Risky business – DWP fraud reviews

In January, Kate Osamor MP secured a Westminster Hall debate on the DWP Risk Review Team. She stated that she had been contacted by ‘29 constituents who had had their universal credit [UC] payments suspended indefinitely’. She was told that ‘the cases were under the management of the Risk Review Team, with little to no further explanation of the reason, apart from some claims of suspicion of fraud. Constituents told me that their claims were suspended for months on end—as long as 11 months, in the worst case.’1

The Risk Review Team

DWP set up the Risk Review Team in May 2020 as a response to the risk of organised crime groups seeking to exploit COVID-19 easements, which had been identified by the department’s Integrated Risk and Intelligence Service (IRIS). The role of the Risk Review Team is to review and take action on cases identified by IRIS as being a high fraud risk.

By 17 February 2022, 174,000 claims had been suspended under the Risk Review Process, a percentage of 3.1 per cent. Of the 174,000 claims suspended, the Risk Review Team had ‘de-suspended’ 5,346 claims.2

The war room

IRIS was created, in response to COVID-19, by merging the department’s Risk and Intelligence Service, Cyber Resilience Team and Serious and Organised Crime investigators. DWP officials like to refer to it as ‘the war room’.

IRIS is developing data matching rules and ‘transaction risking’ – applying risk scores to cases to enable the targeting of cases determined to be high risk. The department views the roll-out of risk models, alongside an increased use of data analytics and greater automation, as being part of a long-term strategic transformation required to address fraud and error.3

The missing centrepiece returns?

The creation of an integrated risk and intelligence unit has been a longstanding aim of the department. The 2010 DWP/HM Revenue and Customs (HMRC) strategy on tackling fraud and error included plans, focused on prevention, for an integrated risk and intelligence unit to develop advanced data matching skills to complement the department’s existing Generalised Matching Service and the Housing Benefit Data Matching Service.4 DWP Accounts for 2013 –14 confirmed the continued commitment to establish IRIS to shift to ‘risk based’ fraud prevention, combining new IT and a blend of analytical/intelligence capability.5 However, the National Audit Office found that IRIS was ‘missing’ from the UC Pathfinder6 and that the DWP, despite having originally considered IRIS to be the centre-piece of its programme, was unable to clearly explain its reasons for scrapping the programme.7 The DWP trialled differentiated interventions based on risk.8

By 2018 the department planned to develop a fully automated risk analysis and intelligence system, the Risk and Intelligence Service (RIS).9

By September 2020, the department claimed that IRIS, the successor to the RIS, was assessing the risk of fraud on cases according to 84 different categories and carrying out ‘test and learn’ investigations on cases determined as being high risk, with the aim of rolling out the work in 2021.10 The department told the Public Accounts Committee that it aimed, in near to real time, to assess every claim using transaction risking and assess how much it trusts the information in the claim.The department received extra funding in 2021, which it plans to use to expand IRIS, further develop transaction risking and expand work aimed at preventing and detecting fraud.11 By March 2022, the DWP claimed that IRIS had more than 600 data matching rules.12

Unequal impact?

Kate Osamor MP states that every one of her 29 constituents who had had their benefit suspended by the Risk Review Team were Bulgarian nationals. The DWP says it is unable to report on the nationality of people whose awards have been suspended and that nationality is not a factor in allocating risk scores. The department states that its use of algorithms is subject to oversight13 The department says that it has a draft Data Science Ethics Framework for machine learning that (it says) ensures it considers bias and discrimination in the design of predictive models and that the IRIS is working with legal experts to ensure that the ethical and legal position of its products have been considered ahead of wider automation.14 It is unclear how, if the DWP is failing to monitor the impact of transaction risking by nationality, that would impact on its ability to consider bias and discrimination.

Assisting claimants

The DWP acknowledges that some claimants struggle with English, which can lead to delays in reinstating benefit, but that interpreters are made available. It says claimants are notified of the suspension via their journal and text, that they should never be unaware of the action they need to take, and that once entitlement is established, benefits are put into payment as soon as possible.

