Like Spyblog, I noticed Home Office Minister, Andy Burnham, out and about yesterday on the breakfast TV circuit hawking the government’s latest ‘research’ into the supposed costs of identity fraud. The news is, of course, ‘bad’ – it always is when the government are trying to justify unpopular measures and drum up support for something by trying to scare the bejeebus out of the general public.
So, of course, the estimated costs of identity fraud to the country have gone up, from the last discredit figure they were hawking around - £1.3 billion – to a new and equally discreditable figure of £1.7 billion.
And the solution to all this – well identity cards of course. And boy does Burnham talk a load of bollocks on that subject when he gets going.
Of course, his brief interview on the BBC Breakfast sofa, with Dermot Murnaghan, was prefaced by the obligatory cautionary tale of a couple who had their internet bank accounts were looted by thieves, with suspicion falling on their recycled rubbish as the source of the information used to get at their accounts; but where Murnaghan, to his credit, tried to point out that ID cards offer no protection against this kind of fraud all he got in return was a load of bullshit about biometrics – which Burnham thinks will enable us to ‘own’ our identity - and a bunch of waffle about preventing multiple ID registrations, neither of which were relevant to the question. Classic politico stuff – answer the question you wanted to be asked, not the one you were actually asked.
All this achieved was to point up the problem with Breakfast TV as a medium for this kind of discussion. At most, each interview segment lasts 4-5 minutes, often with a 30-60 second introductory film, interspersed with all the regular features - headlines, news round-up, sports news, local news, brief review of the day’s papers, all running to an hour-long rolling cycle and leaving no time for the interviewer to mount follow-up questions or challenge a politico when they start spouting crap. All of which is why, I suspect, the Breakfast TV gig is far more popular with politicians than an appearance on Radio 4’s Today programme or an encounter with Paxman on Newsnight, where the format allows time for journalists to get their teeth into the interview.
It says a lot about the attitude of senior politicians to political debate that many of them now spend more time glad-handing the like of Richard and Judy than they spend appearing on serious news programmes or discussion programmes like ‘Question Time’ – speaking of which, wasn’t last night’s show a major disappointment. Not only did they put the pretty boy Tory wannabe ex-soap actor and failed pop star, Adam Ricketts, on the show – and isn’t he an irritating little squit – but the rest of the panel was such a yawn fest that it was barely worth watching at all. What happened to the great QT tradition of feeding the idiot/newbie to a heavyweight? Surely QT could have got someone like Tony Benn on the programme to give Ricketts a real test of his ability as a politico rather than the dull and uninspiring bunch they did put up
Anyway, enough bitching and moaning for now, back to the government’s identity fraud figures, which as they released them into the public domain, deserve as rather closer look.
UPDATED ESTIMATE OF THE COST OF IDENTITY FRAUD TO THE UK ECONOMY
2 February 2006
Association of British Insurers - £22m
A number of insurers (representing approx 36% of the industry) estimated that their financial loss in 2003 due to identity fraud was £7.9m, which translates to £22m for the industry as a whole.
Not only is the total figure given an extrapolation from a sample which assumes uniform rates of fraud across the industry sector – which may not be true – but no definition is give as to what the ABI classes as identity fraud.
This figure could relate to fraudulent application for insurance, where a false ID is used to obtain a policy against which a false claim is then made, but could also include other forms of fraud against which ID cards would be useless, the obvious one being motor insurance fraud where a driver involved in a minor road traffic accident provides false information to the other driver involved either to avoid a claim against their insurance or because they are not insured, leaving the other drivers insurance company to pick up the bill for repairs.
Likewise, it is not clear from this report whether the figure quoted relates solely to the material costs of fraud or whether it includes the operational costs of investigating fraudulent claims, which is likely to be near enough a fixed cost irrespective of the introduction of ID cards
APACS, the UK payments association - £504.8m
Losses resulting from plastic cards being used by criminals pretending to be the rightful owner or by criminals using a fictitious identity.
This figure comprises:
(i) Counterfeit (skimmed/cloned) cards - £129.7m
(ii) Cards lost or stolen - £114.4m
(iii) Card not present - £150.8m
(iv) Mail non-receipt - £72.9m
(v) Fraudulent applications - £13.1m
(vi) Account takeover - £23.8m
Straight away we can remove ‘card not present’ fraud from these figures as ID cards will do nothing to tackle that kind of fraud. In the case of card skimming/cloning, lost or stolen cards and mail interceptions, is it not the case that these are all forms of fraud that ‘chip and pin’ is expected to address and with that in mind, where are the benefits that we are constantly being told that the move to ‘chip and pin’ will bring reflected in these figures?
