Online Scams: Consumer Protection

Nusrat Ghani Excerpts

Wednesday 28th April 2021 Westminster Hall

[Ms Nusrat Ghani (in the Chair)]

I remind hon. Members that there have been some changes to normal practice in order to support the new hybrid arrangements. Members need to clean their spaces before they use them and before they leave the room. I also remind Members that Mr Speaker has stated that masks should be worn in Westminster Hall throughout the debate.

[Ruth Edwards (Rushcliffe) (Con)]

I beg to move,

That this House has considered protecting consumers from online scams.

It is a pleasure to serve under your chairmanship, Ms Ghani.

Last year, my constituents Mr and Mrs Biggs came to see me at one of my constituency surgeries. They were asking for my help because scammers had stolen £30,000 of their savings. How had that happened? Well, a friend of theirs had spotted an advert on Google for a bond that, when compared with other products on the market, seemed to offer a reasonable rate of return over a three-year period. They called the telephone line provided to discuss the product further. The bond was being offered by a reputable firm, Goldman Sachs, and it was advertised on Google, which presumably had done its due diligence before accepting the advert, so my constituents invested. Only it was not Goldman Sachs that they had invested with, and the bond did not exist. Instead, Mr and Mrs Biggs, like many people up and down the country, had become victims of a very convincing clone scam. They had transferred £30,000 into the bank account of the perpetrators of that scam.

Clone scams exploit people’s trust in reputable brands by carefully mimicking their websites and online presence and even researching and impersonating their sales managers. When they also carry the stamp of an advert, be that on Google, Facebook or any other online platform, many consumers believe that the platform carrying the advert has checked out the company that posted it and that therefore it is an official advert from the company in question. But the truth is that that is rarely the case, because online platforms currently have no legal obligations to protect users against fake or fraudulent content, and that is the primary issue that I would like to address in the debate today.

In the last 18 months, we have been living through a public health emergency, but the pandemic has also had a really profound effect on the way adversaries operate online. We have seen everything: nation state espionage on vaccine programmes, the spread of misinformation and a huge increase in online scams. We have seen fake personal protective equipment, and phishing sites posing as councils giving out covid grants, or sending fake messages about parcel deliveries to try to download software on to victims’ phones or to direct them to give their bank details to scammers. It shows how sophisticated the world of online scams has become, how fast criminals can adapt to new situations and how easy it is for people to be taken in.

Action Fraud figures show that, in the year to June 2020, 85% of all fraud was cyber-enabled. Reports of clone scams increased by nearly 30% between March and April—just in the space of a month—last year. Victims lost more than £78 million to clone scams in 2020. It is hard to put those sorts of figures in the context of individuals, but the average loss for victims is about £45,000. That could be the deposit for someone’s home, the money that they were saving to start their own business or expand it, or savings for retirement or to pass on to their children. But it is gone, and often with no compensation.

Fortunately, in the end, my constituents, Mr and Mrs Biggs, were compensated. That was not without a fight and the resulting stress and anxiety. Many other victims are not compensated. In 2018, The Telegraph, which has done some really excellent work on this issue, reported that, in the previous year, only 25% of the funds lost to authorised push payment or APP scams, in which the victim transfers money to the bank account of the criminal, were successfully returned to victims.

These figures are shocking, before we even take into account the immense psychological and emotional toll on victims and their families. Scammers take advantage of people’s fears, hopes and anxieties, and they motivate them to transfer large sums of money on this basis. Anyone who has helped a victim of these crimes knows how heart-wrenching the ordeal is for them. The feeling of anxiety and powerlessness experienced when pleading with banks and law enforcement to help recover life savings is a tremendous unseen harm caused by online scams.

Recent analysis by consumer champion Which? found that there are 300 to 350 fraud reports every week in which victims show signs of severe emotional distress. One such account from Which? details the case of an 80-year-old gentleman who could not sleep for weeks after losing his retirement savings to scammers. The person behind the scam pretended to be a real investment company, assuming the name of a real investment manager at that company, and ultimately stole £50,000 from the victim, even after he checked their credentials online.

This scam, like the others I have mentioned, began as an advert at the top of Google’s search results. TV, print and radio advertising are all governed by a comprehensive set of rules, yet very little exists to govern online advertising. The majority of people now go online to research and buy everything, from pensions to pet food, holidays to houses, shoes to savings products, but it is for each individual platform to decide what, if any, verification checks it wants to make on businesses taking out adverts on its service.

I do not mean to imply that platforms are doing nothing. Following ongoing discussions with the Financial Conduct Authority, Google, for example, has updated its financial services policy to make financial services advertisers subject to its business operations verification process. I followed the link that Google provided in its letter to the FCA to understand more about what the verification process entails. The policy states:

“Advertisers may be selected to complete business operations verification if, for example, the advertising behavior has been identified as unclear or their ad content is deemed as potentially misleading.

Advertisers whose accounts were suspended due to a violation of our Google Ads policies may also be requested to undergo business operations verification as part of the account suspension appeals and remediation process.

Advertisers who are required to complete business operations verification will be notified and given 21 days to submit the verification form. In certain circumstances, we may pause advertisers’ accounts immediately when business operations verification is initiated. This means that advertisers’ ads will not be able to serve until they are able to complete the program successfully.

