"Understanding the Reality of Fraud Victimisation" - Cassandra Cross

we are very pleased to introduce our next speaker dr cassandra cross this is her first time speaking at b science hopefully not her last time and her talk is on understanding the reality of fraud victimization so let's all welcome cassandra to the stage of the big round of applause all right good morning everyone how are we feeling this is this is quite exciting to be in a room with actual people and despite the fact all these bright lights means i can't see you it's just exciting to have people in three dimensions um shout out to all my fellow queenslanders who had that mild panic attack that i had just before easter when we had the snap

lockdown in brisbane so didn't think that this would be a reality but it's it's really nice to be here in person i'm thankful for the opportunity to come i'm thankful that i'm not presenting with my laptop on an ironing board at 2am in my lounge room which is what i've been doing quite recently so today i'm here to talk about fraud victimization um this is an area that i've been in for a while i'm currently a senior research fellow with the cyber security cooperative research centre i'm also an associate professor in the school of justice at qut and i first started researching fraud back in 2008 so it's been a it's been a while sadly

it hasn't gotten better it's gotten worse if anything um today i'm not here to give a technical talk um but what i am here to do is share with you some of the insights from the research that i've done and hopefully get you to think about this topic in perhaps a different way if there's one thing that you can hopefully take from it it's just the understanding of what fraud actually is what fraud victimization the reality of it i guess given in the title and to maybe get you to think about it slightly differently so firstly i do want to acknowledge the traditional owners on the land and where we meet today i also acknowledge the traditional

owners the younger and terrible people where i live and work up in brisbane i'm not going to ask for a show of hands partially because i can't see you but how many people have received kind of fraudulent emails in their inboxes i'd imagine pretty well everyone in the room has received some type of fraudulent emails to listening funds soliciting personal information soliciting all types of things um they vary around the types of approaches i'll talk about it a few slides time but in terms of one to ten levels of outrageousness this is probably one of my favorites so this one um it's from the early 2000s but it surfaced again around 2016 and it's about the nigerian astronaut

who is stuck in space and requires three million dollars in order to get home has been stuck in space for about 14 years and needs need some money to come home so i mean this is clearly not true this is quite a outrageous ridiculous type of email i'm sure there probably were some people that did respond to this whether um in seriousness or whether in jest i'm not sure how much money was made of this particular approach but when we think about fraudulent emails when we think about scams we generally think about kind of the outrageous ones we think about the nigerian prince who became a nigerian astronaut but i guess what i want to talk about

today is the fact that that's not actually the reality for many individuals these aren't the responses these aren't the approaches that many people respond to they're in fact a lot more nuanced a lot more sophisticated and a lot more complex so in terms of fraud just quick definition it's all about financial advantage it's all about an offender being able to gain a financial advantage through lying through cheating through deception and i guess that at the core of fraud it's about getting people to send money under circumstances that they wouldn't ordinarily send it so one of the challenges with fraud victimization is that victims are active participants so they are transferring money they are responding to emails they

are sending personal information but i guess my counter to that is that they're doing it under under false pretenses they wouldn't ordinarily do it if they knew the truth if we think about fraud there's so many different ways to perpetrate it i will cover a few of them the financial advantage is usually through a direct monetary transfer but it can also be around personal information everyone in this room knows how important personal credentials are and what they can be used for in order to gain other lines of credit if we think about categories of fraud i've argued in some of my research that there's endless plot lines so offenders are really innovative they're really creative

persons and they can use anything any type of approach in order to craft something in order to try and target someone so unsurprisingly in 2020 we saw a lot of covid 19 related frauds and scans um earlier this year when australia started the vaccine rollout i know that that's a hot topic for today but when that first started back in march um automatically we saw immediately sorry we saw approaches where there were emails going out to people telling them they had to pay money in order to jump a cue in order to get a vaccine so offenders will use any circumstance possible early 2020 i was writing about bushfires and and the the frauds that were related

to that and i very quickly kind of transitioned defenders very quickly transitioned to covert 19 in march 2020 and whatever's coming up in 2021 i don't want to jinx it but whatever is coming up the rest of this year offenders will be on top of that as well but despite the variety of the approaches there will always be a request for money or personal information i mean that's the essence of fraud that's why offenders do it they're doing it for that financial advantage and the most common categories are around advanced fee fraud many of you may have heard that term it's essentially when someone's asked to send a small amount of money for a larger amount in return

