Scams

The Scams Prevention Framework Bill has passed through the national legislature. The expectation is that it will set out consistent and enforceable obligations for businesses in key sectors, with overarching principles for compliance by all members of designated sectors. 

The ACCC has announced that the Commission will 'closely monitor regulated entities’ compliance with principles to prevent, detect, disrupt, respond to and report scams. The legislation empowers the ACCC to investigate potential breaches and take enforcement action where entities do not take reasonable steps to fulfill obligations under the principles, with fines of up to $50 million and scope for consumers to seek redress from regulated businesses. The ACCC will be involved in development of the formal designation of sectors, sector codes, and consumer and industry guidance. The initial sectors will be banks, certain digital platforms (including social media) and telecommunications providers. 

 Under the Framework, the ACCC will enforce the digital platforms sector scams code and take enforcement action where digital platforms breach obligations. The Australian Securities and Investments Commission will be the regulator for the banking sector code. The Australian Communications and Media Authority will be the regulator for the telecommunications sector code. There will be a single external dispute resolution body under the new Framework, involving the Australian Financial Complaints Authority (AFCA). 

A Treasury Minister may, by legislative instrument, designate one or more businesses or services to be a regulated sector for the purposes of the Framework. This designation instrument is subject to Parliamentary scrutiny through the disallowance process and sunsetting. The Treasury Minister may designate an individual business or service, or designate businesses or services by class, meaning that the Minister may in effect designate specific entities to be a 'regulated sector' within a designation instrument. 

 Without limiting the businesses or services that may be designated, a Treasury Minister may designate the following classes of businesses or services to be a regulated sector (or a subset of those business or services): 

 • banking businesses, other than State banking (within the meaning of paragraph 51(xiii) of the Constitution) not extending beyond the limits of the State concerned; 

• insurance businesses, other than State insurance (within the meaning of paragraph 51(xiv) of the Constitution) not extending beyond the limits of the State concerned; 

• postal, telegraphic, telephonic or other similar services (within the meaning of paragraph 51(v) of the Constitution), which can include, but is not limited to: - carriage services within the meaning of the Telecommunications Act; - electronic services within the meaning of the Online Safety Act 2021, such as social media services within the meaning of that Act; - broadcasting services within the meaning of the Broadcasting Services Act 1992. 

 The description of the businesses and services are based on the relevant constitutional heads of power and provide flexibility for the Framework to be expanded to a wide range of sectors over time. It is not intended to provide a roadmap of the exact sectors the Government is proposing to designate. The Government's intention is to initially designate telecommunications services, banking services and certain digital platform services. 

 Before designating a sector to be subject to the Framework, the Minister must consider all the following matters: 

 • Scam activity in the sector. For example, the Minister may identify that certain businesses or services experience high levels of scam activity.   

• The effectiveness of existing industry initiatives to address scams in the sector. For example, there may be existing initiatives in a sector seeking to protect against scams but do not appropriately address scam  activity in that sector.   

• The interests of persons who would be Framework consumers of regulated services for the sector if the Minister were to make the designation. For example, designation may be appropriate if the Minister considers that consumers would be better protected against scams arising out of activity in a sector if it is subject to the Framework, rather than relying on existing frameworks.   

• The likely consequences (including benefits and risks) to the public and to the businesses or services making up the sector if the Minister were to make the designation.   

• Any other matters the Minister considers relevant to the decision to designate a sector to be subject to the SPF. For example, this could include the compliance and regulatory costs of designating sectors, the privacy or confidentiality of consumers' information, the regulatory impact of designation, the outcomes of consultation with impacted entities and consumers, and scam activity in the relevant sector in another jurisdiction. 

 Before designating a sector, the Minister must also consult relevant consumer groups and the businesses or services making up the sector, or such associations or other bodies representing them as the Minister thinks appropriate. Given the nature and scope of the requirements under the Framework, this is 'appropriate to ensure consumers and affected entities are given notice of the Government's intention to designate the relevant sector. It will also provide these stakeholders with an opportunity to give feedback on the details of the designation instrument, including on any application provisions or transition period before the SPF comes into effect for the sector'.

What is a 'Scam'? The legislation seeks to provide certainty on the scope of harms intended to be captured by the Framework, with a scam being a direct or indirect attempt (whether or not successful) to engage an  Framework consumer of a regulated service where it would be reasonable to conclude that the attempt: 

 • involves deception; and 

• would, if successful, cause loss or harm including the obtaining of SPF personal information of, or a benefit (such as a financial benefit) from, the SPF consumer or the SPF consumer's associates. 

