Criminals are using the dark web to scam millions of pounds in Universal Credit (UC).
Threat intelligence firm IntSights says it has identified multiple cybercriminals offering scamming lessons and tutorials for committing UC fraud.
“Cybercriminals have exploited the pandemic in many ways, one of which is the scamming of Universal Credit systems,” said Etay Maor, CSO at IntSights. “According to the chatter we have seen on the dark web, cybercriminals are utilising the DWP’s advanced loan system where individuals can apply for Universal Credit and within three days receive up to £1500. For cyber criminals, this is a low risk scam with a very high reward.”
UC is a consolidation of several services offered by the UK government, from income support to child tax credits and more. In the early weeks of lockdown, it was estimated that more than £1.5 billion had been lost due to UC fraud.
Maor says that in the past, scammers used to impersonate DWP officials and ask victims for their personal info. Today they can simply find that data on stolen and leaked databases, allowing for a faster, easier and safer process when creating synthetic IDs.
“Because of the success of the scam, we have seen cyber criminals now selling tutorials on how to defraud Universal Credit on the dark web, with some selling their expertise for £120,” he explains.
The victim’s details are stored on a database and marked as having received the funds. The risk here is that some individuals may eventually need these benefits and the advanced loan, but they will be unable to receive it because the system will indicate that they have already applied for and received the benefits.
“It is important to note that trying to monitor and authenticate every single individual applying for Universal Credit, particularly during the current climate, is easier said than done. Governments are under tremendous pressure to look after their citizens and provide money that supports and protects them. Having said that, more security checks and processes should be put in place to validate and authenticate those applying for benefits,” said Maor.
However, experts say that ID alone won’t solve the problem as it takes a number of data points to prevent exploitation – especially where money is being paid out.
Also, the UK isn’t alone in being targeted by unemployment scams. IntSights says cybercriminals are carrying out scams on Pandemic Unemployment Assistance (PUA), the United States’ federal aid for workers who have lost their jobs or been furloughed during the pandemic.
The company advises that as COVID-19 unemployment fraud spreads across various European countries like Germany, Switzerland, and France, individuals and companies should be aware of these type of scams and regularly check to see if their identity has been linked with a fraudulent claim.