1 00:00:08,320 --> 00:00:13,640 I'm on the trail of a new generation of criminals. 2 00:00:13,680 --> 00:00:18,040 They're fuelling a fraud epidemic. 3 00:00:18,040 --> 00:00:20,640 I was starting to panic because obviously my account hit zero. 4 00:00:20,640 --> 00:00:25,600 I just started crying. 5 00:00:25,600 --> 00:00:27,680 Their targets are everywhere - big brands, the banks... 6 00:00:27,680 --> 00:00:31,880 And they could be coming for you. 7 00:00:31,880 --> 00:00:34,520 I feel like, how stupid was I to believe this? 8 00:00:34,520 --> 00:00:39,520 They are openly using social media to run criminal networks. 9 00:00:39,600 --> 00:00:43,240 You could potentially earn anywhere from £2000 to £4,000. 10 00:00:43,240 --> 00:00:48,440 And promoting fraud as a lifestyle choice. 11 00:00:48,560 --> 00:00:51,600 I'm a London scammer, I see it, I want it, I click it. 12 00:00:51,600 --> 00:00:54,240 Nights in the Bando Pyrex whipping. 13 00:00:54,240 --> 00:00:57,880 So he's saying, I'm making all this money and if you want to make this 14 00:00:57,880 --> 00:00:59,360 money, here's how you do it. 15 00:00:59,360 --> 00:01:01,760 My name is Kaf Okpattah and I'm investigating what happens 16 00:01:01,760 --> 00:01:06,920 when fraud goes viral. 17 00:01:14,760 --> 00:01:19,440 There is one crime that is the most commonly experienced of all. 18 00:01:19,440 --> 00:01:23,080 Fraud. 19 00:01:23,080 --> 00:01:28,280 It makes up 40% of all criminal activity in the UK. 20 00:01:28,600 --> 00:01:30,640 During the pandemic it boomed, costing us all more 21 00:01:30,640 --> 00:01:35,640 than £2 billion in a year. 22 00:01:35,640 --> 00:01:40,760 For many the crime begins with a dodgy text. 23 00:01:41,520 --> 00:01:43,400 I've found out where some of the messages 24 00:01:43,400 --> 00:01:47,200 like these are coming from. 25 00:01:47,200 --> 00:01:49,360 Earlier this year, Emmeline Hartley was fooled 26 00:01:49,360 --> 00:01:54,600 by a text from fraudsters. 27 00:01:55,600 --> 00:02:00,880 Well, there was a text, first of all, from the Royal Mail. 28 00:02:02,680 --> 00:02:05,560 It said on the text delivery failed you need to pay £2.99 29 00:02:05,560 --> 00:02:06,560 additional postage paid. 30 00:02:06,560 --> 00:02:08,360 And I've paid that before. 31 00:02:08,360 --> 00:02:12,040 And it kept directing me to the Royal Mail website. 32 00:02:12,040 --> 00:02:14,440 And then I clicked back and scrolled around and then 33 00:02:14,440 --> 00:02:15,800 I entered my details. 34 00:02:15,800 --> 00:02:18,520 And then I got a phone call the next day, 35 00:02:18,520 --> 00:02:23,720 which was on my birthday, from my bank. 36 00:02:24,640 --> 00:02:29,240 In fact, it was the fraudsters. 37 00:02:29,240 --> 00:02:34,400 Because they had used the information she had entered 38 00:02:36,240 --> 00:02:39,040 to the fake Royal Mail website, she believed it was her bank. 39 00:02:39,040 --> 00:02:41,480 They convinced her to transfer her money into a different 40 00:02:41,480 --> 00:02:44,760 account to protect it. 41 00:02:44,760 --> 00:02:50,040 Emmeline suddenly realised she had just paid over 42 00:02:51,880 --> 00:02:53,480 £1000 to criminals - everything she had. 43 00:02:53,480 --> 00:02:55,160 I just broke down on the phone. 44 00:02:55,160 --> 00:02:56,680 He was still on the phone. 45 00:02:56,680 --> 00:02:59,560 I just started crying and he's still trying to calm me down, 46 00:02:59,560 --> 00:03:02,440 knowing full well at this point, there's nothing else he could get 47 00:03:02,440 --> 00:03:05,040 out of me and eventually just gave up and hung up, 48 00:03:05,040 --> 00:03:06,680 to which point I just, I wailed. 49 00:03:06,680 --> 00:03:09,040 Emmeline shared her story online. 50 00:03:09,040 --> 00:03:14,240 It went viral. 51 00:03:15,000 --> 00:03:17,640 It led to messages of support, and she got her money 52 00:03:17,640 --> 00:03:19,240 back from the bank. 53 00:03:19,240 --> 00:03:24,440 But Emmeline also received disturbing messages. 54 00:03:25,040 --> 00:03:30,240 I started to get other messages from people who were supposedly 55 00:03:36,320 --> 00:03:39,800 within the scammers' network as well, which were a bit worrying. 56 00:03:39,800 --> 00:03:43,040 So a few of them sent me screenshots of the scammers' bank account 57 00:03:43,040 --> 00:03:45,680 with my money in it, in the exact transactions that I'd 58 00:03:45,680 --> 00:03:47,520 sent, the exact figures. 