From the DWP Permanent Secretary & HMRC Chief Executive Sir Robert Devereux Jon Thompson Meg Hillier MP House of Commons London SW1A 0AA 10 June 2016 Dear Meg, Fraud and Error Stocktake We are writing to provide you with an update, as promised, on recommendation 4 of the Fourth Report of Session 2015 16 (published 28 October 2015), specifically, the requirement to report back to the Committee in 6 months on progress made in relation to initiatives exploiting third party data. Both Departments have a history of investing in data matching to help tackle key loss areas, which has helped reduce fraud and error to its lowest ever level in both HMRC and DWP. However, national fraud and error estimates make it clear that customers do not always report their circumstances accurately or forget to tell us (or are late in telling us) about changes in their circumstances. It is important therefore that both Departments continue to explore data sharing opportunities, including the use of third party suppliers. A number of new and innovative ways of using data are being pursued. This letter provides updates on the third party data sharing initiatives currently being explored (Annex A) along with details on existing data sharing arrangements between the Departments and across Government (Annex B). Page 1 of 10
In this way, we aim to actively demonstrate the Departments understanding of what causes fraud and error and illustrate the commitment that is helping tackle loss in the welfare system. Both Departments will of course continue to work towards further savings using all the means at our disposal in order to address fraud and error, including structural change, welfare reform, new technology and of course improved data sharing. Yours sincerely Sir Robert Devereux Jon Thompson Page 2 of 10
Annex A - Third party data sharing initiatives: recent developments DWP Analysis and Intelligence Hub 1. Since the Committee made its recommendations, DWP has further developed its Analysis and Intelligence (A&I) Hub for Universal Credit. This capability enables DWP to establish and deploy data driven rules, which either give confidence in a transaction (and allow it to proceed without intervention) or which flag a transaction as needing further checks. The A&I Hub incorporates departmental and third party data sources, fused together through open source technologies, and went live in September 2014. As the Universal Credit caseload grows, and more data is analysed, the A&I Hub becomes a progressively more powerful capability. 2. To give some examples of rules in operation, and their effect: a. in April 2015, the A&I Hub identified rules which allowed a reduction in the extent of manual verification to assess childcare costs. 40% of these costs can now be verified automatically. b. in December 2015, the A&I Hub deployed 30 rules, utilising information from across government, to identify inconsistencies in benefit entitlement for Universal Credit claimants and responsibility for dependants. As at June 2016, 4,589 cases have been referred for further investigation, with payments worth a total of 919,767 being corrected. 3. The further development of the A&I Hub includes: a. a data visualisation tool, delivered at the end of 2015, which presents analysts with the capability to search across and visualise over 180 million links and relationships. This tool is being used to identify anomalous patterns indicative of fraudulent behaviour, including organised attacks, and to spot errors early in the process. b. data trials are underway, focused on household composition, identity and housing: this includes evaluating the value of data from Land Registry, Valuations Office, the National Fraud Initiative, Credit Reference Agencies and the Metropolitan Police. 4. The A&I Hub has, and will continue to work, with operational teams to identify both claimant behaviour indicative of fraud and common faults associated with official error. The key to the A&I Hub is the ability to identify emerging behaviours and respond quickly. By taking a risk based approach, the A&I Hub will help alleviate the burden of resource intensive verification processes within Universal Credit and will test differentiated intervention types based on the severity of the risk. Page 3 of 10
DWP Cyber Resilience Centre 5. The DWP Cyber Resilience Centre (CRC) was created specifically to mitigate the threats associated with a more digital approach to delivery, in particular the threat to Universal Credit from cyber crime and cyber enabled fraud. 6. The CRC deploys in-house cyber security skills, the systems necessary to perform big data security analytics (using our own cyber analytical environment), and the processes and linkages to other departments, notably the Government Computer Emergency Response Team (GovCERT), the Computer Emergency Response Team UK (CERT UK) and HMRC that allow for effective security incident response. HMRC data architecture 7. HMRC already has a Data Acquisition and Exploitation Team which performs a similar function and lessons learnt by HMRC will help inform the development of the A&I Hub. 8. HMRC s Connect is a data matching and risking tool that allows HMRC to cross match one billion HMRC and third party data items. It identifies hidden relationships between people, organisations and data that could not previously be identified. Connect has the capacity to highlight patterns in HMRC s rich reserves of taxpayer and third party data, allowing HMRC to find anomalies between such things as bank interest, property income and other lifestyle indicators. Once identified relevant compliance action will be taken. Connect is a very powerful data tool central to HMRC s work to close the tax gap and tackle evasion which is also being exploited to counter fraud and error in Tax Credits. 