Action Fraud, the UK’s Cybercrime reporting centre, has warned that fake TV licence payment scam emails have generated 5,247 complaints between 1st October and the end of December, with 1,983 complaints in December alone.

What Emails?

According to Action Fraud, the highly convincing scam involves sending people emails that use headlines such as “correct your licensing information” or “your TV licence expires today”.  In some cases, the email title and contents suggest that the recipient is eligible for a TV Licensing refund.  On opening the email, recipients are encouraged to click on a link to a fake version of the TV Licensing website.

When the victim visits the fake site, they are asked for their personal payment details – account number, sort code, and card verification value (CVV) code.

There have also been reports that victims who have submitted personal details to the fraudsters via the website are contacted a week or two later by the fraudsters who claim to be from the fraud department of the victim’s bank, claim that the victim’s bank account has been compromised, and ask the victim to transfer their money to a new, so-called ‘safe account’.

Some media reports put the amount of cash stolen by fraudsters using this scam in the region of £230,000+.

Official TV Licensing Never Email Customers Unprompted

The spate of fraudulent emails has prompted the real TV Licensing authority to confirm that they never email customers unprompted to ask for personal or payment details or to inform customers of eligibility to any refunds.

Real Glitch Last Year

Some of us may remember that a real security risk involving the genuine TV licensing website was identified back in September 2018 when an Infosec blogger noticed that Google Chrome was flagging the TV Licensing website as insecure.  The blogger estimated that as many as 130,000 people may have been affected by the breach.  TV Licensing then notified customers who accessed its website between 29th August and 5th September 2018 that their personal details may have been stolen but maintains that there was a very small risk of the information having been accessed. 

What Does This Mean For Your Business?

This latest scam is one of many convincing scams that use phishing to steal payment details and other personal information. Phishing is one of the most popular cybercrime methods.

Action Fraud advice for avoiding falling victim to this scam includes:

• Check the sender’s email address – does it look like one TV Licensing would use?
• Check the subject line and treat any requests such as “action required” or “security alert” with suspicion.
• Check the spelling and grammar, as grammatical errors are often signs of scam emails.
• Look at the style of the emails.  If it appears too familiar or casual, this could be a sign that it is a scam.
• Check where the link goes – is it the official TV Licensing website?  It is worth remembering that the official TV Licensing authority never emails customers unprompted to ask for personal or payment details.

If you think that you may have fallen victim to this scam, the advice is to report it to Action Fraud by calling 0300 123 2040 or report it through the website here: https://www.actionfraud.police.uk/report-phishing.

Ways to help protect your company against the threat of phishing attacks include education and training of staff to help them spot and deal with phishing, and even using phishing attack simulator tools (such as ‘Attack Simulator’ in Office 365) to help sharpen your organisation’s defences.

The UK’s fraud reporting service, Action Fraud, has reported that contactless card fraud doubled in 2018 to £1.8m stolen compared with £711,000 in 2017.

Average Theft Amount Increased

The latest Action Fraud figures have also revealed that the average theft through contactless fraud in 2018 rose to was £657, compared with £493 in 2017.

Back in February 2017, figures from UK Finance showed that contactless card fraud had already overtaken cheque fraud, prompting finance experts to warn banks against raising the £30 limit for payments, to avoid incentivising more criminals to steal them.

Contactless Technology

Contactless cards incorporate a special chip that can be read quickly and easily by a payment terminal (without making direct contact), meaning that entering a PIN is not necessary, thereby speeding up transactions.

How Can Hundreds Be Stolen? I Thought It Was Only Up To £30?

Current rules mean that only payments of up to £30 can be made using contactless technology, and as such, many of the contactless thefts have involved the thieves taking multiple small amounts using the same card so that users don’t notice immediately.

Why The Doubling of Contactless Card Fraud?

Many commentators believe that the simple fact that contactless is overtaking chip and PIN as the most popular way of paying for goods and services now, and that a PIN is not required to use a stolen card are the main reasons why contactless card fraud levels have soared.

Worldpay figures, for example, show that more card payments were made using contactless technology than chip and PIN in the UK over the year from June 2017 to June 2018, and that after increasing by 30% on the previous year, contactless payments are now the most used card payments in shops.  Yolt figures show that 76% of Britons have used contactless payments, and 40% make half or more of their card payments using contactless.

Secure?

Even though UK Finance, the body which represents many banks, is quick to point out that no contactless fraud has been recorded on cards still in the possession of the original owner, contactless cards have robust security features built-in, and that customers are fully protected against any losses from contactless card fraud, the Action Fraud figures still appear to show a security problem.

This problem has not gone unnoticed by consumers.  For example, even though many of us are now used to having and using contactless technology, MoneySuperMarket research from as recently as last September showed that 55% of those surveyed had concerns about the security of tap-and-go technology.