59 00:03:47,520 --> 00:03:50,280 So I knew, obviously, that it had come from them. 60 00:03:50,280 --> 00:03:55,440 It's surprising how public and open it is. 61 00:03:55,520 --> 00:04:00,360 Like it's almost as if it's not illegal. 62 00:04:00,360 --> 00:04:03,560 The photo that showed Emmeline's money going into another bank 63 00:04:03,560 --> 00:04:08,840 account was posted by someone calling themselves Uncle Vio. 64 00:04:09,040 --> 00:04:14,200 I want to find out more about him and what he's up to. 65 00:04:14,280 --> 00:04:17,760 It turns out this little green king has been marketing himself on social 66 00:04:17,760 --> 00:04:21,840 media as a fraud consultant. 67 00:04:21,840 --> 00:04:24,480 'With the economy in a rough spot, generating a legal source 68 00:04:24,480 --> 00:04:29,000 of income has become tough. 69 00:04:29,000 --> 00:04:31,600 But Uncle Vio is here to assist you.' 70 00:04:31,600 --> 00:04:36,520 This promotional video was posted on Snapchat. 71 00:04:36,520 --> 00:04:38,680 'You could potentially earn anywhere from £2000 to £4,000.' 72 00:04:38,680 --> 00:04:40,720 Uncle Vio offers a way into fraud. 73 00:04:40,720 --> 00:04:44,280 'So if you're interested, don't hesitate to message us today 74 00:04:44,280 --> 00:04:45,960 'at Uncle Vio for more information.' 75 00:04:45,960 --> 00:04:47,840 His marketing might be professional and modern - 76 00:04:47,840 --> 00:04:49,360 but this is old fashioned crime. 77 00:04:49,360 --> 00:04:54,600 As his victims know only too well. 78 00:04:55,160 --> 00:04:58,240 Sending out fraudulent text messages like the one that tricked Emmeline 79 00:04:58,240 --> 00:05:01,440 is known as spamming. 80 00:05:01,440 --> 00:05:04,280 We wanted to find out how easy it would be to become 81 00:05:04,280 --> 00:05:06,120 a spammer ourselves. 82 00:05:06,120 --> 00:05:10,960 Uncle Vio was ready to help. 83 00:05:10,960 --> 00:05:14,440 He's been advertising on Snapchat for people to work with him. 84 00:05:14,440 --> 00:05:19,720 And he's easily reached through the messaging app Telegram. 85 00:05:20,120 --> 00:05:23,800 He got back to us immediately. 86 00:05:23,800 --> 00:05:27,840 It cost £100 in bitcoin to buy our way in. 87 00:05:35,160 --> 00:05:37,400 He explained that he was offering a fake website 88 00:05:37,400 --> 00:05:42,560 for spamming phone numbers - or leads. 89 00:05:42,960 --> 00:05:48,160 For £15 more he said he would spam 4000 "leads" on our behalf. 90 00:05:49,000 --> 00:05:51,840 I've never met Uncle Vio but thanks to a couple of apps 91 00:05:51,840 --> 00:05:54,480 on my phone and £115, I could have tried to defraud 92 00:05:54,480 --> 00:05:58,320 thousands of people. 93 00:05:58,320 --> 00:06:00,440 Obviously I couldn't take part in the fraud, 94 00:06:00,440 --> 00:06:05,640 so I didn't take him up on the offer. 95 00:06:05,840 --> 00:06:11,080 Instead, I asked if we could supply some numbers. 96 00:06:11,720 --> 00:06:15,960 Vio agreed to the deal. 97 00:06:15,960 --> 00:06:21,200 But all of the phone numbers belonged to me. 98 00:06:26,760 --> 00:06:30,000 Sure enough, I was targeted. 99 00:06:30,000 --> 00:06:32,520 It was scammers pretending to offer me a phone contract. 100 00:06:32,520 --> 00:06:35,880 You said you needed my bank details, is that right? 101 00:06:35,880 --> 00:06:37,200 Yeah. 102 00:06:37,200 --> 00:06:41,200 What details would you need? 103 00:06:41,200 --> 00:06:44,840 So we will need like the sort code and the account number. 104 00:06:44,840 --> 00:06:47,680 We'll also take the card number and the security code for taking 105 00:06:47,680 --> 00:06:51,520 the first payment of £29. 106 00:06:51,520 --> 00:06:54,280 I should probably let you know that I'm actually a BBC 107 00:06:54,280 --> 00:06:56,600 reporter for Panorama. 108 00:06:56,600 --> 00:06:59,680 It's pretty obvious that you're trying to scam me, 109 00:06:59,680 --> 00:07:04,560 how can you do that? 110 00:07:04,560 --> 00:07:06,760 It's only like to give you a contract. 111 00:07:06,760 --> 00:07:12,040 It's clearly not though. 112 00:07:15,520 --> 00:07:19,200 Any normal provider... 113 00:07:19,200 --> 00:07:20,960 Go to hell with your CVV passcode. 114 00:07:20,960 --> 00:07:22,960 HANGS UP. 115 00:07:22,960 --> 00:07:26,520 Uncle Vio appears to be running a sort of criminal enterprise. 116 00:07:26,520 --> 00:07:31,560 But we haven't been able to identify him. 117 00:07:32,000 --> 00:07:34,600 After we wrote to Uncle Vio on social media, he phoned 118 00:07:34,600 --> 00:07:38,120 us, using his alias. 