it's quite often around lotteries around investments around inheritances romance fraud is when offenders use the guides of a legitimate relationship i've done a lot of work in this space i'm currently analyzing three and a half thousand reports from scamwatch around romance fraud victimization for me it's the saddest type of victimization because it really it plays at the core of who we are as humans around our desire to connect and have relationships and it's it's difficult for individuals to not only greet the financial losses but to grieve that loss of a relationship and the betrayal and violation that goes along with that and then business email compromise is one that's kind of jumped to the list in terms of the

highest financial advantage here in australia sorry highest financial losses in australia and essentially it uses established relationships between businesses and individuals and business colleagues in order to gain that financial advantage so it's where our offenders impersonate ceos companies suppliers in order to get the money if we think about fraud statistics it's billions of dollars that are lost every year and i don't think everyone really recognizes that or we don't really our response to it isn't commensurate with the amount of money that is actually lost so up here is some stats from 2019 um there's no official stats for 2020 as of yet but the anecdotal evidence suggests that cyber crime skyrocketed in 2020 unsurprisingly we were all at home we

were all on our computers we were living our lives virtually even more so than we do in everyday life so australia 2019 634 million dollars was reported lost and given that we know reporting is quite low we know that it's generally less than a third um is reported that's a phenomenal amount u.s was three and a half billion dollars the internet crime complaint center reported that which is huge um it's not a western problem it's not just um australia us uk canada um hong kong police intercepted um hong kong three billion dollars in terms of cyber crime and fraud in 2019 and there i guess what i've mentioned around this is it's not just the

financial losses but fraud is so much more and this this statistic only captures a small minority of actual losses this is kind of my snapshot fraud 101 five key points that we know about fraud as i've already mentioned we know it has a very low reporting rate we know that the majority of victims will not report to police or any other third parties that they may not know that they're victims they may be too ashamed and embarrassed to acknowledge that they're victims they don't see any point in reporting they don't think they'll get their money back i have no doubt in this room that there are many of you who have lost money who have been victims of fraud

and it's it's very difficult in terms of reporting to get that accurate statistic we do know that victims have great difficulty in seeking access to what's termed the fraud justice network so in terms of fraud there's more than one agency you can report to police are obviously one of them but you can go to banks you can go to consumer protection agencies you can go to a range of government non-government services and it's very difficult for individuals to navigate that network because there is kind of a lack of responsibility there's a lack of direction there's a lack of ownership in the area and victims will talk about being passed from one agency to another agency to a third agency and still not

be able to actually lodge an incident actually lodge a complaint we do know that there's a large degree of shame and stigma associated with fraud a lot of my research with victims this has been very prominent many of the victims that i've spoken to and i've been fortunate enough to probably speak to over 200 victims in the last 10 years for different projects that i've done there is such a degree of shame associated with victimization this this guilt around having been deceived having sent money having not realized it and that's a challenge because offenders are really good at what they do nobody wakes up in the morning and thinks hey i'm going to become a victim of

fraud today and i think we expect sometimes that there's these neon flashing lights over all the fraudulent approaches and people should have seen it coming and in reality that's just not the case as i've already mentioned we know the impact of fraud is far greater than monetary losses so victims of fraud we'll talk about decline in physical health emotional well-being varying levels of depression relationship breakdown unemployment homelessness there was one lady i spoke to a number of years ago she was living out of her car for three months because she'd lost all of her money her son had disowned her and she had nowhere else to go extreme levels victims will contemplate or commit suicide and there

are many victims that we know globally who have taken their lives in response to this and this is me on my little soapbox but this is so frustrating there are so many people out there that are suffering that are suffering devastating losses and we just don't acknowledge it we don't acknowledge this as an issue and we don't talk about it constructively which leads to the last point that fraud is not really a priority of any policing agency i've written a lot about this i could do a different talk about this um it's not necessarily their fault i don't think we can lay any blame at the feet of any police agency but in terms of policing priorities and

political priorities fraud has never really been on the top five if we think about the current state of fraud it is a high volume crime and it can vary in value so offenders can sometimes just get small amounts from a lot of people i mean if i got the credit card details of everyone in this room and you all even gave me five dollars i could get a nice dinner i could have a good night out but it does go through to high financial losses um i've spoken to a couple who lost three and a half million dollars from an investment scheme i mean that's a ridiculous amount of money and i can't even fathom having

three and a half million dollars to lose but there are victims out there that lose substantial amounts of money and that's that's life-changing um a large amount is perpetrated online and certainly the online environment has enabled fraud to flourish it's enabled a lot of cyber crimes crimes um to to flourish um but it's not just online there's still a large number of fraud that happens over telephone land lines for those of you that remember what a landline is there are some people that still have them and offenders are using them um text messages social media platforms any any means of communication can be used by offenders we know that policing a fraud is ineffective and unsatisfactory

