MANAGING FRAUD - HEI Services

MANAGING FRAUD
FIONA INNES
FRAUD MANAGER, SLC

Special Investigations Unit – (SIU)
Introduction
The Special Investigations unit consists of two teams, SIU and SIU2. Both are involved in
investigating suspected customer fraud relating to all parts of the application process from personal
information stated on the paper p form or online, to Childcare and Disabled Student Allowance claims.
The teams also deal with any residency issues which may be highlighted.
Size of the Team
The SIU has 8 permanent members of staff and one Manager. The Manager is also responsible for
SIU2 and this team also has 8 members of staff and one Team Leader.
Heather Laing, the Fraud Prevention & Detection Manager ,has overall responsibility for both Teams
and reports into the Company Secretary Chris Andrew.
Where are we
The teams are located within the Bothwell Street office in Glasgow – Contact details provided.

What do we do
• The teams are responsible for monitoring the
levels of fraud within the system and identifying
ways in which these levels can be kept to a
minimum.
• As part of the work undertaken the team use a
number of fraud prevention tools, reports and
pattern and trend analysis techniques to ensure
that we monitor the system and remove found
fraud.
• We also consult most areas of the Business
daily to discuss potential fraud cases and ways
in which fraud can be reduced.
• We are consulted as part of all new projects
which involve the application process and
potential fraud concerns are raised and are
taken into consideration when planning any new
implementations.

Fraud Prevention Tool – SIRA -
(Syndicated Intelligence for Risk Avoidance)
• SIRA is a fraud management system provided by Synectic Solutions. The system helps the SIU track
fraudulent applications within the Student Finance system by using a rules based search engine to
identify duplicate information such as Bank details, email addresses and Phone numbers.
• Rules have been applied to the database and all approved applications for Student Finance are run
against the Rules to determine if matches are present. Any matches are presented to the team in
batches depending on the Rules hit by the application. Examples of the worklists completed by the
team are, Matches to Fraud, Matches to Suspect, and Multiple Matches. The lists are prioritised and
worked accordingly.
• The system matches current year application data and enables the team to add suspect information
such as names and addresses of individuals who may apply for funding and who are not entitled to
receive it.
• Students applying for funding, and who have been approved, will appear on SIRA within 24 hours if
they match for any reason with other current students, or fraudulent students from previous academic
years.
The SIRA check is carried out after all other SLC checks are undertaken. These are listed on the
next page.

What checks are carried out as part of the Application
Process
SLC have a number of checks in place that help prevent fraud.
• Our primary method of identity verification is through the Identity and Passport
Service (IPS) link that uses the applicant’s passport number to verify the identity
details they have submitted.
•The applicant’s National Insurance Number (NINO) is also matched against DWP
records.
•The Verification of Household Income (VHI) checking service allows the income of the
students sponsor/s to be validated via HMRC.
• Once the application has been processed, the University’s s attendance confirmation
provides us with a further check to ensure that the individual is in attendance before
the instalments are paid.
The SIU receive any exception cases highlighted as part of the above checks.

SIU2
•What do we do
• In order that we could understand the value of funds that could be saved through enhancing
our fraud prevention and detection capability, SLC invested in membership of CIFAS and
National SIRA and a team of staff (SIU 2) to work the suspect fraud cases identified as a result
of this proactive work.
• The SIU2 has been in post for almost 18 months and has been a positive addition to the Fraud
Prevention work already undertaken by the Company by highlighting a number of high risk areas
and these are listed later in this presentation.

What’s National SIRA & CIFAS
National SIRA – (Syndicated Intelligence for Risk Avoidance)
National SIRA is an enhanced version of SIRA which is worked by the original SIU. National SIRA allows us to match
with all other external users of the service which widens our scope for preventing fraud as checking multiple
applications shows any inconsistencies with information being provided by individuals across a number of other
applications for finance. The system is Rules based which means each application is checked against a set of
questions and any positive matches are shown in batch format for staff to review. Examples of matches are, multiple
use of same, address, bank details, email addresses or telephone numbers.
CIFAS – (Credit Industry Fraud Avoidance Service)
As well as having access to the National SIRA data we are also linked into CIFAS. CIFAS is an organisation which
collates all fraud data from organisations such as Banks, Building Society’s, Insurance Company’s plus many other
financiali institutes. t The referrals from CIFAS will take priority it asthey include actual fraud cases, this means any
matches we have with this data will be due to the students having committed fraud against another organisation.
SLC were the first sizeable public sector organization to become members of CIFAS in September 2011.
Top 5 Referral Reasons
•The address has been used in connection with a fraud.
•The identity details have been used in connection with a fraud.
•The applicant and/or sponsor has provided false income details when applying for some form of credit (mortgages
and/or other loans).
•The bank details have been used in connection with a previous fraud.
•The telephone number and/or e-mail address have been used in connection with a previous fraud.

What kind of fraud do we see in SLC
• Eligibility
Identity fraud facilitated by false identity and residence documents.
Non attendance
• Entitlement
Sponsor claiming to be a lone parent when they are one of a couple;
Childcare grant fraud;
DSA grant fraud;
Sponsor’s income fraud;
• Diversion of payment facilitated by e.g. Phishing, smishing or vishing.