119 00:07:38,120 --> 00:07:40,480 He said he doesn't actually commit fraud himself but has 120 00:07:40,480 --> 00:07:45,240 people working for him. 121 00:07:45,240 --> 00:07:48,400 When asked about defrauding Emmeline he said, "That was one of my boys. 122 00:07:48,400 --> 00:07:50,480 That wasn't even me." 123 00:07:50,480 --> 00:07:52,880 After we wrote to Snapchat, Uncle Vio's account was closed 124 00:07:52,880 --> 00:07:58,120 for violating community guidelines. 125 00:08:01,880 --> 00:08:04,480 Criminals like Uncle Vio used to hide on the dark web, 126 00:08:04,480 --> 00:08:07,320 but now they don't need to. 127 00:08:07,320 --> 00:08:12,600 Social media can give them enough anonymity to escape investigation. 128 00:08:16,440 --> 00:08:20,120 Anonymous accounts are leaving not just a small amount of breadcrumbs 129 00:08:20,120 --> 00:08:25,240 to investigate them, there are no breadcrumbs, 130 00:08:27,480 --> 00:08:29,360 there is no additional footprint left behind them, 131 00:08:29,360 --> 00:08:33,240 so to investigate this is nearly impossible. 132 00:08:33,240 --> 00:08:36,240 This anonymity has enabled some social media fraudsters to build 133 00:08:36,240 --> 00:08:41,080 influential brands without the fear of being caught. 134 00:08:41,080 --> 00:08:45,080 And there's one in particular that stands out. 135 00:08:45,080 --> 00:08:50,280 Meet Tankz. 136 00:08:50,400 --> 00:08:53,920 Listen - I'm a London Scammer, I see it, I want it I click it. 137 00:08:53,920 --> 00:08:55,360 Nights in the bando pyrex whippin. 138 00:08:55,360 --> 00:08:57,760 He keeps his true identity hidden while rapping and bragging 139 00:08:57,760 --> 00:09:01,560 about fraud on social media. 140 00:09:01,560 --> 00:09:06,840 This track has been played nearly 7 million times on Youtube. 141 00:09:12,600 --> 00:09:15,560 From time to time he even posts a bit of life advice. 142 00:09:15,560 --> 00:09:18,600 It doesn't matter if it's legal or illegal at the end of day 143 00:09:18,600 --> 00:09:19,600 it's still a hustle. 144 00:09:19,600 --> 00:09:22,080 He is probably, you know, one of the influencers out 145 00:09:22,080 --> 00:09:24,200 there when it comes to this kind of stuff. 146 00:09:24,200 --> 00:09:29,360 He wants to be the Kim Kardashian of fraud. 147 00:09:31,200 --> 00:09:33,320 Tankz is on Youtube, Twitter, Instagram, Snapchat and Tiktok. 148 00:09:33,320 --> 00:09:35,680 He's built his reputation through a web of the biggest 149 00:09:35,680 --> 00:09:38,040 social media platforms. 150 00:09:38,040 --> 00:09:40,920 With a total of over 150,000 followers, Tankz is a social media 151 00:09:40,920 --> 00:09:46,160 influencer who promotes crime. 152 00:09:48,480 --> 00:09:51,720 Fraudsters on social media have brought this kind 153 00:09:51,720 --> 00:09:57,000 of crime to a new audience. 154 00:09:58,000 --> 00:10:02,320 I've gone back to my old school to meet some year 12s. 155 00:10:02,320 --> 00:10:05,920 These students are not involved in fraud themselves but have agreed 156 00:10:05,920 --> 00:10:11,160 to talk me through what school kids are finding on social media. 157 00:10:14,520 --> 00:10:16,240 When did you start seeing fraud specific 158 00:10:16,240 --> 00:10:17,240 posts on social media? 159 00:10:17,240 --> 00:10:19,360 I'd say around year 10. 160 00:10:19,360 --> 00:10:20,360 So that's like 15? 161 00:10:20,360 --> 00:10:22,000 On social media. 162 00:10:22,000 --> 00:10:25,480 Has this become like a thing for young people? 163 00:10:25,480 --> 00:10:27,680 Yeah, definitely. 164 00:10:27,680 --> 00:10:30,320 No one really brags about other crimes. 165 00:10:30,320 --> 00:10:32,280 You don't really hear people say, oh yeah, 166 00:10:32,280 --> 00:10:34,440 I robbed that house last night. 167 00:10:34,440 --> 00:10:39,640 So that's why if it's on social media, it's everywhere, 168 00:10:40,680 --> 00:10:42,800 you've seen the lifestyle, you've seen everything, then there's 169 00:10:42,800 --> 00:10:44,960 no reason for you to think it's really bad. 170 00:10:44,960 --> 00:10:47,400 I think it's very much glamorised all over social media 171 00:10:47,400 --> 00:10:48,600 to have the rich lifestyle. 172 00:10:48,600 --> 00:10:51,000 And so it doesn't really matter how you get there. 173 00:10:51,000 --> 00:10:53,880 The fraudsters, they're thinking as it's not my pocket, I don't care. 174 00:10:53,880 --> 00:10:56,280 But they don't actually sit there and think whose pocket 175 00:10:56,280 --> 00:10:57,480 is it coming out of. 176 00:10:57,480 --> 00:10:59,360 That person is losing out on their money. 