In fact, as this press release shows, the figures quoted above appear to be from last year (2004) - although the government’s quoted figures for counterfeiting and lost and stolen differ somewhat from those quoted by the industry here, the total costs in each report (£244.1 million) are identical.
What this press release does show, however, is a drop in the level of card fraud for the first half of 2005 of £36 million against the same period in 2004, made up of a 31% drop in fraud by counterfeiting and a 27% drop in fraud using lost and stolen cards, a cut which, if extrapolated across the whole year at the same level, would give a total annual figure for last year of £173.3 million. However even the assumption there may be invalid and undervalue the impact of ‘chip and pin’ on fraud as it fails to take into account any growth in the use of the system during the second half of last year, which could result in further reductions in such fraud from its 2004 levels.
Chip and pin is by no means foolproof but it is having an impact and, interestingly, the press release includes this comment:
Other types of card fraud, such as identity fraud and card-not-present fraud, are being tackled by retailers and banks through a number of initiatives. These include verifying the cardholder’s address and cross-checking a card security code to combat fraudulent transactions made over the phone and internet; production of training manuals; multi-sector working groups to address practical solutions and research into hand-held readers that could be used in the future for card-not-present payments.
This appears to suggest both that, in the eyes of the industry, identity fraud is seen as being distinct from counterfeiting, lost and stolen card fraud and card not present fraud, casting further doubts on the government’s figures which lump all these kinds of fraud under the general heading of identity fraud. Equally, the industry is clearly – and sensibly - working on a range of anti-fraud measures which do not rely on any future Identity Cards.
On that basis, it would appear that the vast majority of the £504.8 million for card fraud included in the government’s figures is of highly dubious provenance and has been included to artificially inflate the headline figure for identity fraud as a whole
Audit Commission - £15m
Audit Commission not included in 2002 Study. Estimate of loss to pensions schemes due to identity fraud (extrapolated from Audit Commission National Fraud Initiative figures).
This one is interesting to say the least.
The fraud being highlighted here is, from the Audit Commission’s own report, which is based on 2002 data, is that of continuing to claim against occupational pension schemes after the death of the beneficiary. First and foremost, that is not identity fraud, rather it is a reporting fraud based on a failure to notify a change in circumstances.
Second, the actual figures quoted in the report for this kind of fraud are only £5.7 million, an increase over the previous year’s figures (2001) of 53% but one that is largely accounted for by an increase in the number of pension schemes participating in the Audit Commission’s review from 2.8 million (2001) to 3.8 million (2002).
The extrapolation here appears to be based broadly on the assumption of a similar level of growth in this form of fraud over at least the succeeding 2-3 years, which assumes both that rate of fraud are uniform across the board and across all such schemes.
It seem to me that here, the government is simply pulling numbers out of their arse
British Bankers’ Association
Figures for card fraud included in APACS totals. The BBA does not collect statistics on identity fraud. Figures from its members for card fraud are included in the APACS figures.
Already dealt with
Building Societies’ Association - £3.1m
A number of building societies representing just over 50% of the industry responded to a survey and estimated their financial loss due to ID fraud. The BSA extrapolated figures for the sector as a whole and estimate that this translates to approximately £3.1m losses due to ID fraud over the past year.
Again, no explanation of the nature of the fraud and therefore no basis on which to assess whether this is relevant to identity cards
CIFAS – The UK’s Fraud Prevention Service - £2.3m
This represents the cost of identity fraud to the retail sector. CIFAS figures have only been included with respect to the retail sector. This avoids double-counting on contributions made by other sectors directly.
I can only assume this to be losses to retailers arising from unsecured payments, i.e. where the retailer has been unable to recover their losses via chargeback from the payment verifier – again its not clear that identity cards would have any impact on this kind of fraud
Department for Constitutional Affairs
£29.9m - Unpaid fines due to “tracking� problems - this is due to a number of reasons including false information being provided to the Police.
Note that ‘this is due to a number of reasons including false information being provided to the Police’ – i.e. this figure does not relate entirely to identity fraud, in deed much of it is likely to relate simply to situations where people have moved on and changes address without informing the courts.
Again the figure here is over-inflated and unreliable
£5.9m - Unpaid fines due to identity problems – i.e. many people issued with fines do not turn up at courts to verify their alleged name and address. Given this, courts find it difficult to enforce the payment of a fine because they are not certain the identity on the fine is a true identity (many fines get issued to fictitious identities or identities with inaccurate spellings).
Since when did the inability of a Police Officer to record information accurately become identity fraud?