Advertiser accounts may be paused if the advertiser’s business model is unclear and we suspect that their advertising or business practices may cause physical or monetary harm to users. Non-exhaustive examples include: misrepresenting yourself in your ad content; offering financial products or services under false pretences; or offering unauthorized customer support services on behalf of third parties.

Once the verification form is completed and reviewed by Google, advertiser’s accounts that do not meet the requirements of this verification program outlined below will be suspended with a 7 day notice period. Note that if any further clarification or information submitted to Google during this 7 day notice period is insufficient to verify the account, Google may suspend the account immediately.”

So, Google “may” carry out checks, or they may not. They “may” pause the adverts at the start of the verification process, or they may not. Advertisers “may” get 21 days leeway before proper checks are completed. Advertisers found not to meet the requirements of the verification process will have seven days to provide further information to verify the account. If they cannot provide that, Google “may” decide to suspend the account immediately, but presumably they also may not. I know politicians are often accused of using non-committal language and trying to evade a straight answer, but this is a masterclass. It might be time that we in this place send the strong signal that that approach is not enough to protect our constituents, who are definitely being scammed out of their life savings.

If a verification process is to be effective, it needs to take place before any adverts are served. Leaving them up for 21 days while checks are completed provides a free-for-all for scammers. An experiment undertaken last year by Which? shows why. It created a fake water brand, Remedii, and an accompanying online service offering pseudo health and hydration advice, called Natural Hydration. It advertised both using Facebook and Google. Which? reported that

“With barely any checking, Google promoted ads for our website and fake mineral water to users who searched for popular terms, such as ‘bottled water’. Our ads gained nearly 100,000 impressions over a month.”

That shows how fast fake ads can reach a wide audience. A lot of damage can be done in 21 days.

Just this week, in a user survey published by Which?, a third of victims who reported a fraudulent ad on Google said that the advert was not taken down by the search engine, while a quarter of victims who reported an advert on Facebook that resulted in them being scammed said the advert was not removed by the social media site. Those companies earn billions of pounds from advertising. Yesterday, Google’s parent company, Alphabet, reported record results, with a 163% increase in profits. Alphabet’s executives have attributed that rise to an increase in people using Google’s online services and interacting with their online adverts. I do not think it unreasonable to require those companies to spend some of their money on helping to protect people from the harm caused by fraudulent adverts, especially given that adverts are targeted at users based on their recent web activity and behaviour. Fraudulent ads, based on a user’s interests or concerns, are effectively pushed towards them by online platforms, which act as enablers for the scammers.

I will briefly tackle the issue of compensation for victims, which is, at the moment, a minefield. In my constituency, I have seen cases involving victims who have found it incredibly difficult to make their claim heard by their bank, prolonging the painful battle to recoup their losses. Those people are forced into a position in which the odds of a successful outcome are low, and they often emerge at the other end with a growing distrust for our regulatory system.

The Financial Ombudsman Service website puts it very clearly:

“When it comes to payments that customers have authorised themselves, the starting point at law is that their bank won’t be liable for the customer’s loss, even when it’s the result of a scam.”

We might say, “Fair enough. It is not the bank that’s at fault. They are merely acting on the instructions of their customer.” What about the companies who expose users to those fraudulent ads, however? Those companies actually target the adverts at users based on their interests, and make billions from doing so. Are we honestly saying they should have no liability, and that there should be no redress for users who are targeted with ads placed by criminals? How can that be fair?

We urgently need to tackle the issue of online financial harms. I asked the Home Secretary about this matter when she gave evidence to the Home Affairs Committee. She said:

“We are actually doing some work right now through the economic crime board that I chair with the Chancellor—I chaired it just last week. If you speak to many financial regulators and to the financial services sector, they are equally concerned about this. One of the key outcomes that we are now discussing and picking up across Government is: how are we going to make the online harms Bill much stronger, and how are we going to tackle many of these online advertising platforms that come up through search engines, social media and other forms of electronic communications?

We still have a way to go, but what I can say—and I am very grateful to colleagues in the Treasury on this as well—is that the level of focus and attention to this issue definitely means that it will be given a huge push, a significant push, because, quite frankly, economic crime is now becoming one of the most predominant challenges when it comes to law enforcement but also criminality.”

I could not agree with her more.

I would be grateful for an update from the Minister on how the Government propose to tackle the issue. Will financial harms become part of the online harms Bill as the FCA, the Financial Services Compensation Scheme and Which? are asking for it to be? If not, will she set out what they plan to do instead? In either case, can she go any further towards providing a timetable for action?

We have a really urgent problem affecting thousands of people every year. We must sort it quickly. I am confident that we can, because I know from knocking around the cyber-security industry for most of the past decade that the UK has always been a global leader in cyber-security and tackling cyber-crime. I have seen our strategy grow, mature and evolve as the threat has. Fraudulent online adverts are a real threat to all our constituents. It is not on the horizon; it is here already, and it has been for several years. The alarm bells are sounding, and the problem is growing, so let us grip it now and offer our constituents the protection they all deserve.