177 00:10:59,360 --> 00:11:01,280 They're not going to get that money back. 178 00:11:01,280 --> 00:11:03,680 For the social media generation, there's a gateway to crime 179 00:11:03,680 --> 00:11:08,920 that they hold in the palm of their hand every day. 180 00:11:09,320 --> 00:11:14,600 Online fraud against UK retailers is on the rise. 181 00:11:15,800 --> 00:11:21,040 On social media it's known as clicking. 182 00:11:22,520 --> 00:11:25,640 Last year it's thought to have cost the UK economy over a quarter 183 00:11:25,640 --> 00:11:30,880 of a billion pounds. 184 00:11:31,680 --> 00:11:36,840 Tankz, the man in the mask, doesn't just rap about fraud. 185 00:11:38,320 --> 00:11:40,000 He's been selling how-to guides about clicking. 186 00:11:40,000 --> 00:11:41,600 They're known as methods. 187 00:11:41,600 --> 00:11:44,200 He's promoting a lifestyle, which is what influencers do. 188 00:11:44,200 --> 00:11:47,760 So he's saying, I'm making all this money and if you want to make this 189 00:11:47,760 --> 00:11:49,200 money, here's how you do it. 190 00:11:49,200 --> 00:11:54,400 You have to buy these methods off me. 191 00:11:56,000 --> 00:12:01,160 We posed as someone interested in learning about fraud. 192 00:12:01,560 --> 00:12:06,800 We asked Tankz for a guide via Instagram. 193 00:12:09,240 --> 00:12:14,120 He offered us a set of how-to guides to choose from. 194 00:12:14,120 --> 00:12:17,160 We chose what he called the expert guide. 195 00:12:17,160 --> 00:12:22,240 It cost £100. 196 00:12:25,320 --> 00:12:30,360 The files he sent contain multiple techniques to commit fraud. 197 00:12:31,040 --> 00:12:33,440 We're not going to reveal his tricks, but I can 198 00:12:33,440 --> 00:12:36,920 tell you these methods target major brands. 199 00:12:36,920 --> 00:12:39,560 And there's even a way to con the taxpayer by defrauding 200 00:12:39,560 --> 00:12:44,760 the Universal Credit system. 201 00:12:47,440 --> 00:12:52,720 We showed the guide to fraud expert, Tim Ayling. 202 00:12:54,520 --> 00:12:57,680 Based on what you've seen there, I'm guessing it poses a threat or...? 203 00:12:57,680 --> 00:12:58,760 Oh yeah, for sure. 204 00:12:58,760 --> 00:13:01,040 I mean what he's doing here is finding weaknesses 205 00:13:01,040 --> 00:13:06,320 in systems of different companies and advertising that. 206 00:13:08,880 --> 00:13:12,000 I mean the price, £100, he's got to be selling that a lot 207 00:13:12,000 --> 00:13:15,040 for it to be worthwhile for him to do this so for sure, 208 00:13:15,040 --> 00:13:18,720 there's going to be a lot of takers and that in itself is an issue. 209 00:13:18,720 --> 00:13:23,080 Tankz is still selling these guides, he's still making money from them, 210 00:13:23,080 --> 00:13:25,200 does that mean that retailers, banks, even the government, 211 00:13:25,200 --> 00:13:26,440 haven't clocked onto his methods? 212 00:13:26,440 --> 00:13:29,760 Certainly in the finance world and to an extent the retail world, 213 00:13:29,760 --> 00:13:32,920 there is a lot of technology that they have in place to stop 214 00:13:32,920 --> 00:13:34,200 as much as they can. 215 00:13:34,200 --> 00:13:39,200 The reality is that it's very difficult to stop everything. 216 00:13:39,520 --> 00:13:42,320 Tankz's Tiktok, Instagram and Snapchat accounts 217 00:13:42,320 --> 00:13:45,720 were closed after we wrote to the social media companies. 218 00:13:45,720 --> 00:13:51,000 Twitter said he was not in breach of their guidelines. 219 00:13:51,640 --> 00:13:54,040 Youtube didn't close his account, but said they strictly prohibit 220 00:13:54,040 --> 00:13:58,160 videos 'that promote violence or criminal activity'. 221 00:13:58,160 --> 00:14:01,960 Many of the clicking methods being circulated by people 222 00:14:01,960 --> 00:14:04,320 like Tankz rely on the fraudsters getting hold of stolen 223 00:14:04,320 --> 00:14:09,480 personal information. 224 00:14:10,960 --> 00:14:16,200 This information is known as "fullz". 225 00:14:17,040 --> 00:14:19,840 We kind of use the term "fullz" now, Full Financial Profile essentially 226 00:14:19,840 --> 00:14:22,680 is what that stands for and we know that criminal can get 227 00:14:22,680 --> 00:14:24,400 these through the likes of phishing attacks. 228 00:14:24,400 --> 00:14:27,560 So they might send you an email, get you to click a link, 229 00:14:27,560 --> 00:14:28,760 fill out all your details. 230 00:14:28,760 --> 00:14:30,440 And once they've captured that information, what 231 00:14:30,440 --> 00:14:32,320 are they doing with it? 232 00:14:32,320 --> 00:14:37,520 Essentially they will sell that. 233 00:14:38,520 --> 00:14:43,400 Again, fraudsters are using social media for their marketing. 