay on the line after you hang up. Alternatively, use a different line altogether to call your bank.

• Do not let a stranger take your debit or credit card off you. You should only ever have to hand it over at your bank. If it’s cancelled, you should destroy it yourself.

Action Fraud is warning people of a new scam that has seen victims lose over £400,000 in just two months by responding a new Amazon Prime scam. Members of the public report receiving automated calls telling them a fraudster has used their personal details to sign up for an Amazon Prime subscription. The victim is instructed to press 1 to cancel the transaction. When they do this, they are directly connected to the scammer posing as an Amazon customer service representative. The criminal tells the victim the Amazon Prime subscription was purchased fraudulently and that they need remote access to the victim’s computer in order to fix a security flaw that will prevent it from happening again. The victim is instructed to download an application called Team Viewer and asked to log onto their online banking account. The software download grants the fraudster remote access to the victim’s computer and allows the fraudster to see the victim’s personal and financial details. Other variants of the crime involve victims being informed of a refund for an unauthorised transaction on their Amazon account.

“ Unsolicited requests to

remote access your

computer should always

raise a red flag

Pauline Smith, Head of Action Fraud

Page 5: FRAUD Insight - NHS Hull CCG · 2019. 11. 11. · Data breach analysis carried out by the UK ... The NHS payment system showed that the invoice had been approved by Mr Inije,

Counter Fraud Specialist Martyn Tait

A FEW QUICK QUESTIONS

What advice would you give to someone who wants to work

within counter fraud?

Do it, I have loved every minute of working in Counter Fraud,

had some great experiences and it is not a boring job! I have

been on the BBC, had my cases in the national newspapers and

it has been very rewarding professionally and personally.

What’s your favourite quote and why?

I recently watched the Rocky series of films with my son and

this quote was something I laughed at as being a little cheesy,

but it is essentially telling us never to give up no matter how

hard work or personal lives get. “It’s not about how hard you

can hit; it’s about how hard you can get hit and keep moving

forward”….I give you the philosopher Rocky Balboa/Sylvester

Stallone

What did you do before you became a counter fraud

specialist?

I worked in Local Government as a freelance contractor for ten years,

working as a Counter Fraud Specialist throughout the UK mainly in bene-

fit fraud but also covering Corporate fraud, Blue Badge fraud, tenancy

fraud, Council Tax fraud and Business rates fraud.

What does a normal week look like for you?

During a normal week I will work on proactive counter

fraud exercises looking into areas of high risk for audit

one clients. I also deliver presentations at induction

events. It is always busy and there is always something

new to challenge us.

PRESENTATIONS: CAN YOU HELP ? As your fraud provider we are always looking at ways to raise awareness of fraud within your

organisation. One of the key ways we do this is by delivering counter fraud presentations. Our

interactive presentation focuses on real life fraud cases with mainly news clippings and the

stories behind them. The presentation can be tailored to suit the audience and time available.

So if you have a monthly/quarterly team meeting and fancy hearing from a team you might

not ordinarily consider, why not give us a go.

What does a counter fraud specialist do?

In general terms we promote a culture of anti-fraud, investigate

allegations of fraud/bribery, we deliver agreed proactive exercises on

known areas of risk across the NHS to the clients. We also assist in fraud

proofing policies and procedures for the clients.

What’s the difference between an auditor and a counter fraud specialist?

From my personal opinion Internal auditors look at the

bigger picture of an organisations systems, whereas the

CFS get into the nitty gritty, identifying areas of fraud risk

and if needed investigate allegations to a criminal

standard.

What do you enjoy most about being a counter fraud

specialist?

The variety makes this role enjoyable, the NHS is subject

to a huge amount of risk areas and we are always l

learning new things. I had been in similar roles for the

previous ten years or so and I was starting to get bored

of doing the same thing day in day out, however the NHS

is so big I rarely do the same thing twice which is great.

I’m always extremely proud when we recover money lost

to fraud.

What parts of your job do you find most challenging?

Working with so many clients, who have very different

demands is extremely challenging, sometimes it can be a little

bewildering, even after a couple of years in the NHS!

Page 6: FRAUD Insight - NHS Hull CCG · 2019. 11. 11. · Data breach analysis carried out by the UK ... The NHS payment system showed that the invoice had been approved by Mr Inije,

MEET THE COUNTER FRAUD TEAM