In our latest webinar, we invited representatives from the UK Identity Fraud Advisory (UKIFA) to discuss the ways that fraudsters are adapting to digital hiring processes, as well as committing document fraud, and scamming work seekers out of ID data and money. Presenting were three of the four founding members of UKIFA:
Keith Rosser – Director of Reed Screening & Chair of the Better Hiring Institute
Rob Brooker – Head of Fraud and Forensics, PFK GM
Gavin Burton – Co-founder and Director, UK Identity Fraud Advisory (UKIFA)
What is UKIFA?
Founded in 2020, UKIFA (UK Identity Fraud Advisory) was founded to help protect individuals and support businesses. They provide free advice and guidance for work seekers, businesses, and the general public around ID fraud. Services include:
Information on what to do when you’re unsure of the legitimacy of a company
Guidance on how to apply for work safely and protect your ID
Guidance for organisations on how to spot fake documents
Bringing together of collective expertise to fight fraud
A unique ID repair checklist to help victims of ID fraud to reclaim their identity
Guidance on how to report a stolen identity
Reports on the impact that fraud has on victims.
ID Fraud and digital hiring
The recent developments in recruitment, in particular, the introduction of more digital systems, has led to a change in how fraud is being committed.
The benefits that developing digital hiring systems such as digital ID, digital DBS checks, and digital Disclosure Scotland checks can enhance experiences for both employers and employees. However, with new processes come new risks.
Keith explained that the way in which fraudsters are already adapting to the new systems this early in the journey of digital recruitment is offering us signposts as to how it can be managed in future. The new digital information bill, which is currently being processed through the House of Commons, is bringing in some clear provisions that will help tackle fraud in hiring, including:
Creation of a governance body sitting above the markets that helps to oversee issues in the digital identity market.
a public register of certified firms in the digital ID space so employers can select providers that meet the required standards
increased obligations for firms to do more to fight fraud in digital ID
As well as this, it’s important that we have provisions, duties and responsibilities for the technology companies in the digital ID marketplace to have the latest technology to help combat fraud, to share fraud information across the ecosystem, as well as provide information and assistance.
How are fraudsters targeting digital systems?
Since digital ID verification was introduced as a valid method of proving an employee’s Right to Work, increasing numbers of fraud cases have been identified, as the technology is more effective at spotting forged or stolen documents than face to face checks.
In a study of 70,000 candidates, 83% opted to use the digital route for checking documents, while 17% preferred the face to face or postal options. While there are plenty of perfectly valid reasons to opt for manual processes (not least because currently digital ID verification technology can only be used with a valid passport), fraudsters will also opt for the manual processes too, as their fake documents are less likely to be exposed.
What is being done to address fraud in the hiring process?
There are a number of actions organisations such as the BHI and UKIFA are taking to fight fraud in digital hiring.
From a business perspective:
working with the Home Office to expand the document set accepted by IDSPs (Identification service providers) when verifying right to work. One in five work seekers currently cannot use a digital check, and must use a face-to-face route, because they don’t have an in-date passport. By expanding the accepted documents, more people will be able to opt for the digital route and exposing fraudsters will be simpler.
Meeting with civil servants to confirm that work is being done to refine the digital right to work scheme, to evolve and tackle this kind of fraud.
Ensuring that different employment models are covered as the way we obtain work evolves, as illegal workers are finding different ways of obtaining work i.e., through umbrella companies, through project teams under statement of work models, or as freelancers. Currently there are grey areas around where the responsibility to carry out the right to work check lies.
From a job-seeker perspective:
Working with Department for Science, Innovation, and Technology to improve security and safeguarding in our new digital way of hiring.
Through UKIFA, protecting ID documents online and raising awareness of fake job offers.
Advising MPs on the need for IDSPs to lead the charge.
What to know as an employer
Fraudsters are exploiting the face to face and postal routes of ID verification with fake documents. According to Cifas’ Fraudscape 2023:
The highest ever volume of identity fraud cases was recorded in 2022, with over 277,000 cases, accounting for 68% of all cases in the National Fraud Database.
86% of all identity fraud occurs through online channels, which may be a direct result of threat actors trying to circumvent online identity verification controls.
UKIFA can help businesses by:
Helping businesses spot fake documents when screening new employees
Emphasising the security features of each document
Pointing to extensive content of documentation, including overseas identity documents.
Collating general advice from GOV UK when undertaking checks on prospective employees.
What to know as an applicant
Feedback has provided insights into common concerns that applicants have around using digital ID:
A worry over lack of help and guidance.
Lack of knowledge around how digital ID data is used by employers once a digital check has been undertaken.
Concerns over security around submitting details to a recruitment agency that they then didn’t work for.
UKIFA has compiled guidance for individuals such as Keeping my documents and details safe, and Applying for work safely.
Employment Fraud – fake jobs and advertisements
Rob spoke about the ways that honest work seekers are scammed out of their money or ID data, as well as becoming involved in criminal activity.
The facts around recruitment fraud include:
Job seekers aged between 18 and 24 are most likely to be targeted.
30% UK adults have experienced employment fraud when searching online.
Victims lose around £4,000 on average.
74% work seekers applied for at least 1 job that never existed.
5 million people in the UK have been a victim of identity fraud.
After the COVID-19 pandemic, the job market has changed considerably, with some skills becoming highly sought-after, while other positions were being made redundant. Therefore, we’re seeing a lot of people looking for work, with more than two thirds searching solely online, including on social media.