CPAG is acting on behalf of a claimant who had her ongoing award suspended at a time that she had settled status because a doubt had been raised about her right to reside during a past period when she had pre-settled status. She was not asked for further information until six weeks after her UC award was suspended. Six months later, her award is still suspended despite her having: provided the information within days of the request; attended job centre appointments to provide evidence; asking the DWP for updates on over 30 occasions; and having involved her MP.

The department also says that data on the average length of claim suspension is not available but that it is dependent on the timely provision of information, and that the Risk Review Team takes care to understand potential vulnerability before suspending benefit. Contact from a vulnerable claimant will, the DWP says, be dealt with by a dedicated team who will discuss the claim in detail and provide support.

The suspension and termination guide states that if suspension would or does cause hardship, benefit must not be suspended and be reinstated immediately – relevant factors include age, ill health, impact on children and financial commitments. How this guidance might be applied in suspected fraud cases is unclear. In many cases, it might depend on the claimant providing information showing that s/he is at risk of hardship – information which may be sufficient to remove the fraud doubt altogether. Letters sent when payment is suspended invite the customer to contact the office if the decision will cause hardship, but letters sent in suspected fraud cases do not.

Guidance recommends that suspension is looked at again after a maximum of one month to determine whether the suspension can be lifted.15

The DWP has guidance covering circumstances in which claim suspension may not be appropriate.16

If the department refuses to lift a suspension when asked to do so, then the only means of challenging this is by judicial review.17

Transparency

Important questions remain unanswered. For example, it is unclear whether a higher level of risk must be identified to justify suspending an individual’s existing benefit award as part of fraud detection activity as compared to the level of risk required to justify additional checks being put in place prior to awarding benefit, or before increasing an award, as part of fraud prevention activity.

Clearly, the DWP wants to deploy automated algorithms to carry out transaction risking, but it remains unclear whether the department has actually developed and deployed this capability. DWP officials have stated that an algorithm carries out data matching, and that while automation helps guide DWP work, the ultimate decision is made by individuals. The department says that it does not use artificial intelligence software, predictive modelling or automated decision-making software to make decisions regarding benefit entitlement18 However, this fails to acknowledge that the interaction between algorithmic tools and human decision making is complex and does not eliminate the risk that bias within the algorithm will influence the human decision.

Privacy International states that the fact that ‘decisions to investigate are the result of an algorithm sets the ground for inequality especially when the agency responsible refuses and/or is unable to provide clarity as to how someone can be flagged as a suspect of fraud in the first place’. It goes on to note that we do not know:

• the categories of data being used to flag someone as likely to be committing fraud;
• the relevant criteria used by any fraud-detection systems operated by the DWP;
• the code of the algorithm.19

Lord Sales, Justice of the Supreme Court, has stated that:

Through lack of understanding and access to relevant information, the power of the public to criticise and control the systems which are put in place to undertake vital activities in both the private and the public sphere is eroded. Democratic control of law and the public sphere is being lost.
[…]
Precisely because algorithmic systems are so important in the delivery of commercial and public services, they need to be designed by building in human values and protection for fundamental human interests. For example, they need to be checked for biases based on gender, sexuality, class, age, ability.20

Legal challenge

The Greater Manchester Coalition of Disabled People (GMCDP) has sent a pre-action letter which asks the government to explain how its data matching system, the General Matching Service, works and what, if anything, it has done to eliminate bias. GMCDP has expressed concerns that disabled people are disproportionately impacted.21 DWP officials did not know how many disabled people were being investigated.22 It is unclear whether the experiences of GMCDP are related to the actions of the Risk Review Team.

The pre-action letter states that government must be transparent in this type of decision making, citing Article 5(1)(a) of the General Data Protection Regulation, Article 8 of the European Convention on Human Rights, and the common law principle of transparency.