Announced on 27 April, the scheme provided loans of up to £50,000 – or a maximum of 25% of a company’s annual turnover - and in total, the Department for Business, Energy & Industrial Strategy (BEIS) and the British Business Bank (BBB) estimate the scheme to have lent some £38-£48 billion as at 4 November 2020.

Additional figures from HM Treasury (dated 6 September) show that:

• 1.2 million loans have been delivered to businesses, totalling £36.9 billion;
• 90% of loans have bone to businesses with an annual turnover of less than £632,000;
• The real estate, professional services and support activities sectors received the largest amount of support – £8.5 billion from 283,000 loans.

Interestingly, the bounce back loan scheme in particular was subject to less strict eligibility criteria than other COVID-related business loan schemes. For example, it relied on businesses self-certifying application details with limited verification and no credit checks performed by lenders for existing customers.

According to the NAO, this presents significant credit risks as it increases the likelihood that loans are made to businesses which will not be able to repay them, leading to losses of taxpayers’ money.

Whilst the BBB will not currently estimate the overall level of fraud, the Cabinet Office’s Government Fraud Function believes that fraud losses are likely to be significantly above the 0.5% to 5% generally estimated for public sector schemes.

Figures released by BEIS and the BBB suggest that 35-60% of borrowers may default on the loans, which would result in a cost-to-government of £15-£26 billion assuming the scheme lends out a total of £43 billion.

Matthew Cox (pictured above), managing director EMEA, fraud, security & financial crime at FICO, said: “When the bounce back loan scheme was set up, the government rushed so fast because they needed to, and they didn’t put all the normal controls on loans at the bank level. For example, to qualify a business had to have been established before 1 March 2020. Also, there was very little proof of business health needed. As a result, the fraud is estimated at £15-26 billion. As long as a simple fraud check was completed, the government has 100% liability for these loans, which means the taxpayer does.

“From a fraud MO perspective, we are seeing two things;

• Each business was supposed to only be able to make one application, but there are no controls to ensure this. There are businesses that have applied up to five times, so they are getting multipliers on the £50,000 or 25% annual turnover they’re supposed to get. Some business owners may be ready to cash out and could have received five loans for 125% turnover.
• I could pretend to be a director of your company and start making applications for loans on your company. You might not even find out that this has happened until you need to start paying next spring. Fraudsters will try to put mail redirection on businesses, so that people at the company won’t get the mail confirming the loan. But in fact, as we’re in lockdown, those confirmations may be sitting in vacant offices.”

One criticism of the government’s provision of a 100% guarantee to lenders during the pandemic is that it may reduce the lenders’ incentive to recover money from borrowers. If a borrower fails to repay the loan, lenders are required to attempt recovery, but they are still able to claim on the government’s guarantee within “a reasonable time” or if no further payment is likely.

The NAO has called for government to implement a thorough debt-recovery process with lenders and consider how it might better prevent fraud in any future schemes.

Gareth Davies (pictured above), head of the National Audit Officer, explained: “With concerns that many SMEs might run out of money as a result of the pandemic, the government acted decisively to get cash into their hands as quickly as possible. Unfortunately, the cost to the taxpayer has the potential to be very high, if the estimated losses turn out to be correct. Government will need to ensure that robust debt collection and fraud investigation arrangements are in place to minimise the impact of these potential losses to the public purse. It should also take this opportunity to consider now the controls it would put in place to protect against the abuse of any future such schemes.”

The full extent of losses, both credit and fraud, will not emerge until the loans are due to start being repaid from 4 May 2021.

Cox added: “The program was a great success, but there will be a lot of clean-up to do. The government will now have to consider having a consolidated collections process across the banks that made the loans. Initially, the government asked the banks to pump this money out, and now that they’re realizing the potential scale of fraud and bad debt, they’ll be looking to the banks to help get that money back. It will be difficult to do much about impersonation fraud — that money will be gone, siphoned off to cryptocurrency, international payments and cash.

“What can be done now? If I was the government, I would look to implement network analytics used in identity fraud detection across all the applications done through the UK banks. Don’t wait until the payments are due to start — using advanced link analysis, you can find all the connections between loans, like common phone numbers or company names or addresses. Get all the data together, use the analytics to find everyone who made more than one application, put all those into a bucket, then start contacting them. The money may be gone, but no one can abscond with it, they can’t even leave their house! Then run some first-party fraud definitions on the rest. Banks should consider using automated notifications, like SMS and App Push for account holders that have made an application.”

Founded in 1956, FICO currently holds more than 195 US and foreign patents on technologies that aim to increase profitability, customer satisfaction and growth for businesses in many sectors including financial services, telecoms, health care and retail. Based in the tech-hub that is Silicon Valley, the company draws on predictive analytics and data science to improve its customers’ operational decisions.