234 00:14:43,400 --> 00:14:48,680 Sometimes, they even give away free samples of fullz. 235 00:14:49,320 --> 00:14:53,960 Like on this account on Instagram. 236 00:14:53,960 --> 00:14:57,640 My name is Kaf, I'm a reporter from the BBC. 237 00:14:57,640 --> 00:15:00,080 Some of the phone numbers of the victims were listed 238 00:15:00,080 --> 00:15:01,800 so I gave them a call. 239 00:15:01,800 --> 00:15:04,200 I was just wondering if you were aware that your 240 00:15:04,200 --> 00:15:09,400 details were online. 241 00:15:11,000 --> 00:15:13,280 I don't want to scare you. 242 00:15:13,280 --> 00:15:15,720 It's all sitting there on Instagram. 243 00:15:15,720 --> 00:15:16,520 I'm sorry about this. 244 00:15:16,520 --> 00:15:21,400 It's clear that the details are real. 245 00:15:21,400 --> 00:15:24,400 I'll let you go right now so you can double check your account. 246 00:15:24,400 --> 00:15:27,000 I felt as if I was the one violating their privacy. 247 00:15:27,000 --> 00:15:28,200 No, no, that wasn't nice. 248 00:15:28,200 --> 00:15:29,520 I know. 249 00:15:29,520 --> 00:15:31,960 After making the calls, we reported this post to Instagram 250 00:15:31,960 --> 00:15:36,800 using their reporting tool. 251 00:15:36,800 --> 00:15:41,960 But they left it up there for a month. 252 00:15:44,160 --> 00:15:47,200 I went to meet one of the people whose information had been posted. 253 00:15:47,200 --> 00:15:50,840 I showed him what we'd found. 254 00:15:50,840 --> 00:15:53,880 I can see basically all my details, I can see my full name, 255 00:15:53,880 --> 00:15:59,160 I can see my fully address, my number of my phone, 256 00:15:59,360 --> 00:16:00,600 the number of my card. 257 00:16:00,600 --> 00:16:04,080 My account number, my sort code. 258 00:16:04,080 --> 00:16:07,880 So basically I can see my whole life here. 259 00:16:07,880 --> 00:16:12,160 What's going through your head having looked at that? 260 00:16:12,160 --> 00:16:17,400 It's scary because you never realise how unprotected you are. 261 00:16:18,520 --> 00:16:21,520 We've reported it to Instagram but they haven't taken it down. 262 00:16:21,520 --> 00:16:23,720 If it's still there that means they, they don't, 263 00:16:23,720 --> 00:16:27,480 they don't care about us. 264 00:16:27,480 --> 00:16:30,680 Wilson had cancelled his card by the time the post went up. 265 00:16:30,680 --> 00:16:33,120 But with the help of Instagram social media fraudsters now 266 00:16:33,120 --> 00:16:38,400 have his personal information. 267 00:16:38,600 --> 00:16:40,960 After we wrote to Instagram's PR team, the post was 268 00:16:40,960 --> 00:16:42,040 finally taken down. 269 00:16:42,040 --> 00:16:46,480 But they didn't explain why it stayed up for so long. 270 00:16:46,480 --> 00:16:51,160 Facebook who own Instagram told us "fraudulent activity is banned" 271 00:16:51,160 --> 00:16:56,440 and they take "strong action wherever possible to remove it". 272 00:16:56,760 --> 00:16:58,680 They say they've launched a new reporting tool 273 00:16:58,680 --> 00:17:03,960 within the facebook app. 274 00:17:04,040 --> 00:17:06,400 So what is the government doing to tackle online fraud 275 00:17:06,400 --> 00:17:11,280 and its promotion on social media? 276 00:17:11,280 --> 00:17:13,640 Earlier in the year they unveiled plans to reduce illegal 277 00:17:13,640 --> 00:17:18,600 and harmful digital content. 278 00:17:18,640 --> 00:17:23,680 It's called the Online Safety Bill. 279 00:17:24,080 --> 00:17:26,720 The world wide web was, of course, invented by a Brit, 280 00:17:26,720 --> 00:17:29,560 and now the UK is setting a safety standard for the rest 281 00:17:29,560 --> 00:17:31,920 of the world to follow. 282 00:17:31,920 --> 00:17:34,520 The proposed laws were initially aimed at tackling things like online 283 00:17:34,520 --> 00:17:39,520 hatred and abuse, not fraud. 284 00:17:39,680 --> 00:17:42,200 But after pressure from consumer groups, the banks and the police, 285 00:17:42,200 --> 00:17:45,560 the Government changed its mind. 286 00:17:45,560 --> 00:17:47,480 The government announced that they did want posts 287 00:17:47,480 --> 00:17:51,760 about fraud to be covered by the rules after all. 288 00:17:51,760 --> 00:17:55,160 But I'm reading the draft of the new laws and I can't see any 289 00:17:55,160 --> 00:17:59,640 mention of fraud anywhere. 