What Does This Mean For Your Business?

For businesses, contactless payments offer the chance to reduce the cost and hassle of having to handle cash, cut queues, increase the speed and hopefully the frequency of transactions (increase footfall), increase average transaction values (ATV), provide a clear audit trail and assured payment, and even (for some types of businesses) the chance to change to better business models e.g. card / contactless only cafes and bars in cities.  For customers, contactless offers a better, more convenient and faster retail experience for the majority of their purchases (£30 and under), which in turn has a positive rub-off value for retailers.

The prevailing trend in developed countries is a move away from cash to cards, and particularly contactless. For example, UK Finance projects that in Britain cash will be used in just one-fifth of all sales by 2026, and Paymentsense has reported the removal of 4,735 cash machines in the last year.

Even though customers may be protected (i.e. re-reimbursed later) if their card is stolen and used by fraudsters, it is still an unpleasant experience to have money removed from their account that can cause financial hardship in the short term and can affect their ability to pay important bills and could have a negative impact on their credit rating.  The Action Fraud figures appear to show, therefore,  that there is a growing problem with contactless card fraud that banks are not yet fully tackling.

On 3rd December, Skype announced that it was celebrating United Nations International Day of Persons with Disabilities by launching its new call captioning with live captions and subtitles feature.

Inclusivity & Accessibility

Skype says that this latest feature, which uses AI-driven captions, is part of its on-going work to make Skype more inclusive and make Skype calls more accessible to all.

How Does It Work?

The new live captions and subtitles feature works on a call-by-call basis through the in-call screen or can be set to activate by default under Settings > Calling > Call Subtitles > then toggle ‘Show Subtitles’ for all voice and video calls.

The feature works on the latest version of Skype for one-on-one calls with friends or co-workers, or to any phone number, as well as in group calls with a work team or friend group.

Currently, the captions and subtitles auto-scroll in your call, but Skype says that it will soon enable additional viewing options, including the ability to scroll through them in their own side window.

Skype says that the captions and subtitles will be optimised to be fast, continuous, and contextually updated as people speak.

Translations Into 20 Languages

Skype also says that in the coming weeks, it will be augmenting the live captions and subtitles feature further by releasing translations that support over 20 languages and dialects.

Microsoft – Introducing Captions and Subtitles For PowerPoint Presentations

Microsoft, which owns Skype, announced that as part of the same celebration of the United Nations International Day of Persons with Disabilities, it is introducing AI-powered captions and subtitles for presentations in real-time for PowerPoint.

Many Languages Too

Microsoft also announced at the launch, that the live captions and subtitles for PowerPoint will support 12 spoken languages and display on-screen captions or subtitles in one of 60+ languages.

Features

Live captions and subtitles in PowerPoint will use AI, automatically adaptive speech recognition based on the presented content for more accurate recognition of names and specialised terminology, and the ability for presenters to easily customise the size, position, and appearance of subtitles.

What Does This Mean For Your Business?

AI is the technology at the heart of these new features, and Microsoft is finding ways to utilise the technology to create many different value-adding and differentiating benefits to its services.

Accessibility is an important consideration and point of compliance for businesses, and these new AI-powered features can help businesses to communicate and present information in a more inclusive, accessible and engaging way.

Microsoft has emphasised that the new captions and subtitles feature joins many other accessibility features that it has introduced to Office 365, such as automatic suggestions for alt-text in Word and PowerPoint, expanded availability of automatic closed captions and searchable transcripts for videos in Microsoft Stream, plus enhancements to the Office 365 Accessibility Checker.

The fact that Human rights group Liberty has won the right for a judicial review into the Investigatory Powers Act 2016 could mean a legal challenge in the high court as soon as next year.

The Investigatory Powers Act

The Investigatory Powers Act 2016 (also known as the ‘Snooper’s Charter’) became law in the UK November 2016. It was designed to extend the reach of state surveillance and requires web and phone companies (by law) to store everyone’s web browsing histories for 12 months and to give the police, security services and official agencies unprecedented access to that data. The Charter also means that security services, government agencies and police can hack into computers and phones and collect communications data in bulk, and that judges can sign off police requests to view journalists’ call and web records.

Long Time Coming

Liberty was given the general go-ahead by the UK High Court to make a legal challenge against the Investigatory Powers Act in July 2017 and was enabled to do so with the help of £50,000 of crowdfunding raised via CrowdJustice.

Also, Liberty’s challenge is thought to have been helped by the European Court of Justice (in a separate case, represented by Liberty lawyers back in 2016) ruling that the same powers in the old the UK state surveillance law the ‘Data Retention and Investigatory Powers Act’ (DRIPA) were unlawful, and by a ruling by the court of appeal in January 2018 also finding the same thing.