and that's clearly the case from victims and those trying to access the fraud justice network but it's equally on the part of police and other agencies so i've been able to do many interviews with law enforcement and others here in australia but also overseas in canada and the united kingdom and there's such a level of almost despair from a number of um agencies around seeing the problem wanting to do something but not being able to do it based on the system that we're currently in there is a strong focus on prevention and that's good i mean ideally we would stop people sending money because that would that would solve a lot of issues but the

reality is that there will always be fraud victims there will always be people that lose money and we can't ignore or deny that and i think a lot of my work hopefully is trying to improve that response it's acknowledging the fact there will always be victims and we need to do better and i think one of the challenges with that is that offenders are invisible they're faceless we don't know who they are we don't see them we can't point a finger at them we can't address them prosecute them but the victims they're right here with us so instead we lay blame on them in terms of the stereotype of who a victim is i'm sure there are many of you

in this room who maybe have some thoughts around that around who you think is a a stereotypical fraud victim there is this notion that they're older persons that older persons are more vulnerable and and more likely to be victims and there certainly is a stereotype that victims are greedy gullible uneducated and that they somewhat deserve what happens to them i would argue very strongly that both are not founded in research and they're certainly not founded across the work that i've done i would argue that all the victims are attractive targets so if you think about the goal of offenders it's around finances older people generally have savings they have access to superannuation um they generally own

their own homes and assets they have good credit ratings they're attractive whereas myself i'm younger i have a mortgage which hopefully i'll pay off at some point i may have some life savings but i'm probably not as financially attractive as an older person so it i think it does open them up to that vulnerability but it doesn't necessarily mean they're more likely to be victims and we just need to recognize that offenders are highly skilled tech savvy individuals that can manipulate victims we need to put the onus on the individuals perpetrating this and i'll come back to this later if we look at what we know the actual statistics around victimization the most likely person to be a victim is

is anybody it's around being an individual being a human that's what makes you vulnerable to fraud and that's not really useful and i get the when i get asked from police when i get asked from banks who should we be targeting and i say everybody they don't really like that response so all persons have a vulnerability or a weakness that if targeted in the right way at the right time means that they could be a victim of fraud and that's everybody in this room myself included everyone in this room has a vulnerability that could make them more susceptible to a fraudulent approach it won't be the same i'd hazard a guess that the technical expertise in this room

is phenomenal i don't have that but there will be other weaknesses and vulnerabilities that you could be open to you could be susceptible to we do know that there are some groups and some types of fraud that are related so obviously if i go back to the landline experience younger people don't have landlines they don't necessarily even know what a landline is so that's probably not the best way to target them so telemarketing does um target older persons there are also life events and psychological factors that we know can increase the likelihood of victimization but there's no guarantee around these particular factors there's very limited research around demographics around psychological attributes around personality traits that do relate to fraud generally

there's some around particular types of fraud and i would argue that vulnerability it's neither fixed nor static it's really kind of a continuum and it can change from day to day from month to month i've spoken to victims that just professionals were really rushed going through their emails trying to clear their inboxes we all know we all know that feeling and just reading an email not really processing it properly responding to it and giving access to all of their bank account information to an offender it can happen in 2019 the australian competition consumer commission released what i think is a really great demographic just breaking down the top three fraud categories for all demographics so this really

speaks to the point that everyone is vulnerable so you've got under 18s are vulnerable but they're vulnerable to different things compared to the over 65s so unsurprisingly under 18s are vulnerable to online shopping fraud because we're all spending our lives going through ebay going through various sites and you can see 18 to 24 it's around threats to life um in the media periodically we see stories particularly targeting chinese university students probably not so much post-covered times but previously there were a number of schemes going around where chinese students were being threatened with deportation if they didn't work with the offender they would send photos of themselves being i guess kidnapped to their families and friends back home

arguing that they needed money in order to be released and that was specifically targeting i guess a particular demographic in the community and that's that's the highest category for that particular age group that won't work for older age groups so offenders are very good at targeting and tailoring approaches that they think will work if we look up to the older demographics it's all around romance it's all around investment and this was 2019 so 2018 data but i'd hazard a guess to say it's quite similar now if we think about why fraud is successful it's again it's around the fact that offenders are highly skilled tech savvy individuals they know what they're doing they know how to identify someone's