290 00:17:59,640 --> 00:18:02,280 Fraud experts say it is included in what the bill refers 291 00:18:02,280 --> 00:18:07,560 to as illegal content but for some, that's not enough. 292 00:18:11,080 --> 00:18:13,680 It shows that they had no thought prior to the bill 293 00:18:13,680 --> 00:18:14,800 drafting to include fraud. 294 00:18:14,800 --> 00:18:17,440 After a bit of campaigning they said, OK it should include 295 00:18:17,440 --> 00:18:20,560 fraud, but it doesn't actually do very much to hold the companies that 296 00:18:20,560 --> 00:18:24,640 are providing these online media platforms to account. 297 00:18:24,640 --> 00:18:27,480 This bill is not fit for purpose for the war against fraud. 298 00:18:27,480 --> 00:18:32,520 It's miles off. 299 00:18:32,560 --> 00:18:37,720 The Government says: 300 00:18:53,280 --> 00:18:57,920 Social Media Fraudsters have their eyes on our bank accounts. 301 00:18:57,920 --> 00:19:00,320 So banks and businesses are fighting back. 302 00:19:00,320 --> 00:19:03,000 They've brought in new systems to verify their customers' 303 00:19:03,000 --> 00:19:08,280 transactions - including the one time passcode. 304 00:19:08,600 --> 00:19:13,400 But criminals are finding more and more ways around it. 305 00:19:13,400 --> 00:19:16,840 Now the one time passcode is essentially sent to your mobile 306 00:19:16,840 --> 00:19:19,720 phone so that you can authorise a transaction, but what we know 307 00:19:19,720 --> 00:19:22,600 is that criminals are often socially engineering the victim to get that 308 00:19:22,600 --> 00:19:27,800 one time passcode, you know. 309 00:19:30,000 --> 00:19:32,640 Carina Schneider knows how easy it is to be caught out. 310 00:19:32,640 --> 00:19:35,600 It started with a call she thought was from her bank. 311 00:19:35,600 --> 00:19:40,160 They call you. 312 00:19:44,040 --> 00:19:45,680 They call you telling you your account 313 00:19:45,680 --> 00:19:48,240 has been compromised, 314 00:19:48,240 --> 00:19:50,360 let's go through security, and they go through security, 315 00:19:50,360 --> 00:19:53,680 they know your name, they know your address, 316 00:19:53,680 --> 00:19:55,120 they know your date of birth. 317 00:19:55,120 --> 00:19:57,040 She said I'm going to send you now 318 00:19:57,040 --> 00:19:59,240 a one time passcode, and then you just read 319 00:19:59,240 --> 00:20:00,400 the information to me please. 320 00:20:00,400 --> 00:20:01,600 And that's what I did. 321 00:20:01,600 --> 00:20:04,000 Carina had unwittingly given the criminals the one time passcode 322 00:20:04,000 --> 00:20:09,240 which is used to authorise activity on an account. 323 00:20:09,480 --> 00:20:13,720 They say that my current account was compromised. 324 00:20:13,720 --> 00:20:16,760 They would cancel my card, open a new account and then my money 325 00:20:16,760 --> 00:20:19,400 would be safe, but that was just the beginning of it, 326 00:20:19,400 --> 00:20:20,840 because I had savings as well. 327 00:20:20,840 --> 00:20:23,280 How much money ended up in this new account? 328 00:20:23,280 --> 00:20:28,520 £7,192. 329 00:20:28,760 --> 00:20:31,160 She was refunded by her bank but it looks like 330 00:20:31,160 --> 00:20:34,440 the criminals got away with it. 331 00:20:34,440 --> 00:20:39,720 I feel like how stupid was I to believe this, 332 00:20:41,720 --> 00:20:45,600 and I do read a lot I see the news, and I didn't realise how damaging 333 00:20:45,600 --> 00:20:50,880 was this one time passcode. 334 00:20:51,240 --> 00:20:56,440 Stealing one time passcodes is a growing criminal trend. 335 00:20:57,960 --> 00:21:00,200 I started investigating how one gang offered to help 336 00:21:00,200 --> 00:21:05,440 fraudsters do it with a highly professional automated service. 337 00:21:09,720 --> 00:21:14,240 OTP Agency marketed themselves through the Telegram app. 338 00:21:14,240 --> 00:21:16,360 They used videos like this to advertise their services 339 00:21:16,360 --> 00:21:20,120 while hiding who they were. 340 00:21:20,120 --> 00:21:23,560 The group was even on the review site Trust Pilot. 341 00:21:23,560 --> 00:21:25,000 It was a highly rated service. 342 00:21:25,000 --> 00:21:30,280 So how did it work? 343 00:21:32,320 --> 00:21:37,560 Imagine a criminal client of OTP Agency has got hold of your details. 344 00:21:39,040 --> 00:21:42,680 They try to buy something - and when they do, your bank sends 345 00:21:42,680 --> 00:21:47,920 you a one time passcode to check that it is you making the payment. 