9. HMRC is currently building an Enterprise Data Hub, in essence a central repository for all data across HMRC which will facilitate a richer source of information about their customers. The Enterprise Data Hub comes with a suite of new analytical tools which will enable HMRC to match data across its legacy systems and against third party data sources. HMRC s digital ambition and its development of on line products is a further opportunity to gather data that will provide an insight into customer behaviour and help promote customer compliance. 10. HMRC has provided analysts with additional accesses to bulk data repositories, increasing capacity on data matching. These analysts have also received industry accredited training, which has resulted in improvements in successful case identification. 11. Connect has two distinct environments: Analytical Compliance Environment (ACE) - is an analytical environment that allows a small number of specialist analysts to manipulate, analyse and profile data. Tax Credit data is placed into the ACE environment to match live claims against HMRC and third party data, enabling identification of undeclared partners, directors, foster carers, landlords, claimants living abroad and claimants with private bank accounts, indicating potential undeclared wealth. Page 4 of 10
More recently it has also proven useful through bulk matching known fraudulent data against HMRC and third party data, reducing processing timescales by avoiding the need for individual searches and cross referencing. Integrated Compliance Environment (ICE) - is a Visualisation Tool which presents linked data, shown pictorially on screen, with the results used to enable further targeted risk assessment. Around 3,000 staff across HMRC use ICE and it is a very useful tool in supporting the identification of organised attacks. Using the private sector to bring in additional compliance capacity 12. HMRC already has a contract with Concentrix, a private company, who carry out checks against potential Tax Credit error and fraud. This novel approach is the first time such checks have been carried out by an external provider. These checks are in addition to HMRC s own error and fraud checking, using the same processes, and add further capacity to HMRC. In the period from November 2014 to 31 March 2016, over 125 million (Annually Managed Expenditure) savings had been made. Continual exploitation of technology 13. HMRC is continually looking at ways of further developing and exploiting the technology that is available. Two examples are the use of the Fraud and Error System Tool (FEAST) and Rules Based System technology (RBS): FEAST - is used to screen incoming Tax Credits claims, using models to automatically identify newly received claims with heightened risk of fraud or error. The models are continually updated and use a combination of predictive analytics, insight and third party information from the Experian Credit Reference Agency. FEAST has prevented gross losses of more than 80 million in 2015-16. RBS is interactive guidance used within HMRC contact centres that, through the exploitation of HMRC data, carries out real-time risking on a customer s change in circumstances. Notification of a change in childcare costs is a good example as the costs can be calculated more accurately preventing fraud, error and debt. Using Child Benefit, schools and health centres data for suspect children 14. HMRC introduced new checks on children including third party checks with schools and health centres. This has meant over 2.2 million gross losses prevented from June 2014 to March 2016, over 0.75 million since September 2015. Banking 15. DWP has now incorporated into Universal Credit third party data checks on bank accounts. The Bank Absolute Wizard supports verification of the bank account nominated to receive Universal Credit payments. It uses third party data to provide Page 5 of 10
additional confidence that the bank account nominated is related to the individual making the claim. 16. DWP is also working with the banking industry to test a proof of concept, by the end of September, to identify wider potential anomalies between bank data and DWP benefit entitlement conditions. Initially, the proof of concept is focusing on data matching to establish risks around excess capital, or where there is consistent activity abroad, which may be incompatible with benefit conditionality. 17. Alongside the proof of concept development, DWP has strong links with the banking industry, both in looking at the strategic use of shared data through the Government Engagement Advisory Group (GEAG) and through the Fraud/Financial Investigation Unit within the Fraud and Error Service. DWP and HMRC are standing members on the GEAG, where Whitehall departments collaborate with the banking industry and explore opportunities for closer working, joint venture and innovation, and ongoing liaison on managing the impact of change. Self-employed 18. Both Departments have started matching annual self-employed tax returns against benefits. This data is very similar to the earnings data received from employers via real-time information and P45/46 data. Potentially it bridges the gap on validating self-employed information, although the data will inevitably reflect previous tax years. 