weakness they know how to manipulate it and they know how to exploit it and i've seen it time and time again not just in the stories of the victims i've spoken to i've seen it in the email communications i've seen it in the text messages in the chat logs that that victims have shared with me i've seen how offenders get in and they they just know exactly what to do and what to say at any given time we do know that offenders work in groups to target victims and this is i guess interesting in terms of from a victim perspective sometimes they they've said to me that they feel they're talking to more than one person so it's kind of the one

person it might be cassandra that they're talking to but cassandra has multiple personalities in real life as well as online and and that the victim can figure out that or they just have this inkling that they're not talking to the same person they have this idea that they're talking to multiple people depending on the time of day but they also work they bring different characters in they can be kind of the person they're communicating with they can be family they can be professionals they can be doctors they'll bring people in in order to try and get get what they want offenders will bombard victims with communications so for a lot of the victims that i talk

to during the time that they're being defrauded they talk about it as being all-consuming because essentially from when they wake up in the morning to when they go to bed at night they're they're communicating with the offender in some way whether it's over email whether it's over text message whether it's actual phone calls it's just constant communication so i remember one victim spoke to me around the fact that she turned off her mobile phone she just needed a break she turned it back on and she had 130 missed calls from the offender i mean it's ridiculous in terms of just the way that they communicate the way that they just it becomes all-consuming we do know that offenders also have

answers for any questions and this is what makes it really hard and really challenging for those on the outside as a family member as a friend as law enforcement to have a conversation with someone who's on the inside and try and have a rational conversation you can't have a rational conversation around an irrational situation i've spoken to victims who have told me that later on that day they're going to the post office and they're going to transfer more money there was one guy in particular i remember in perth and he had lost a couple hundred thousand dollars he was living in a big mansion he was in housing commission he was still sending money on the off

chance that it was real that he would get his money back and that afternoon he was going to australia post to send his pension i mean it's just heartbreaking that that this happens and it's it's difficult on the outside to try and understand that to try and understand how the person still sends that money and it goes to the last point that victims don't really believe they're susceptible to fraud i think sometimes it's easier to send money with the hope that it's real than it is to actually acknowledge the fact that you have been deceived that you have trusted someone and that they that they have exploited that if we think about techniques of offending um offenders are really smart

they know what to do so many will use social engineering techniques and many of you in this room are probably familiar with those with authority offenders will take on positions of authority whether that's ceos in business email compromise fraud whether that's military personnel and romance fraud um they will use this notion of authority we get text messages from banks or from the ato kind of demanding i got a missed call from the ato the other day telling me there was an arrest warrant out for me because i hadn't paid my tax i know that that's not true but that that can really scare some people if they don't know what actually happens they use urgency they use scarcity in

order to get someone to do an immediate reaction to respond immediately without thinking and then a lot of my work in an area i'm really interested in is the use of psychological abuse that offenders use so i have done some work where i've identified that offenders use the same psychological abuse techniques that we know offenders use in domestic violence the same techniques that are being perpetrated within tv i would argue offenders are using that in a fraud context and offenders are able to to wield a huge amount of power and control from on a person's life even though they're not geographically in the same place an offender can be on the other side of the world

and they can still exert an incredible amount of power and control and fear on the lives of the victims here i've had several victims that have moved house at the end of their experience because they didn't feel safe in their house they didn't feel comfortable the offender knew too much about them and offenders are really good at using these techniques and that's why it's hard it's hard i guess on the inside when you're in that to experience it and it's hard on the outside to to see what's happening to somebody in terms of technology technology has really enabled fraud to flourish it's enabled a number of cyber crimes to flourish the internet didn't create fraud it

didn't create any of these things the nigerian example has been around for a very long time used to be through fax machines if we remember what they are but it's exponentially increased the ability for offenders to target victims it's it's increased their potential victim pull technology creates many barriers for victims and law enforcement i think everyone in this room's aware of that there are many technological efforts in place to reduce fraud victimization and i certainly don't need to talk technical to those in the room there are spam filters antivirus algorithms chat bots artificial intelligence there's a lot of research happening in in that area in the fraud space but regardless of the best technology fraud still has that human element and

being human is what makes you fallible to fraud so wrapping up if you take anything away from today hopefully it's just perhaps a different understanding of what fraud victimization is it's understanding that it's not always nigerian princes or nigerian astronauts it's not people responding to these outrageously crazy emails but offenders are very good at targeting individual vulnerabilities and weaknesses and getting in there and exploiting them in any way possible we need to acknowledge that all of us in this room are potentially vulnerable to fraud and that's not to scare everybody i do a lot of presentations to older people so it's always hard to talk about this without scaring all the people to never turning on their computers ever again

