Criminals exploited the cover of Covid-19 to use the “dark web” to commit fraud against local businesses, a top detective with the Bermuda Police Service has revealed.

Detective Superintendent Nicholas Pedro said fraud-related numbers during the lockdown were half what they were during the previous three years.

But he added: “What is starting to develop is usage of the dark web to purchase stolen credit card numbers and using those to purchase goods in Bermuda. The goods are sold onwards for cash to buy drugs and engage in other criminal activities.”

Detective Superintendent Pedro said the BPS is working with the Bermuda Banking Association and the Chamber of Commerce to “close some of the gaps that exist in the online purchasing environment, and the due diligence processes conducted by retailers and other companies in Bermuda.

“This type of fraud is certainly becoming more sophisticated than what we have seen in the past and we do recognise that this is directly linked to the pandemic.”

On the future of financial crime on the back of Covid-19, he added: “We see a new level of sophistication. With people staying at home, they have time to learn and be creative. People navigate the dark web and use encryption to disguise their identity to engage in criminality.

“It is a constant battle for us, but thankfully we have invested in a small, but capable digital forensics team and we are also supported by our partners in the US and the UK. They are well equipped to support these types of investigations.

“We have a budgetary challenge at the moment, and we are working with government to address this. We have responsibility to remain compliant with international standards and be able to deal with these types of cases on behalf of Bermuda.”

Detective Superintendent Pedro said work is being done to bring Bermuda into compliance with the Budapest Convention on Cybercrime, saying: “Some of the offences that will be created will address new means of committing fraud, certainly on the online side.”

He added: “Regarding the Bribery Act, we have had an increase in the number of bribery offences and due to Covid, a small number of cases went before the court.

“It is worth noting, that there still seems to be a lack of knowledge of the requirements set out in the Bribery Act.”

He and Rosalind Barbour, a senior manager in the advisory department of professional services firm KPMG, discussed issues related to fraud with Kateryna Kotelnikova, an assistant manager, KPMG advisory.

Ms Barbour said feedback from the KPMG network and the firm’s clients indicated “an increase in cyber fraud, payment fraud, credit card abuse and fraudulent mobile payments linked to the dark web, identity theft, and stealing personal data”.

She added: “With everybody now forced to stay home, online transacting has skyrocketed in terms of volume. The insurance and healthcare sectors have seen an increase in fraudulent claims for support schemes, whether it is work schemes being made available to the staff or benefits from governments.

“The volume and speed of fraud has increased globally as it is done electronically. This results in a reduction of paper or traditional audit trails and tracking becomes difficult. Businesses have to adjust their forms.”

Detective Superintendent Pedro said: “We have seen some evidence and in fact, we do have some cases under investigation relating to house price gouging and in the healthcare sector, so that is certainly something we are looking at.

“We are also observing increased fraudulent employment opportunities, mystery shopper scams, and high value gift cards.

“Also, compromised business e-mails, otherwise known as CEO scams, where official-looking e-mails are sent out requesting payment transfers. This seems to be a persistent problem in the local environment.

“Retailers are receiving fake Bermuda notes and investigating this is certainly high on our list.

“Money laundering continues to be another issue for us. We note greater interest from overseas jurisdictions since the amendment to the Proceeds of Crime Act in 2017, which made tax evasion a criminal act.”

In terms of risks going forward, Ms Barbour said “financial misconduct might be an increasing problem within the financial services, asset management, insurance, banking or any industry where people are rewarded based on performance.”

She added: “Businesses have to be vigilant in managing their performance-related incentive schemes.”

Detective Superintendent Pedro acknowledged that smaller businesses, in particular, face challenges in the areas of detecting and reporting fraud.

He said: “It might be challenging for smaller business to do regular audits to identify fraud issues like this, and there may well be some reluctance reporting this type of challenge. Unfortunately, many instances do not get reported to the Police.

“We know that there are unclaimed taxes, which need to be recouped by government and once we see government action in this regard, we may see increased fraud reporting.”

He provided advice about how businesses can protect against fraudulent activities: “We recommend the use of professional services to perform regular audits and look at their accounts to identify if actual fraud has taken place.”

The top detective added: “We recommend internal fraud controls for example, people are rotated regularly out of posts. When a person does go on vacation and someone else is doing their job that is usually a good opportunity to identify anything untoward.

“Fraud and other types of dishonesty could have been prevented or stopped had managers been more assertive in their management role.”

Ms Barbour also shared advice, saying: “The traditional approach to preventing and detecting fraud gives management the opportunity to understand what their risks are. Even if they are working with their brother or sister in a small business, it is important to acknowledge that risks exist.

“We understand that policies and procedures in a smaller environment would not necessarily be sophisticated, but the companies should definitely have documented process flows and authorisations in place.”

Ms Barbour added: “Effective communication can play a big role in the prevention and detection of fraud. Using hotlines or whistleblower lines is a very effective tool in the detection of a fraud incident.

“Key elements of fraud risk management are making sure that you enforce your policies and procedures, implement some form of investigation, take action and ensure employees have a way to report potential or actual fraud incidents.”

Detective Superintendent Pedro said anyone with concerns about tax fraud should contact the Office of the Tax Commissioner.

He said: “They can report to us, the BPS, but their first port of call should be the Tax Commissioner’s office and an inquiry, on whether or not payments have been made on their behalf.

“If there is a confirmation that companies have not been making the required payments, then the Tax Commissioner will refer the matter to us for an investigation.”

Ms Kotelnikova asked Mr Pedro if there is a process to follow for a company that wishes to report a possible financial crime or fraud to the BPS but would like to stay anonymous.

He replied: “If a company reports an issue, it is very important to have the evidence ready, whether it is digital or hard copy evidence.

“Internal investigations do help, but at the same time, we would like to be notified of the alleged crime as soon as possible. We would not want you to delay reporting something because you were collating and preparing evidence for reporting purposes.

“Reporting a crime sends a strong message to other people that might be contemplating engaging in similar activities.”

But he added: “In terms of anonymity, there are disclosure obligations and when the matter does go to court, that becomes a public record and unless there are compelling circumstances, it is usually very unlikely that a judge is going to allow the proceedings to be sealed.”

Ms Kotelnikova concluded: “Responding quickly and efficiently to alleged or suspected fraud and misconduct is critical.

“Given the increased risk, companies in Bermuda should assess fraud risks and make sure that they have an action plan that would help establish the facts and deal appropriately with potentially damaging and sensitive situations.”

To read the full transcript of the interview, see https://home.kpmg/bm/en/home/insights/2021/07/fraud-in-times-of-covid-19.html