Winter Meeting 3rd November, 2016 Poca update Winter Meeting 3rd November, 2016

$38,000,000,000 Telecoms Revenue $2.255 Trillion (USD) $2,255,000,000,000 $38,000,000,000

Fraud Converts ‘free’ service into income: Fraudulent Service Acquisition Social Engineering Subscription fraud PBX hacking Account takeover Wangiri SMS Spam Artificial Inflation of Traffic (AIT) Massive calling to content services on high-tariff international ranges 1996 Scotland Yard PBX compromised - £620k Losses for mobile operators and Customers Income for Fraudsters

CFCA 2015 Survey

Revenue Share Proceeds of Crime Number provider Content provider Call costs £2.00 Pays £1.60 Pays £1.35 Pays £1.15 Pays £0.50 Number provider Content provider Network Carrier 1 Carrier 2 Keeps £0.40 Keeps £0.25 Keeps £0.20 Keeps £0.65

2016 RAG summer conference: Risk & Assurance Group

AIT Process: Stopped by Annexe E Domestic Origin Dealer Revenue Share Fraud Missing A no. Repeat A no. Sequential B no. Same duration Night hours Consecutive calls Criminal receives proceeds Terrorist receives proceeds International Origin UK Operator Dealer

POCA Approach: Proceeds seized under POCA Domestic Origin Beneficiaries arrested Revenue Share Fraud Missing A no. Repeat A no. Sequential B no. Same duration Night hours Consecutive calls Proceeds seized under POCA Beneficiaries arrested International Origin UK Operator

Poca powers (1) Criminal confiscation: powers to confiscate the proceeds of crime following a criminal conviction (2) Civil recovery: a system for confiscating the proceeds of crime through the civil courts (3) Cash forfeiture: powers to seize and forfeit cash, through a civil process, where there are reasonable grounds to suspect that it is the proceeds of crime (4) Criminal taxation: allows the National Crime Agency to access revenue powers to tax income which it has reasonable grounds to suspect are the proceeds of crime Risk & Assurance Group

Poca civil recovery Civil recovery via the High Court enables the recovery of property obtained through unlawful conduct Proceedings are against the property, not against a person Civil standard of proof applies – balance of probability It isn’t necessary to show that the person in possession of the property was responsible for the unlawful conduct. Risk & Assurance Group

Communication barrier HPMN traffic was being charged well below IOT and CDRs show a loss of 25k SDRs We need a corroborating MG9 or there’s no section 2 committal Risk & Assurance Group

Industry side prepares an agreed briefing paper which describes a) how the process should work and b) what the most common frauds look like LEAs prepare a high level process doc which shows a) points to be proved and b) the data and evidence required Risk & Assurance Group

Risk & Assurance Group

How much Fraud is reported? a) the number of crimes reported under NFIB7 Telecoms Industry Fraud (Misuse of Contracts) b) the value of crimes reported under NFIB7 Telecoms Industry Fraud (Misuse of Contracts) c) the number of crimes reported under NFIB52D Computer Hacking – PBX/Dial Through d) the value of crimes reported under NFIB52D Computer Hacking – PBX/Dial Through Answers due in the next few days Risk & Assurance Group

How much fraud is Prosecuted? a) the number of prosecutions brought under the Communications Act 2003 section 125 Since CPS charging advice considers that prosecutions may also be brought under the Fraud Act 2006 section 11, or the Computer Misuse Act 1990 section 1, please provide the same data for prosecutions brought under these Acts and sections where they relate to the provision of telecommunication services. Prosecutions under: 2013 2014 2015 Communications Act 2003 s125 3 10 2 Computer Misuse Act 1990 s1 141 105 148 Fraud Act 2006 s11 265 247 158 Risk & Assurance Group

How much is Prosecuted? a) the number of prosecutions brought under the Communications Act 2003 section 125 (Fraud Act 2006 s11, or CMA 1990 s1) – see table b) the sum of the related dishonest benefit - £14,179.77 c) the value of Proceeds of Crime Act (POCA) confiscation orders made in these cases - nil d) the value of any related POCA recoveries - nil Risk & Assurance Group