The Insolvency Service laid bare the rampant cynicism of fraudsters last month, raising questions over the constraints that officials face when trying to tackle it.

The government agency revealed that it had shut down two companies – DT Care and Amolin Solution – that had defrauded people in their 70s and 80s. Each company had used the same approach: cold-calling pensioners with false claims that their computers were faulty, using the victims’ panic as leverage to gain remote access to their hardware and then charging them for non-existent IT services.

Just as painful is the way the companies were registered. The Insolvency Service had come to believe that the companies had operated out of India, but had used the identities of very elderly, nominee directors to register with Companies House. When the Insolvency Service spoke to those directors – aged 88 and 91 respectively – they had been unable to produce accounting records for the businesses.

For Insolvency Service Chief Investigator David Usher, the two winding-up orders sent out “a strong signal to the business community that we will use all the powers at our disposal to shut you down if you prey on some of the most vulnerable people in society”.

However, in its coverage of the announcement, regional news site The Business Desk cast doubt over whether the UK enforcement system has what it takes to properly tackle so-called corporate ‘cuckooing.’ The article featured comments issued last year by anti-fraud and tax avoidance campaigner Dan Neidle saying that long-planned reforms of Companies House would not make it any easier to identify or stop those engaged in this sort of activity.

Trickster’s toolbox

“This type of crime is very prevalent at the moment, particularly in the field of supply-chain fraud,” says Alex Bomberg, Group Chairman of corporate risk specialists International Intelligence.

His company recently assisted a large business that lost hundreds of thousands of pounds to a fraudulent outfit that was passing itself off under the company’s name. Cybersquatting played a significant role: the fraudster had purchased a domain name very close to the company’s own URL and had used a similar email address. “We believe that a former employee was involved, as there would have been no other way to know that Company A supplied Company B,” Bomberg says.

Bomberg points out that Companies House imposes no requirement for proof of address. As soon as a bad actor achieves registration, even if their address details are false, that paperwork becomes an article for fraud. In the eyes of anyone the fraudster approaches, it carries official clout.

“This is all part of the confidence trickster’s toolbox,” Bomberg says. “From that point, the fraudster can open bank accounts and that’s when their activity tends to escalate very quickly.”

To safeguard against the dual risk of impersonation and being stung, Bomberg advises people to be much more careful with their personal data. Indeed, one of the services that his company provides is continuous monitoring of how clients’ names and postcodes are used online. By itself, the existence of that service illustrates the scale of the problem.

“A lot of these frauds are fostered on social media,” Bomberg says. “If we take a random brand – for example, Boots – the fraudsters would follow a reasonably established playbook. Someone will set up a Facebook page called, say, ‘Boots Customer Services.’ They will then hunt online for people who’ve provided positive or negative reviews of Boots in comments on official social channels, then contact those individuals to offer rewards or compensation.” 

This serves as a hook for obtaining customers’ home addresses and card details. Social engineering also plays a massive part, he explains. “If fraudsters combine some personal knowledge about someone with some positive reinforcement, it doesn’t take long for the targeted individual to start singing like a canary.”

Whole-system approach

Alongside his clients’ experiences, Bomberg says, his own company is currently grappling with the harms of passing off. “We’ve been trying to contain the effects of someone claiming to be us and advertising a job,” he explains. “We’ve had major problems dealing with online recruiters and domain registries, and have even had to get the intelligence services involved. People who think they’re speaking to us have been debriefed on sensitive matters. Clearly, it’s not helpful to my brand from a reputational standpoint and it’s compromising for those intelligence analysts, too.”

Bomberg agrees with Neidle’s view that reforms of Companies House, as currently envisioned, will not prevent cuckooing. Asked how the agency should adapt its procedures, Bomberg stresses that it should take a whole-system approach.

“Tie in identification with HM Passport Office and any other relevant agencies,” he says. “Create a Government Gateway-style login system complete with multi-factor authentication, which could include steps such as facial and phone recognition.” 

Companies House doesn’t have to reinvent the wheel, he adds; these anti-fraud measures and technologies are already in daily use at banks and other financial services firms, with relatively low implementation costs.

“In countries such as India, Pakistan and Africa, there are factories pumping out this type of fraud,” he notes. “That’s the nature of the challenge that Companies House reforms must address.”