This entire set of figures from the DCA is a load of bollocks
Department for Work & Pensions - £20m
DWP estimates that £20m-£50m of benefit fraud arises as a result of identity fraud (i.e. claiming benefit in false identities).
Fair enough, it is only an estimate, but the report at least takes the lower figure for what is genuinely a form of identity fraud.
It interesting, however, to note that one has to get nearly halfway through the report to get to the first reasonably reliable set of figures
Driver & Vehicle Licensing Agency - £2.5m
Estimated cost of operational activity required to help prevent abuse of the driving licence in identity crime.
So this is what, the operational costs of investigating possible attempts to obtain false documents?
Fair enough, but how does this compare with the costs to the DVLA of implementing the Identity Cards and the National Identity Register as part of the process of issuing driving licences? – remember driving licences are amongst the designated documents where, if recent amendments from the House of Lords are overturned, registration on the NIR and the issuing of an ID card will be mandatory.
Whoops, we don’t know because the government thinks that information is ‘’commercially sensitive’.
The figures here are impossible to validate in relation to identity cards as the government will not release the cost estimates necessary to make a comparison with the current position and should not, therefore, be included here
Driving Standards Agency - £1.12m
Estimated costs of ensuring that DSA is satisfied as to the identity of candidates presenting for theory and practical tests. The resultant enforcement activity in preventing and detecting impersonations, ensuring that only those entitled can hold driving licences reducing the ability to commit identity fraud.
Again, as with the DVLA, these costs can only be accurately assessed against the costs of implementing identity cards within the Agency and therefore one cannot assume any future savings on this figure should ID cards be introduced
Should not be included in this report
Finance & Leasing Association - £14m
FLA not included in 2002 study. This figure relates to identity fraud arising from the provision of motor finance by FLA members.
This looks to be a valid inclusion as it appears to relate to fraudulent applications for hire purchase and lease agreements.
That’s two from eleven so far – not very good really
HM Revenue & Customs
Indirect taxation: £215m (MTIC fraud)
It is not possible to determine if the scale of this problem has changed since 2002. The figure from the original study has been included for illustrative purposes to help estimate any comparative changes to the overall cost of identity fraud since 2002.
I will admit I had to look this one up with HM Treasury, but MTIC fraud is, according to HMRC:
Missing trader intra-community (MTIC) fraud is a systematic criminal attack on the VAT system, and has been detected in many EU member states.
It involves obtaining a VAT registration to purchase goods from a VAT-free source elsewhere in the EU, selling the goods at a VAT-inclusive purchase price, and going missing without paying over the VAT. This results not only in to a loss to the Exchequer of the VAT owed, but on occasion a further loss in VAT refunds made to traders in the chain.
MTIC fraud is commonly known as acquisition fraud, and often involves items with rapid turnovers that are transported in high volumes, such as soft drinks and confectionery.
A development of this fraud, known as carousel fraud, involves the continuous movement of goods between collaborating traders in different EU member states, resulting in multiple tax losses. To facilitate this, a number of companies are inserted in the supply chain, increasing the distance between the UK missing trader and UK dispatcher, making detection difficult.
The result is that goods are sourced VAT-free from EU countries and sold on in the UK for a VAT-inclusive price. The criminals disappear before the VAT is paid over, and a further tax loss occurs with purchasers reclaiming the VAT paid to the original trader. Goods that are easily traded and have a high value and low volume, such as mobile telephones and computer components, are particularly attractive to MTIC fraudsters.
The estimated cost to the UK of this kind of fraud, for 2001-2, was anything from £1.7 -2.75 billion, so this is big business. However this is primarily a form a business fraud involving companies, so it neither clear to me how the figures for identity fraud related costs have been arrived at or, again, how this might relate to identity cards – my suspicion is that it doesn’t except from a law enforcement point of view in terms of identifying those responsible.
In this case identity cards would seem to offer little of value here – they will not prevent this kind of fraud and the sums of money involved and international character of this kind of fraud point to it falling into the broad category of ‘serious and organised crime’ rather than straight identity fraud.
Again, I would suggest that this is in here to deliberately inflate the headline figure on the assumption that the majority of people will find this all rather too technical to question its relevance.
Direct taxation: £2.7m
Tax Credits
HMRC has identified a number of fraudulent and potentially fraudulent tax credit claims based on false and stolen identities. Some 6,800 fraudulent claims have been identified based on stolen DWP staff identities, of which 4,100 were fully intercepted by HMRC before any payment. The loss from this fraud is estimated at £2.7 million.
HMRC is currently subjecting around 30,000 potentially fraudulent tax credit claims to detailed investigation including claims based on the stolen DWP staff identities and on stolen Network Rail staff identities. It is too early to estimate the loss from this fraud.