Identity theft
The goal for fraudsters is to extract data from applicants, including their name, address, date of birth, bank details, phone number, and family information, in order to sell it to serious organised crime gangs.
To obtain a work seeker’s data, fraudsters can go to great lengths, such as setting up and going through a multi-level, long-term interview process, including telephone, virtual, and in-person interview stages, offering applicants the job, and once they’ve sent their ID details, suddenly disappearing.
Unfortunately, this kind of fraud is not prioritised for investigation by the police, and therefore organisations like UKIFA exist to provide assistance and guidance to victims of such scams.
Money-making scams
Fake employers and job adverts designed to swindle work seekers out of money are a growing threat. Common features of fake employment include claims that you can earn lots of money with little time and effort, and jobs that require employees to buy a starter kit, tools, or goods in order to earn.
The tricks that many fraudsters adopt to scam money from applicants include:
Demanding advance fees to cover police checks or CV security, then disappearing.
Offering a telephone interview held on a premium rate phone line, engineered to last a considerable length of time.
Money Laundering
A common story is that a work seeker will be offered a job that feels like a genuine Work-From-Home position, but they’re really being used to launder illegally gained money for a criminal gang. These positions include buying and selling IT hardware and transferring money between different accounts.
One victim then found themselves being asked to conduct interviews to recruit more people to carry out the same work.
It’s likely that victims will not be paid for their work, and may have given money to pay for training, equipment, or goods, with a false promise of reimbursement.
Document Fraud
Gavin spoke about how convincing forgeries of ID documents can be made, and what employers should look out for.
When looking at a British passport, there are three key areas that forgers can target.
MRZ (Machine Readable Zone) – this is the area at the bottom of the passport page written in code. It contains check sums to ensure that it is properly encoded. This is quite simple for fraudsters to replicate because the algorithm it uses is published in the International Civil Aviation Organisation (ICAO – the governing body for regulations around travel documents) manual.
VIZ (Visual Inspection Zone) – this is the part of the passport that contains personal information including photograph, date of birth, and passport number. This can be read using optical character recognition extraction and is designed to enable interoperability between different international borders.
Chip – the biometric chip contains data groups including MRZ data and a digital portrait that are currently read only. This means that when the passport is scanned at a border, for example, the scanner can only extract the data, it cannot interact or alter the data that is on the chip.
Data from the MRZ, VIZ, and Chip can be cross-checked with each other.
IDVT and forgeries
Different companies offer different levels of ID verification depending on the level of risk and need. For instance, some companies will just scan the MRZ of a passport, which provides a lower level of confidence in the veracity of the document, as fraudsters can change the MRZ relatively simply.
The most thorough checks scan all three zones, and cross check the data to ensure it all matches. It then asks the user to upload a selfie, which the system then checks against the portrait on the VIZ, and the digital portrait stored on the chip, providing a higher degree of confidence in the document.
Additional checks include:
Negative/positive data sources – checking the data stored in the document against credit reference agencies, or data that’s been involved in fraud which might be found in CIFAS’ database.
Document liveness checks – checking that the image stored on the document in the VIZ and the chip is not a digitally altered image taken from a stolen passport, for example.
Screen detection – checking that the image uploaded to the IDVT has not been photographed from a computer or television screen and is of a physical document in the user’s possession.
Hologram detection – many official ID documents contain a hologram in a particular position. Some technology may ask users to tilt the document for the purpose of hologram detection.
Artificial Intelligence – mapping of specialist fonts, background patterns, and exact colour hues, to check against official documents.
Document fraud threats
Openly on social media, there are numerous advertisements for ID documents for sale, comprising genuine and completely false ID documents, of many different nationalities and document types.
Every advertisement is a potential scam, and cases where genuine documents are for sale suggest that theft or other crime has been committed to obtain them.
According to research carried out by Beruku, from November 2022 to date, 2621 documents have been found being advertised on social media, of which:
52% were driving licences (63% of which purported to be from the UK)
18% were passports
13% were visas
10% were identity cards
7% were residence permits
1017 were compromised genuine documents
62 individuals found on advertised UK drivers licences were listed as company directors and attributed to over 100 companies.
Also online is the significant threat of high quality raw materials being available for purchase from abroad at a minimal cost. For instance, blank drivers license cards, and high quality hologram stickers can be purchased for pennies – authorities are currently tracking purchasers to crack down on the creation of forgeries.
Insights from our attendees
We took the opportunity to get a gauge on the experiences and opinions of our attendees.
Do you think digital identity checks are more secure than face to face?
Yes – 77%
No – 22%
Have any candidates expressed concern with digital checks?
Yes – 42%
No – 57%
Have you encountered false identity documents in the last 6 months?
Yes – 15%
No – 84%
It’s clear that employers feel confident in the security of digital ID checks as opposed to face-to-face methods with 77% finding them more secure, however almost a quarter of our attendees disagreed. This indicates that while a majority are assured that digital checks are an improvement, work needs to be done to ensure more employers feel secure in their use.
For candidates, this work is more urgent, as 42% of attendees said that candidates had expressed concern with digital ID checks. This shows that information and assurance needs to be passed to candidates and applicants more readily to ensure high uptake of digital processes.
Among our attendees, the vast majority (84%) had not encountered any false documents in the last 6 months, however, it’s important to be vigilant, as 15% said they had.