19. This self-employed data also has significant links to undeclared partners / household composition and could help drive out claimants intent on declaring differing income values to differing departments for the purposes of maximising further entitlement. Student Loans (Bursaries) 20. Students can receive an element for child care costs as part of their bursary payment. HMRC is testing the value of this data in identifying a dual provision for those students who are also receiving Child Tax Credit which also includes a provision for childcare, and additionally as a cross check to the numbers of children for whom child care costs are being claimed. Future data initiatives 21. DWP will continue to work with third party providers in order to tackle household composition fraud and error. Data held by other organisations can potentially help DWP link adults to addresses, with analysis of resulting data helping identify at risk cases, leading in turn to the creation of referrals for potential investigation. 22. HMRC is currently working on an automated process for the validation of UK births when claiming Child Benefit, which will reduce potential error and fraud and improve customer service. Page 6 of 10
Annex B Departmental and cross-government data sharing arrangements 23. DWP and HMRC have shared data on a reciprocal basis for a number of years in order to identify claimants who are not meeting the conditionality requirements for DWP benefits, either through work or through excess savings. 24. For example, DWP uses data based around information received from HMRC on interest bearing financial products, including normal bank accounts, ISA, PEP and TESSA savings accounts and lump sums received following successful claims against Person Protection Insurance, to identify undeclared resources. In 2015/16, DWP took receipt of 70 million records and through data matching, identified around 62,000 excess capital cases for intervention. 25. Similarly, earnings data from HMRC, including P45/46 data, which is based on new starters in employment, and Occupational Pensions data, which reflects earnings from non-state pensions, has helped DWP identify income which may not have been properly reflected in benefits assessments. 26. Resulting case cleanse work is carried out by DWP s Fraud & Error Prevention Teams with staff contacting claimants, either by phone or letter, to check all information is up to date and valid, with any mismatches referred for further investigation including potential prosecution where appropriate. DWP estimates that corrective activities over the 2010 spending review period saved 1,454 million in the 4 years ending March 2015. 27. In the same way, HMRC uses data identifying young persons in receipt of Income Support/Job Seeker s Allowance, matching this against Child Benefit records and cross-referencing to Tax Credits. There are also checks that match DWP data against disability elements of Tax Credits and with single claimants. The disability mismatch check, introduced in 2014-15, has resulted in over 13,000 successful interventions and prevented gross losses of over 16 million in two years. The undeclared partner mismatch check, where single claimants have been found to have an undeclared partner, also introduced in 2014-15, has resulted in over 18,000 successful interventions and prevented gross losses of over 80 million in two years. Real Time Information (RTI) 28. Analysis of DWP s fraud and error estimates shows that unreported or undeclared earnings have habitually been one of the biggest causes of overpayments. DWP has as a result drawn on HMRC s RTI system, bulk matching information against existing legacy benefit claims to highlight discrepancies. 29. The RTI system collects earnings and occupational pension data from people on Pay-As-You-Earn and is a key element of the new Universal Credit benefits system, enabling DWP to adjust monthly Universal Credit payment according to people s earnings. Page 7 of 10
30. DWP is using RTI Bulk Data Matching exercises (utilising monthly RTI income data) to help identify people who have not declared (or have incorrectly declared) income from earnings or pension payments when claiming benefits such as Job Seeker s Allowance, Income Support, Pension Credit, Employment Support Allowance and Housing Benefit. DWP expects the use of RTI will save 356 million between 2015-16 and 2020-21. 31. The wider use of RTI will increase accuracy by accessing HMRC earnings, employment and pension data at the start of a claim across a range of benefits. An alerts service will also provide a notification if new earnings or pensions come into payment, or if amounts change during the life of the claim. This is a key part of DWP s prevention strategy, which will help reduce the requirement to detect payment errors after they have occurred. 32. HMRC is using RTI during tax credits renewals to pre-empt overpayments and reduce error and fraud. It is estimated this will save 630 million between 2014-15 and 2016-17. RTI data is also supporting compliance checks against various risk categories, such as undeclared partner and full time non-advanced education. Local authorities 33. DWP has a long established record of sharing data with local authorities, having introduced the Housing Benefit Matching Service (HBMS) in 1996. This replicated the successful data-matching service already in place for the benefits administered directly by DWP. The process involves local authorities sending DWP data extracts of their Housing Benefit caseload. That data is matched against relevant DWP data to identify any data discrepancies and sent electronically to each local authority to progress. 