The UK isn’t taking the risk of contact tracing fraud seriously

Experts have a get-out clause of which politicians can only dream when they are speaking from the podium at press briefings. While ministers are expected to be able to answer questions on any matter, there and then, and have details at their fingertips, advisors can escape most tricky questions with a simple few words: that’s outside my area of expertise.

That makes it all the more baffling that when asked by journalists about the risk of fraudsters exploiting the government’s new track and trace system, not one, but two deputy chief medical officers decided to comment and belittle the risks involved.

Deputy chief medical officer Dr Jenny Harries was particularly sanguine. ‘I think it will be very obvious in the conversation you have with them that they are genuine in that regard,’ she told journalists and the viewing public. ‘I think it will be very evident when somebody rings you these are professionally trained individuals and sitting over them are a group of senior clinical professionals.’ Harries could not have been much more Pollyanna-ish had she turned up at her aunt’s farm in Vermont with goldilocks curls exclaiming ‘good golly gosh!’.

The UK’s contact tracing operation has three tiers of employees, the most numerous of which comprises people who have had half a day or less of training – some of whom applied for generic call centre jobs at minimum wage, and some whose training consisted of being given a PDF with instructions and told to read it.

Coupled with the fact many of these callers will be operating from home, potentially with the sounds of their still-at-home children in the background, and some genuine contact tracing calls will sound anything but professional.

That’s the least of the issues Harries is ignoring, though. Anyone savvy enough to successfully navigate to the official government advice page on track and trace will see reassurance that they should make sure calls or texts come from the official government number listed online.

The problem is that even a relatively amateur con artist can fake the number – as radio host and former The Real Hustle presenter Alexis Conran demonstrated on his Twitter feed on Monday, posting a photo of a phone showing a call apparently from the official 0300 013 5000 number. Spoofing this number takes nothing more than an openly-available app. So much for that protection.

Here is an example of the contact tracing number being spoofed with a commercially available app.

Please be careful.

Just because you see the number it does not mean the call is guaranteed to be genuine. pic.twitter.com/XREbG0d8Uf

— Alexis Conran (@alexisconran) June 1, 2020

That leaves Harries, one of the most senior officials responsible for the well-being of the nation – and in turn the government itself – essentially leaving people to their own devices, navigating a world in which they may be called by complete strangers and told to dramatically change their behaviour, list everyone they have been in contact with, and more.

At least a million attempts a year – the real figure is surely far higher – are recorded of fraudsters attempting to impersonate HMRC by phone, text, or email. Most of us have heard of HMRC and had to deal with it for most of our adult lives – and yet impersonating the department is still lucrative and successful for con artists looking for cash.

Impersonating officials and sounding ‘professional’ is exactly what fraudsters do. They start with plausible details – sometimes they already possess basic reassuring information bought from previous hacks, like a victim’s postcode and name, and seek out more information.

Individuals are conned out of around £7 billion every year in the UK alone, not counting the sums taken from credit cards that is eventually paid for by the banks. Fraudsters target people who are vulnerable, often because of either their age, their concerns about not paying tax, their belief they have broken speeding laws, or – now – because they possibly have coronavirus.

The government has launched its track and trace system before any sane person could possibly think it’s ready, as part of a series of complex political and economic trade-offs – as the cost of lockdown mounts, it reasons, we need to reopen.

Track and trace remains key to that strategy, and perhaps the government believes that launching it early will iron out the kinks all the faster, even if it’s a bumpy ride. Even better if the whole thing helps move the story on from a certain political advisor’s eye tests.

Amid that trade-off, the government seem to have made an additional one: to minimise and outright ignore the very real fraud risks its track and trace programme creates – and by offering false reassurance live on television it is actively helping the fraudsters, who’ll be brushing up on sounding ‘professional’ even as I type.

The government may wish to get a grip on this before thousands of pensioners are spared from Covid only to be stripped of their life savings. There will be enough scandals to look into after the pandemic without needlessly adding another to the list.