Anyone surprised to find this here? Of course not.
You have to admire their chutzpah in trying to make political capital out of one of their own major cock-ups, but before we get too far down that road, let’s remember that the fraud in this case is not only based on the theft of personal data from the DWP but on the ease with which that data could be used to make fraudulent claims using HMRC’s online tax credits application system – and as with any online transactions, such as ‘card not present’ fraud, identity cards offer no protection at all.
Child Benefit
HMRC has experienced a small number of attempts to defraud the Child Benefit system by the use of false documents. These attempts have been successfully detected and it believes the risk of identity fraud to be minimal.
Home Office (Immigration & Nationality Directorate) - £56.2m
Approximate cost to IND of undertaking enforcement activity against individuals who may be involved in some form of identity theft or identity fraud, potentially involving document abuse.
Again, the costs of investigations and enforcement activity (which could conceivably include the legal costs of prosecutions) are being added to the headline figure, this time in relation to the Home Office (Immigration & Nationality Directorate).
What is not clear in this, however, is the extent to which these costs relate to identity fraud which actually occurs in the UK as opposed to overseas. Identity cards might, hypothetically, prevent someone obtaining a false identity in the country, but not a false identity and false papers overseas. Identity cards offer no protection against people entering the UK under false identities obtained in other countries, especially those outside Europe.
There costs are, again, of questionable relevance to the overall identity cards debate as even were they introduced, the Home Office would still incur costs in this area from investigating false identities obtained overseas.
Local authorities
£28,564
From an online poll of its members, LAIOG identified that £28,564 was specifically due to identity fraud. However, most LAIOG members contacted stated that as identity fraud was usually part of a larger fraud, it would not necessarily be recorded.
Hardly worth mentioning really, is it? 28 grand out of a headline figure of £1.7 billion, although if things drag on, watch this figure shoot up as LAIOG members sudden begin to find reasons to keep separate records of identity fraud.
Money laundering - £395m
The overall size of money laundered in the UK is not known currently but is believed to be substantial. This cannot be attributed to any single organisation.
No figures are available currently on the proportion of money laundering that relies on identity fraud. It is not possible to determine if the scale of this problem has changed since 2002. The figure from the original study has been included for illustrative purposes to help estimate any comparative changes to the overall cost of identity fraud since 2002.
Now we really are pulling numbers out of arses!
We don’t know how much money laundering is going on and we also don’t know how much of it relies on identity fraud, but we’ll chuck a figure of £395 million into the pot if it helps.
Total and utter bollocks!
Police Service - £1.73m
It is not possible to estimate the overall cost of identity fraud to the Police Service. However, figures show that last year Police Forces in England and Wales spent 15,000 to 20,000 days dealing with bogus callers – a crime that relies heavily on false identities.
Cost of £1.73m is based on Police Forces in England and Wales spending 17,500 days (midpoint of 15,000 – 20,000 days) at a daily cost of £99.19 (made up of £82.19 per day per officer and support costs of £17.00 per day per officer) to deal with bogus callers.
Again, I have to ask just what relevance this has to the debate on identity cards?
Unless people are going to be issued with personal card readers to check whether the guy at the door who says he’s the gasman really is the gasman, then this is of no relevance whatsoever – and even if that were to happen, that would only very who the person at the door is, not whether they are what they say they are in trying to gain entry.
Yet more headline cost inflation then
Telecommunications - £372m
Telecoms not included in 2002 study. The cost of identity-related fraud is a substantial component of the total fraud/revenue loss in the telecoms sector.
Again, we have another big number added to the total but with no detail against which to verify its credibility.
What are the telecoms companies classing, here, as identity fraud?
Is this figure based solely on people obtaining telecoms services – like mobile phones – solely by making fraudulent applications for contracts using a false identity or are the costs of use of lost, stolen and cloned mobiles also included here, in which case those are not case of identity fraud as it is not the identity of the user that has been ‘stolen’ but either the phone, itself, or the identity of the phone.
In either case this is, again, a situation in which identity cards would have no value in terms of either prevention or investigation.
UK Passport Service - £62.8m
The cost to UKPS of measures to counter identity fraud when processing applications for UK passports issued in the UK.
Again, these are operational costs that can only be assessed against the overall implementation and running costs of the identity cards and there, is, therefore, no guarantee of any cost savings on this figure
TOTAL - £1.72bn
Yeah, right!
