As if Brexit wasn’t a scam enough in itself, Toby Carlin, senior director of Fraud Consulting at EMEA, FICO examines a wave of Brexit related scams and offers advice on how to spot, prevent, and report them.  

A fraudster’s perfect storm has broken in the UK. When the country voted in favour of Brexit in June 2016 it signalled the start of a long, painstaking journey to split from the European Union.

Politicians clashed over trade deals, European citizens living in the UK became unsure of their residential status, and newspaper headlines provoked more questions than they answered – a fraudster’s dream. 

Even in the ‘Post Brexit’ world that we now find ourselves in, there is still significant confusion, persisting fears of Covid-19, and the quickly approaching end of the tax year all combine to present criminals with an ideal opportunity.

We are already seeing the attacks step up in line with public interest and reporting as the UK officially leaves the EU.

The targets

Fraudsters are only limited by their imagination and with Brexit scams they target both European and UK citizens.

The main targets in the EU are businesses. Scammers can adapt incredibly quickly to send out an email asking if the organisation works with or is connected to any British company. These will often look like they come from an official source. 

In the UK, however, their sights are set wider and anyone is fair game. Whether it’s for employment or travel, UK residents will have an obligation to inform themselves on new rulings and expectations borne out of Brexit. This is where the door is left ajar and fraudsters can spread misinformation and perpetrate their scams.    

Playing the long game  

Whilst some fraud will be carried out quickly, we still expect many of the fraudsters to play the long game, executing so-called data farming scams aimed less at a quick buck than at stealing data that can be used later.

Instead of looking for immediate financial gain from a data breach, fraudsters will attempt to obtain as much personal information as possible – and the more personal the better.

Passport numbers, ID cards, and even health insurance have all been recent subjects of data farming scams.

This information will then be used in the months to come – perhaps when the media attention has subsided – to the benefit of the criminal. When the time is right, they can go directly for funds or use the information in other impersonations. 

An example of this occurred when the personal data of nine million EasyJet customers was hacked. When announcing the breach to the media, five months after the attack, EasyJet said there was no evidence that any financial information of any nature had been misused – a fact that was confirmed by FICOs own data as there was no immediate attack.

What is important in this case is that whilst financial data may not have been the target, the wider personal data set allows the fraudster to better perpetrate an account takeover, scam or ID theft.

Fraudsters are also using more layered attacks. In multi-channel scams, fraudsters send out a mass phishing email saying, for example, companies must complete a checklist to prepare for Brexit.

There are often deadlines associated to impart a sense of urgency. The email is followed up with a phone call, which could eventually lead to a financial transaction.

This is a volume-based attack where fraudsters are looking to see who nibbles and then defraud them.  To execute these scams, criminals are using the same kinds of auto-diallers and communication methods used by the majority of reputable institutions.

Three Brexit scams

Unpaid tax warning: Criminals have come up with a new twist on the unpaid tax scam. The fraudster sends out an email or makes a phone call impersonating an HMRC employee, stating that the victim has not paid all their taxes and faces a jail sentence if they do not do so immediately.

In the Brexit version, the scammer may say that the victim needs to pay now, or new rules will come into play that will increase the tax debt or even limit the ability to do business.  

Get-rich-quick: Another scam taking place is based around investment. Fraudsters will make contact, usually through email, to disclose information about a company that is going to succeed after Brexit has happened. This get-rich-quick scam requires an investment from the victim after the fraudster describes the potential gain. 

Invalid passport: We are also seeing a passport scam, in which criminals tell victims that their passport will no longer be valid, in the hopes of getting the passport information, which can then be used in nefarious ways. In addition, the victim may be coaxed into paying for a new passport – a double win for the criminal.

How to handle a Brexit scam

We are seeing a high number of Brexit scams now taking place; the first step in prevention is vigilance. Fraud cannot be stopped if it’s not spotted first. 

• Look for official government advice on anything concerning Brexit.
• Make sure to conduct your own searches for information and always use a reputable source.
• Watch out for calls or emails that pressure you to make an instant decision or you will lose money, be fined or miss out on a great opportunity — this is one characteristic of scams.
• Never open attachments if you weren’t expecting the email and don’t know the source. Brexit scam emails may include attachments that you ‘must read now’ or ‘must complete today’ and these attachments can release malware.
• Be wary of exaggerated claims. Some scammers are telling victims that if they don’t make a payment now their Amazon account will be cancelled, or their bank account will be frozen. HMRC would, of course, do neither to resolve a late payment.
• Ask yourself if you are expecting the email/communication and if not – be wary.

Unfortunately, there is no one-size-fits-all solution to fighting scams. The large number of active fraudsters are clever and creative, so the best thing an individual or business can do is be aware of ongoing scams, using the multiple online education resources available from their governments and also their banks.

And if you spot what looks like a scam, report it to the Government databases that track and take down illegal websites.

Banks that have responsibility for protecting their customers should have a robust, real time, scalable platform capable of learning and adapting to the ever-changing threats and seeing the simple customer-level picture regardless of their channel or origination.

This seems simple to many of our global partners, but payment is often where more risks are taken and therefore must be consistently protected to prevent further exploitation.