346 00:21:49,760 --> 00:21:52,600 At this point, the criminal uses OTP Agency to trigger a robo-call 347 00:21:52,600 --> 00:21:55,880 to you, posing as your bank. 348 00:21:55,880 --> 00:21:58,040 I've obtained a demonstration of one of these calls 349 00:21:58,040 --> 00:22:01,080 from inside OTP Agency. 350 00:22:01,080 --> 00:22:05,960 It shows just how convincing they can be. 351 00:22:05,960 --> 00:22:10,320 John Seymore, this is an automated call from Halifax bank. 352 00:22:10,320 --> 00:22:14,520 They pretend to be calling to prevent fraud. 353 00:22:14,520 --> 00:22:17,600 They say if you want to stop the transaction, you need to give 354 00:22:17,600 --> 00:22:20,520 them your one time passcode. 355 00:22:20,520 --> 00:22:23,840 An authorised payment of £85.23 was made using your debit 356 00:22:23,840 --> 00:22:27,280 card ending in 1312. 357 00:22:27,280 --> 00:22:29,880 In order to cancel this transaction, please enter the code that 358 00:22:29,880 --> 00:22:32,040 you received by text message followed by the hash 359 00:22:32,040 --> 00:22:36,120 key after the beep. 360 00:22:36,120 --> 00:22:39,120 If you follow these instructions, the criminals will have everything 361 00:22:39,120 --> 00:22:43,600 they need to take your money. 362 00:22:43,600 --> 00:22:47,040 I was not the only one investigating them. 363 00:22:47,040 --> 00:22:48,720 I discovered an American cyber intelligence firm, 364 00:22:48,720 --> 00:22:53,960 Scylla Intel was also on the case. 365 00:22:54,320 --> 00:22:59,440 My professional focus is disrupting financially motivated cybercrime. 366 00:22:59,520 --> 00:23:04,720 We're not revealing his identity for security reasons 367 00:23:04,960 --> 00:23:06,840 We're not revealing his identity for security reasons. 368 00:23:06,840 --> 00:23:09,000 Are services like OTP Agency, are they a one-off? 369 00:23:09,000 --> 00:23:14,280 I would describe it as a growing market. 370 00:23:19,360 --> 00:23:23,440 And whereas fraud is this nebulous term, what's developed now 371 00:23:23,440 --> 00:23:27,960 are these services that makes cybercrime incredibly approachable. 372 00:23:27,960 --> 00:23:31,360 Scylla was looking into a wider network of UK based cyber fraud 373 00:23:31,360 --> 00:23:35,280 groups, including OTP agency. 374 00:23:35,280 --> 00:23:37,200 But after information was shared with the police, 375 00:23:37,200 --> 00:23:39,560 OTP Agency suddenly disappeared. 376 00:23:39,560 --> 00:23:41,480 It doesn't seem to have deterred others from 377 00:23:41,480 --> 00:23:46,680 offering a similar service. 378 00:23:48,200 --> 00:23:50,600 This colourful cartoon looks like a gateway into serious crime 379 00:23:50,600 --> 00:23:52,600 using one time passcodes. 380 00:23:52,600 --> 00:23:55,440 Use our service to intercept your OTPs or telepins from your target. 381 00:23:55,440 --> 00:23:58,960 iSpoof is here to help. 382 00:23:58,960 --> 00:24:01,800 The cat and mouse game would always continue with criminals and police, 383 00:24:01,800 --> 00:24:05,800 but it is just about the distance in between the cat and the mouse. 384 00:24:05,800 --> 00:24:09,000 Can you say, who is winning in that cat and mouse game? 385 00:24:09,000 --> 00:24:12,160 I would have to say right now, criminals are winning in the case 386 00:24:12,160 --> 00:24:17,400 of fraud in the world of cybercrime. 387 00:24:34,080 --> 00:24:37,200 In the world of cybercrime, 388 00:24:37,200 --> 00:24:38,880 it's easy to stay anonymous and hidden. 389 00:24:38,880 --> 00:24:40,800 But there's one social media fraudster who's not 390 00:24:40,800 --> 00:24:42,440 as clever as he thinks he is. 391 00:24:42,440 --> 00:24:43,520 Remember Tankz? 392 00:24:43,520 --> 00:24:46,680 He's the guy who raps about fraud who sold me a fraud guide. 393 00:24:46,680 --> 00:24:48,520 I think I've worked out where he is. 394 00:24:48,520 --> 00:24:50,320 And I'm on the way there now. 395 00:24:50,320 --> 00:24:52,200 Tankz' posts about life as a fraudster reveal 396 00:24:52,200 --> 00:24:53,200 more than he intended. 397 00:24:53,200 --> 00:24:55,840 Typing on youtube search bar in this video Tankz is heard 398 00:24:55,840 --> 00:24:57,040 saying he's a uni student. 399 00:24:57,040 --> 00:24:58,480 Do your parents know you click? 400 00:24:58,480 --> 00:25:00,920 Yes, but because I'm at uni, it's made them kind 401 00:25:00,920 --> 00:25:02,120 of more accepting of it. 402 00:25:02,120 --> 00:25:04,760 In this clip, he suggests he lives in the Wembley area 403 00:25:04,760 --> 00:25:05,800 of North West London. 404 00:25:05,800 --> 00:25:08,640 I'm gonna go to Kings Cross, head back to Wembley from there. 