Case Studies
•Two examples have been given of the type of cases the team deal with, one relates to a mature
student and the other a student supported by a sponsor. Example one demonstrates how the
information from CIFAS can provide us with details about aliases used by students to apply for
different sources of funding. This can then be used to establish the true circumstances of the
application.
•Examplep
1 relates to a mature student who submitted a late application on 17th October for a course
that started 19th September 2011.
•This account has 13 CIFAS matches that relate to adverse credit and the use of aliases for the
purpose p of obtaining credit. The investigation established that the student has used various names
and addresses and that she had previous undeclared study from 2004 using one of the aliases that
was flagged by the CIFAS match. When questioned about a) marital status b) previous study and c)
using different names and addresses, the student provided false information to prove their
circumstances.
•Outcome –Current funding has been stopped, the details have been recorded on CIFAS, which could
impact on her future credit rating and she has been deemed unfit to receive any further student
funding.

Case Studies Continued
•Example two - A student has applied with a single sponsor, when indications are that
the sponsor has a partner and has made applications in the wider financial services
sector as one of a couple. Again, this gives us good reason to enquire into the true
circumstances of the application.
•Example 2 relates to a returning student under 25 who applied for funding on the basis
that she was supported by a single sponsor, her mother.
•This match was generated by National SIRA and relates to the household composition.
Applications for credit have been made at the address shared by the student and her
mother by an undeclared male, including a joint mortgage application. The investigation
established that both the student and her mother had made a false statement during the
application process.
•Outcome – The application has been reassessed to nil entitlement and the student has
been deemed unfit to receive any further funding.

Phishing
What is phishing
Phishing is the term given to a type of fraud which involves a third party emailing an individual pertaining to be
from an organisation when in fact they are not. The individual, believing the email to be genuine, verifies a number
of personal pieces of information which allows the third party to amend their online records and redirect money to
another bank accounts. The SIU track and monitor student accounts if they have been victims of this type of
incident, and are involved in the proactive measures put in place to combat further losses.
What have SLC done to prevent these attacks
• Enhanced our phishing site take down service.
• Review and removal of excessive customer
data held on online accounts.
• Active account monitoring for previously
affected and high risk accounts – together with
use of IP address searches.
• Customer text alerts introduced for students
whose bank account details have been
amended.
• Duplicate bank details reports monitored daily.
• Media outreach programme to warn students of the
phishing threat
• Outbound calling to students identified as being at risk
of payment diversion
• Use of existing fraud detection tools
• Contacting ti universities iti directly if there are specific
attacks against their students

Some Facts and Figures
The figures below show the savings generated by both Units in the last 12
months.
Savings
SIU £7,785,552.00
SIU2 £2,594,815.00
Analyst within SIU £3,199,540.00
Total £13,579,907.00
Th b fi l t t 2524 t d t h l titl d t St d t
The above figures relate to 2524 students who are no longer entitled to Student
Finance.

How does fraud happen
• Fraud generally occurs as a result of
a combination of factors.
• For many years, this has been
represented as the “Fraud triangle”
(right).
• Motivation – need or greed
• Opportunity – weak controls, poor
security, low likelihood of detection –
some people are honest, some
dishonest and some can be swayed.
• Rationalisation – most people obey
the law because they believe in it but
can rationalise fraud “ as a
victimless crime” or it’s just a fiddle,
not really acrime.
Motivation
Rationalisation
Opportunity

Summary of SLC’s anti fraud risk management approach
Key priorities:
Priority 1 – Build and apply knowledge and
collaborate with others to prevent and detect
fraud
Priority 2 – Achieve economic efficiency by
investing in SLC’s fraud prevention capability to
reduce the amount of student funding lost to fraud
Priority 3 – Develop an anti-fraud culture where
countering fraud is the responsibility of all those
involved in supporting and delivering the SFE
service
Priority 4 – Assess the risk of fraud and measure
the level of fraud within student funding
Pi Priority it 5 – Disrupt and punish fraudsters

What can you do
Whatever Department you working in, you can do your part to reduce the impact of fraud. You may not realise the part you can play
however do not underestimate your involvement in Fraud Prevention.
All members of staff and colleagues, have a duty to report suspicions of fraud, both internal and external, and raise concerns where
areas of weakness in procedures are identified.
HEI’s can get involved by reporting any irregularities you become aware of, particularly in relation to:
– Attendance; and
– Status
If staff have concerns with an application, or documentary evidence submitted as part of that application, details of the case should
be passed to the Special Investigations Unit by either emailing siu@slc.co.uk or calling us on 0141 243 3336.
If you receive a call from a student who has not received their expected funding on the payment date due, and the bank details have
been amended without the students consent ,calls should be put through to the phishing hotline on 0141 243 3583.
If a student has received an email asking them to verify their personal information be clicking on a link contained within the email
this should be passed to phishing@slc.co.uk

QUESTIONS