34. New HBMS rules are currently being developed, including improved capital rules, which will be operationally tested with a small group of local authorities ahead of full national rollout 2016-17. 35. Development of a new risk score model for Housing Benefit, which can score, rank or classify claims into groups according to their estimated risk, along with the alignment of all existing and new data matching rules, should reach fruition later this year. 36. DWP has already invested in Automated Transfers to Local Authority Systems (ATLAS). This is a bespoke IT system which provides HMRC Tax Credit and DWP benefit data to local authorities with the facility to automatically update their systems where a change in benefit/tax credit award impacts a Housing Benefit claim. ATLAS became fully operational in 2012. It has delivered substantial savings to date and has helped bring down Housing Benefit fraud and error. Between 2015-16 and 2021-22 DWP estimates that ATLAS will generate savings of 509 million. Page 8 of 10
Abroad fraud 37. There is a requirement for claimants to report their circumstances correctly at all times. Claimants who move abroad must inform DWP. If claimants move abroad without telling the Department, DWP can investigate the claim and can stop benefits. DWP currently has 7 data matching agreements in place. They are with Ireland, Spain, Jersey, Guernsey, Australia, New Zealand and Malta. DWP also buys death data from the USA and Jamaica and subscribes to the Foreign and Commonwealth Office s COMPASS register a list of all UK citizen deaths registered at UK Embassies overseas. These agreements cover approximately 700,000 pensioners; further agreements are in the pipeline. HMRC uses Connect, see paragraph 10, to identify erroneous and fraudulent claims from abroad. DWP Debt Management Credit Reference Agency data 38. DWP Debt Management uses Credit Reference Agency data to support debt recovery activity. From July 2015, a new contract created a joint venture ( Indesser ) between Government and a private sector company to provide the required Credit Reference Agency services to multiple government departments. Both HMRC and DWP now use Indesser to source Credit Reference Agency data. 39. The service covers two elements, namely bulk data matching to gather information on customers propensity to pay back debts and access to credit reference agency data, which enables Debt Management to better understand an individual s financial circumstance and therefore reach agreement on sustainable repayment plans. 40. HMRC is providing employer information to DWP to support the Direct Earnings Attachment process. Direct Earnings Attachments allow Debt Management to recover money directly from an employer without a court order where benefit is not in payment. Credit Reference Agency data to identify potential undeclared partners 41. Undeclared partner is the biggest single cause of financial loss from fraud and error in Tax Credits. However, the amount lost to undeclared partner fraud and error in Tax Credits has reduced since 2012, largely due to increased checks and intelligent targeting following the use of Credit Reference Agency data. 42. HMRC currently contracts data from Transactis, through GB Group, to provide HMRC with data matching capabilities as part of its intervention profiling. From August 2015 to July 2016 Transactis will review 430,000 cases for HMRC in order to identify and target high risk cases, leading to intervention action to identify undeclared partners. During 2015-16 there were 360,000 cases sent with over 14,000 single claims identified with undeclared partners, preventing gross losses of over 220 million. Page 9 of 10
43. DWP is currently exploring similar opportunities with a number of data providers. This is reflective of a joined up approach to data sharing, with each Department learning from the other. Illegal working 44. HMRC has established a reciprocal monthly data matching arrangement with the Home Office. HMRC receives a monthly data feed of migrants without leave to remain where the Home Office have no record of departure and provides bulk Tax Credit and Child Benefit data for the Home Office to match against their systems. Results have helped identify individuals who have no proper recourse to public funds. 45. Similarly, Home Office data has helped DWP identify migrants who are obtaining benefits to which they are not entitled. This is producing effective results. Again, this helps the Home Office and DWP alike. National Border Targeting Centre (Home Office) 46. The National Border Targeting Centre provides details of UK departures and arrivals, primarily via flight Advanced Passenger Information. HMRC analysts are piloting the use of incoming and outgoing travel data to enhance identification of Tax Credit undeclared partners and Child Benefit / Child Tax Credit customers who may have left the UK. 47. DWP is provided with Advanced Passenger Information on request on a case by case basis where there is an allegation of benefit fraud. The data provided details arrivals and departures to and from the UK which is subsequently validated by the associated carrier (airline, rail, ferry) to determine benefit conditionality and inform any potential prosecution. Page 10 of 10