The UK government was, therefore, given until July 2018 to amend or re-write powers to require phone and internet companies to retain data on the UK population.

Part 4 of the Act

The most recent High Court ruling on 29th November gives Liberty the right to a judicial review on part 4 of the Investigatory Powers Act.  This is the part which gives many government agencies powers to collect electronic communications and records of internet use, in bulk, without reason for suspicion.

Concerns About GCHQ’s Hacking

Human rights groups and even Parliament’s Intelligence and Security Committee have become particularly concerned about an apparent shift towards the use of hacking of computer systems, networks and mobile phones for information gathering by intelligence services such as GCHQ in projects such as the ‘Computer Network Scaling’ programme.

What Does This Mean For Your Business?

The UK’s ability to spot and foil potential plots is vital. Although the Investigatory Powers Act may include measures that could help with that, many people and businesses (communications companies, social media, web companies) are still uneasy with the extent of the legislation and what it forces companies to do, how necessary it is, and what effect it will have on businesses publicly known to be snooping on their customers on behalf of the state. The 200,000+ signatures on a petition calling for the repeal of the Investigatory Powers Act after it became law, and the £50,000 crowdfunding raised from the public in less than a week to challenge parts of the Act in the courts, both emphasise the fact that UK citizens value their privacy and take the issues of privacy and data security very seriously.

Liberty is essentially arguing for what it sees as a more proportionate surveillance regime that can better balance public safety with respect for privacy. The government initially believed that this level of surveillance was necessary to counter terrorist groups and threats posed to safety and democracy by other states, but successive legal challenges by Liberty have seen them give some ground. According to the Intelligence and Security Committee, GCHQ is running a project that aims to improve the way that it complies with the Act, and MI5 has also said that it trying to operate more compliantly.  As for any additional oversight of government orders to internet and phone companies, this is estimated to be running about a year behind schedule with IT problems being blamed for the delay.

ICO head Elizabeth Dunham is reported to have launched a formal investigation into how police forces use facial recognition technology (FRT) after high failure rates, misidentifications and worries about legality, bias, and privacy.

Concerns Expressed In Blog Post In May

In a blog post on the ICO website back in May, Elizabeth Dunham expressed several concerns about how FRT was being operated and managed. For example, although she acknowledged that there may be significant public safety benefits from using FRT, Elizabeth Dunham highlighted concerns about:

• A possible lack of transparency in FRT’s use by police and how there is a real risk that the public safety benefits derived from the use of FRT will not be gained if public trust is not addressed.
• The absence of national level co-ordination in assessing the privacy risks and a comprehensive governance framework to oversee FRT deployment.  This has since been addressed to an extent by an oversight panel, and by the appointment of a National Police Chiefs Council (NPCC) lead for the governance of the use of FRT technology in public spaces.
• The use and retaining of images captured using FRT.
• The need for clear evidence to demonstrate that the use of FRT in public spaces is effective in resolving the problem that it aims to address, and that it is no more intrusive than other methods.

Commissioner Dunham said that that legal action would be taken if the Home Office did not address her concerns.

Notting Hill Carnival & Football Events in South Wales

Back in May 2017, South Wales and Gwent Police forces announced that it would be running a trial of ‘real-time’ facial recognition technology on Champions League final day in Cardiff. In June, the trial of FRT at the final was criticised for costing £177,000 and yet only resulted in one arrest of a local man whose arrest was unconnected.

Also, after trials of FRT at the 2016 and 2017 Notting Hill Carnivals, Police faced criticism that it was ineffective, racially discriminatory, and confused men with women.

Research

Recent research by the University of Cardiff, which examined the use of the technology across a number of sporting and entertainment events in Cardiff for over a year, including the UEFA Champion’s League Final and the Autumn Rugby Internationals found that for 68% of submissions made by police officers in the Identify mode, the image had too low a quality for the system to work. Also, the research found that the locate mode of the FRT system couldn’t correctly identify a person of interest for 76% of the time.

What Does This Mean For Your Business?

Businesses use CCTV for monitoring and security purposes, and most businesses are aware of the privacy and legal compliance aspects (GDPR) of using the system and how /where the images are managed and stored.

As a society, we are also used to being under surveillance by CCTV systems, which can have real value in helping to deter criminal activity, locate and catch perpetrators, and provide evidence for arrests and trials. It is also relatively common for CCTV systems to fail to provide good quality images and / or to be ineffective at clearly identifying persons and events.

With the much more advanced facial recognition technology used by police e.g. at public events, there does appear to be some evidence that it has not yet achieved the effectiveness that was hoped for, may not have justified the costs, and that concerns about public privacy may be valid to the point that the ICO deems it necessary to launch a formal and ongoing investigation.