Going back over the figures, we have a total of £114.35 million included in operational and enforcement costs (DVLA, DSA, Immigration, Police and Passports) against the Home Office’s own estimated running costs for identity cards of £584m per year – so already we’ve got near enough £470m to make up in order to break even and that’s just on running costs and takes no account of implementation costs.
As these are tangible costs which will not change on the introduction of identity cards, we can also exclude these from consideration in the true headline figure.
From the figures for Card Fraud we can deduct £234m - £150m in card not present fraud and £73m from fraud reductions arising from ‘chip and pin’ and I am not sure where mail non-receipt factors into this is it not clear whether this figure relates to fraud arising from cards stolen by mail interceptions or merely the costs incurred in replacing cards that are lost or stolen in the postal system – and if it is the latter, one cannot distinguish either between costs arising from theft and those arising from the simply lost of mail by the Post Office, but for now I’ll let that figure stand until I can find out more about what it specifically related to.
We can also take out, entirely, the figures from the Audit Commission on pension fraud – as this is a reporting and not an identity fraud (£15m), tax credits (£2.7m) as this is a one-off arising not only from identity theft but from weaknesses in their online application system and therefore in the same class as card not present fraud, MTIC fraud (£215m) and money laundering (£395m) as the figures are unreliable and these are primarily forms of business fraud in which it is entirely unclear how significant a role identity fraud plays and because identity cards will offer little or no value in this area.
That cuts £966m off the headline figure, reducing it to £754m, but let’s not forget, as well, that we also have £35.8m in costs from the DCA, relating to the collection of fines plus the £372m reported by the telecoms industry where it is now way clear how much of those figures relate to actual identity fraud as opposed to everything from clerical errors to the theft and/or cloning of mobile phones, where it is the identity of the phone and not the user that has been stolen. If we assume that only half of each of those represents costs arising from actual identity fraud – and that is being extremely generous in the case of the telecoms industry where I suspect the majority of the fraud they reported is based on lost, stolen or cloned mobiles, then that takes around another £204m out of the picture as being irrelevant when it comes to identity cards, bringing things down to a mere £550m.
Now lets take this £550m and assume that it may be ‘preventable fraud’ should identity cards be introduced.
However, very little of this fraud directly impacts on the public purse, only the £20m reported by the DWP has such a direct impact.
This leaves £530m affecting the private sector which, were it to be prevented, could be turned into profit which would then be taxable and generate income for the Exchequer. Of course things aren’t quite simple, first because under present corporation tax rates the maximum take for the Treasury from that £530m would be around 30%, if it were all to filter through as profit, giving a figure of £159m, but then there is no guarantee that all this money would go through as profit, some of it may be passed on to customers in cost reductions, some may end up being offset against losses, reinvested in capital equipment, stock and whole host of other things besides which reduce the amount of taxable profit arising from this scenario. Equally, that proportion which filtered down to customers in reduced costs and business improvements could serve to stimulate market growth and generate greater profits, not to mention increased revenue from VAT – one cannot predict exactly the impact this all might have in the market.
So, for the sake of argument, let’s assume that this all works out a zero sum deal in and stick with the idea that a £530m reduction in the annual costs of identity fraud to business, arising out of the introduction of ID cards, with generate something of the order of £160m in additional tax revenues across the board…
Oops… Whitehall, we have a problem!
Remember, its going to cost an estimated £584m a year to run the identity cards system, while the package of costs in this report relating to operation activity runs to about £114m, leaving the government to find an extra £470m to cover the running costs of the whole shebang – yet were assuming only an additional £160m is likely to come through in tax revenues from reductions in identity fraud arising from the use of ID cards and even that figure is by no means sound as one thing we haven’t done is factor in the costs to the business sector of making use of the government’s proposed identity verification services or, indeed, the full implementation costs of the system as a whole.
Nor have we factored in the costs of implementing and using identity cards for in areas where their main purpose is not to reduce or prevent fraud but merely to establish identity so as to, supposedly, improve efficiency, where it is much more difficult to establish clearly whether any potential cost savings are likely to offset implementation and running costs.
I’m no economist and I’m sure that even a moderately competent one could easily pick apart the assumptions I’m making here, but it does seem to me that on top of everything else that’s wrong with the whole identity cards scheme, from its impact on civil liberties and the relationship between the citizen and the state, to the question marks that exist in terms of the viability of the technology and the overall security of the system, there appears to be, even with the figures that the government is pushing to justify the scheme, a whacking great hole in the finances that the government is clearly unwilling and probably unable to account for – and I’ve not even mentioned the LSE’s analysis of potential costs to this point.
If you ask me, what we have here is a government with an extremely severe case of white elephantitis, for which the only effective cure would seem to be an elephant gun.