and that's not my aim but we have to be we have to be real about this we have to acknowledge the fact that there will be victims in this room people who have responded and there's potentially if we come back next year there'll be people that have experienced this in the next 12 months we need to accept that the most sophisticated technical expertise does not necessarily protect you against fraud and i think that's that's certainly one of the challenges that i face in terms of working trying to do collaborations with technical people an app is not going to change everything um and we need to talk openly and constructively about fraud with family friends and colleagues

if somebody came to you and said that they'd lost three hundred thousand dollars how would you react to that i mean inside and outside i think what i would just encourage you anything is to have these discussions with your family and friends about the different approaches about the different things that are out there so that you potentially are a trusted person if someone does lose money if someone is unsure about what's happening that they might come to you knowing that you won't judge them you won't disown them but that you will just sit down and have that probably difficult uncomfortable conversation with someone and i can only really encourage you to be supportive of those people

sometimes it's hard sometimes they're not ready to hear it but at some point they will need support and it would be brilliant if it was everyone in this room so that's it for today um if you've got any questions i think there's a few minutes available um my email's up there i'm on twitter can somebody please tweet about this or it probably didn't happen and i'll be around for the next two days thank you we do have a few questions uh one of the first questions is on um scam baiters and scam baiters are people that that tag you know scammers and the question is why alex what are your thoughts on scam baiters and vigilantes that's a

very good question i think it was alex um i have written a paper on this but i'm a bit conflicted about scandals to be perfectly honest i can see the reasons why people do it and i can see in some cases it's quite harmless and i certainly understand the premise of i guess if they're talking with you and you know what's happening then they're not talking with somebody else who might be sending money the issue that i do have with scam baiting is that there's a fine line between kind of the harmless type of scam baiting and the scam baiting that i've seen that very much draws upon misogynistic sex sexist racist um kind of undertones so there's

a number of forums out there i've done some analyses of some of these forums and i guess there's different types of scam baiting and i guess there's also i think this would be right research project it's on my to-do list but i think yeah i'm definitely conflicted i can understand it i wouldn't encourage it myself because i guess for me as soon as you're engaging with an offender you're giving them an opening and you might think you're invincible and you you might well be but you may also have at some point a vulnerability that they identify and they get in so for me it's always about not engaging in any circumstances yeah great uh another question uh this

is an interesting one by ben uh waters what do you think the reasons one of the reasons for the disparity between fraud losses in canada versus australia given that they're similarly sized commonwealth countries um i think it's around reporting and statistics so those statistics do seem quite low and when i was putting them together they do seem quite low compared to australia um australia has improved in terms of its reporting so it used to just be scam watch reporting scam watch figures but scam watch now includes reports from um acorn what used to be acorn the australian cybercrime online reporting network is now report cyber so they include those statistics um they also include statistics from the

big four banks in their most recent publication so i think it's really just around knowledge and around statistics i think in canada my understanding is it's just reports to the canadian anti-fraud centre and i think if they were to do similar things in terms of including other categories and other organizations that it would probably be a much higher statistic but generally speaking we know that the stats are only a very small minority of actual losses so any statistic any figure we put out there is not really going to be representative of the actual harm and loss and cynic has just asked a general question are the slides and information going to be shared there are

some great statistics and info available uh in those slides yeah i'm happy to share those statistics um as i said i've i've been in this area a while i've written a lot so if any of you are interested i've got conversation articles that are short and snappy and i've got academic articles that may put you to sleep and i'm happy to share either and maybe one last question by benzies um how do you handle fraud in the age of massive data links recently facebook and linkedin where tpii identifiers are in that data and do not require traditional methods yeah it's definitely challenging in terms of i guess technology in the way that offenders are always figuring out how to

use things for evil so every time we come up with or technology evolves into something useful and convenient for us there's always kind of a flip side where offenders will use it for evil so i don't necessarily have a concrete answer for that but it is a challenge um around identity crime i've been starting to think about um the use of deep fakes in romance fraud for example so if people are creating deep fake images and and using them as profile pictures then it removes the identity crime of real people so instead of taking real people's pictures and using them they're creating kind of fictitious people but it opens up a whole new range of problems and

issues so for me it's just there's always there's always a counter argument to any good thing there's always something for evil and i think the problem with me and with many of you in this room is that we think about the bad stuff we're kind of paranoid around all the evil that can happen out there well thank you very much for those questions and your presentation so let's all thank cassandra one more time