Reporting fraud, and suspecting a colleague

Reporting to Action Fraud

Action Fraud is the UK's national reporting centre for fraud and cybercrime, run by the City of London Police. It takes reports of fraud from individuals and organisations in England, Wales and Northern Ireland, online or by phone, and passes them to the National Fraud Intelligence Bureau for assessment. In Scotland, fraud is reported directly to Police Scotland.

Report even when recovery looks unlikely. Reports build the intelligence picture that lets police link cases, warn others, and take down the infrastructure behind fraud. If a crime is in progress or a suspect is present, call 999 as with any other emergency.

If money has been sent

Speed matters more than anything else. If your organisation has made a payment to a fraudster, contact your bank immediately, before anything else, and ask them to attempt recovery of the funds. Then report to Action Fraud, preserve all the evidence, including the original emails with their headers, and review how the payment got through so the gap can be closed.

If you suspect a colleague

Suspecting someone you work with is uncomfortable, and it is easy to get the response wrong. The rules are simple.

• Do not confront the person. A tip-off gives them the chance to destroy evidence, move money, or construct a cover story, and if your suspicion is wrong you have done real damage for nothing.
• Do not investigate yourself. Searching their files, emails, or desk can breach policy and data protection law, and can contaminate evidence a formal investigation, or a court, would later need.
• Do not discuss it with other colleagues. Gossip spreads, reaches the person, and unfairly damages them if they are innocent.
• Do make a private note of what you observed, with dates, while it is fresh.
• Do report promptly through the proper route: your manager, the fraud or compliance lead, or the whistleblowing channel, as covered in the previous lesson.

Then let the process work. Raising a concern is your job. Investigating it is someone else's, and keeping those two things separate protects the evidence, the organisation, the person under suspicion, and you.