HM Revenue and Customs said it has successfully blocked fraudsters from faking calls from its best-recognised helpline numbers, following a surge in scams that used this method.
The number of phone-based scams recorded by the tax agency increased 13-fold from 7,778 in 2017-18 to 104,774 in 2018-19. In many cases, fraudsters would fake the caller ID number displayed on most telephones so calls appeared to be from an advertised HMRC number, lulling recipients into a false sense of security.
HMRC said that since introducing new controls in April it has seen zero phone scams that involve spoofing its own phone numbers, and overall this has resulted in scam reports falling by a quarter month-on-month. It added it was the first government agency to introduce such controls, although it warned that criminals may continue to attempt to commit such fraud using other phone numbers.
The tax agency has not detailed how the blocking works, but the controls – introduced with regulator Ofcom and the telecoms industry – follow similar anti-spoofing work covering email and text messaging. HMRC has been one of the biggest beneficiaries of a National Cyber Security Centre (NCSC) service that checks emails that claim to be from @gov.uk addresses. Since implementing the DMARC (Domain based Message Authentication, Reporting and Conformance) verification system in November 2016, HMRC has blocked more than half a billion phishing emails.
The agency has also managed to block the majority of fake SMS text messages through the Mobile Ecosystem Forum, set up with Mobile UK, the network operator association, to establish an SMS SenderID protection registry. HMRC said the numbers of reported instances of HMRC-branded text message scams have fallen by 90%.
“Between April 2018 and March 2019, one in four phishing reports made to Action Fraud were about fraudulent phone calls, “said Pauline Smith, head of the fraud and cyber-reporting centre run by City of London Police for England, Wales and Northern Ireland. “It is encouraging to see that these newly developed controls by HMRC have already achieved a reduction in the number of calls spoofing genuine HMRC numbers.”
Image by Paul Clarke, paulclarke.com