405 00:25:08,640 --> 00:25:10,840 But the most distinctive thing in his videos that 406 00:25:10,840 --> 00:25:11,880 I've noticed is this... 407 00:25:11,880 --> 00:25:13,600 The black and grey carpet. 408 00:25:13,600 --> 00:25:18,840 I think I've matched it to a student accommodation block near here. 409 00:25:22,600 --> 00:25:24,960 Another right and hopefully when we start going down we're 410 00:25:24,960 --> 00:25:29,040 going to be on the road to Tankz's apartment. 411 00:25:29,040 --> 00:25:33,840 Left up ahead, that's good. 412 00:25:33,840 --> 00:25:36,880 Now we're in the right place, the question is how will I recognise 413 00:25:36,880 --> 00:25:39,520 the anonymous London Scammer? 414 00:25:39,520 --> 00:25:44,720 Again, Tankz has given too much away online. 415 00:25:49,160 --> 00:25:52,520 Earlier in the year, he posted a video of a run-in with the police 416 00:25:52,520 --> 00:25:56,280 in which he accidentally revealed his number plate. 417 00:25:56,280 --> 00:25:58,200 When I searched official records, I could see 418 00:25:58,200 --> 00:26:03,480 that it is a grey Vauxhall Corsa. 419 00:26:03,680 --> 00:26:08,960 All I have to do is find the car. 420 00:26:13,400 --> 00:26:17,680 That's it, that right there, that's Tankz' car. 421 00:26:17,680 --> 00:26:22,120 That's his number plate, it's a grey Vauxhall. 422 00:26:22,120 --> 00:26:25,840 All that's left now is to wait for Tankz. 423 00:26:25,840 --> 00:26:30,480 So we did. 424 00:26:30,480 --> 00:26:35,640 And when he turned up we were there. 425 00:26:38,040 --> 00:26:42,880 The first confirmed pictures of Tankz. 426 00:26:42,880 --> 00:26:47,800 They're so good, you can pretty much ID him from this. 427 00:26:47,800 --> 00:26:50,800 So who is he? 428 00:26:50,800 --> 00:26:53,680 An ebay account in the name of Tankz gives a clue - 429 00:26:53,680 --> 00:26:58,520 an email address for a Luke Joseph. 430 00:26:58,520 --> 00:27:00,960 We've been told there's someone with that name who lives 431 00:27:00,960 --> 00:27:06,080 in the student accommodation where the Vauxhall was parked. 432 00:27:06,200 --> 00:27:09,280 And then there's this - an Apple music page suggests 433 00:27:09,280 --> 00:27:11,520 the writer of this Tankz song was Luke Joseph. 434 00:27:11,520 --> 00:27:15,800 The clothes match - and so does the name. 435 00:27:15,800 --> 00:27:18,440 It seems that Tankz, the London Scammer may be a London 436 00:27:18,440 --> 00:27:23,720 student called Luke. 437 00:27:25,120 --> 00:27:27,320 This is a talented individual who clearly is clever. 438 00:27:27,320 --> 00:27:29,680 But using those skills for something that in my mind 439 00:27:29,680 --> 00:27:32,040 is criminal and is wrong, if Tanks is prosecuted there 440 00:27:32,040 --> 00:27:37,320 is a real risk he'll face prison. 441 00:27:37,680 --> 00:27:40,040 We wrote to Luke Joseph and Tankz about our allegations. 442 00:27:40,040 --> 00:27:45,240 There was no response. 443 00:27:46,280 --> 00:27:47,880 All the social media companies who responded 444 00:27:47,880 --> 00:27:52,960 to our questions say they have rules against fraudulent activity. 445 00:27:53,560 --> 00:27:56,000 They all said they take enforcement action against violations, 446 00:27:56,000 --> 00:27:58,120 work with law enforcement agencies, and are developing new 447 00:27:58,120 --> 00:28:01,880 ways to combat fraud. 448 00:28:01,880 --> 00:28:07,000 Only telegram did not respond to our request for a comment. 449 00:28:08,400 --> 00:28:13,480 Social media has transformed how criminals work. 450 00:28:15,960 --> 00:28:18,800 You can now appeal to hundreds, thousands, millions of people in one 451 00:28:18,800 --> 00:28:24,040 go by a simple social media post. 452 00:28:24,120 --> 00:28:28,560 It's helping to fuel an epidemic of crime. 453 00:28:28,560 --> 00:28:30,520 It seems the Government and social media companies 454 00:28:30,520 --> 00:28:35,840 are struggling to stop the spread. 455 00:28:36,080 --> 00:28:38,480 Social media is now the area of expertise for criminals 456 00:28:38,480 --> 00:28:41,120 because we are immersed in it, so they're immersed in it. 457 00:28:41,120 --> 00:28:43,240 So, social media companies need to realise that they're 458 00:28:43,240 --> 00:28:46,320 part of the problem. 459 00:28:46,320 --> 00:28:48,240 The UK's number one crime is going viral. 460 00:28:48,240 --> 00:28:51,080 Keep an eye out for the social media fraudsters - next time, 461 00:28:51,080 --> 00:28:56,320 they could be coming for you.