 The elements of the definition of 'scam' are objective in nature and do not require the scammer's state of mind to be established. This definition is deliberately broad to capture the wide range of activities scammers engage in and their ability to adapt and to adopt evolving behaviours over time. The Framework rules can also provide an appropriate safeguard to exclude conduct that is not intended to be captured under the Framework. 

 The definition of scam captures both successful scams which have caused loss or harm to a Framework consumer, and scam attempts which have not yet resulted in loss or harm to a Framework consumer. This reflects the obligations in the principles, which require regulated entities to take action against scams, regardless of whether the scam has resulted in loss or harm to a Framework consumer or an associate of the consumer. The use of 'attempt' in the definition of scam has its ordinary meaning, which is intended to cover efforts made to engage a Framework consumer. There may be an attempt to engage a Framework consumer even if the attempt is indirect, such as where it is directed at a cohort which includes the consumer or is directed at the public more generally. The attempt to engage an SPF consumer may be a single act or a course of conduct. 

 The legislation introduce the concept of an 'SPF consumer'. The obligations imposed on regulated entities are often in relation to a Framework consumer. This is intended to clearly set out the scope of obligations under the Framework and who they are designed to protect.  A Framework consumer of a regulated service is: • a natural person, or a small business operator, who is or may be provided or purportedly provided the service in Australia; or • a natural person who is ordinarily resident in Australia and is or may be provided or purportedly provided the service outside of Australia by a regulated entity that is either an Australian resident or is providing or purportedly providing the service through a permanent establishment in Australia.  The meaning of 'Australian resident' and 'permanent establishment' with respect to the regulated entity in this context leverages the existing established definitions in the ITAA 1997. 

A Framework consumer is intended to cover any natural person or small business operator who is in Australia when they are provided the regulated service, regardless of where that service is based (for example, the regulated service may be based overseas). This includes natural persons who are only temporarily in Australia. The definition also intends to cover any natural person who is ordinarily resident in Australia but is overseas when they are provided a regulated service that is based in Australia. A Framework consumer could be 

 • an Australian resident in Australia using either an Australian-based or overseas-based messaging service that is offered in Australia; 

• a person ordinarily resident in Australia who is overseas but using an Australian-based banking service; or 

• a tourist visiting Australia using an Australian-based or overseas-based telecommunication service that is offered in Australia. 

 It is not intended that a foreign entity will be regulated with respect to consumers in foreign markets. For example, where an Australian consumer is overseas and is impacted by a scam on a social media service offered by an entity based overseas, this is not intended to be within the scope of the Framework. 

 Small businesses are not excluded from being Framework consumers based on their corporate structure. The small business may be in the form of a sole trader, company, unincorporated association, partnership or trust. Whether a small business is a small business operator for the purposes of the Framework will differ slightly depending on whether the small business is a body corporate or not.  

If a small business is a body corporate, it is a small business operator if it meets all of the following conditions: • the sum of the business' employees and the employees of any body corporate related to the business, is less than 100 employees; • the annual turnover of the business during the last financial year is less than $10 million; and • the business has a principal place of business in Australia.   If a small business is not a body corporate, it is a small business operator if it meets all of the following conditions: • the business has less than 100 employees; • the annual turnover of the business, worked out as if the person were a body corporate, during the last financial year is less than $10 million; and • the business has a principal place of business in Australia.

Cheating

The Financial Times comments that Deloitte in the UK has reinstated in-person interviews for its graduate scheme, reflecting pressure from the Financial Reporting Council about reducing the potential for cheating in virtual assessments. 

 Deloitte stated it will resume to in-person interviews from this month for those applying for its graduate and apprenticeship programmes, switching back from a fully online recruitment process during COVID.

The FRC's lapidary annual review of audit quality at Deloitte, published in July, characterised Deloitte’s fully online recruitment arrangements as posing potential “risks”. In contrast the other Big Four were commended for taking steps to reduce the risk of cheating in online recruitment tests, for example conducting in-person interviews and assessments. 

 The FT states

 The FRC has in recent years raised concerns that some recruitment tests were susceptible to cheating, saying that this type of misconduct affected the integrity of the profession. It said in July that it had continued to find examples of cheating over the past year, adding that this was “unacceptable”. It declined to say at which firms it found examples of cheating. 

Deloitte said ... “In-person interviews provide candidates with an opportunity to see first-hand what it’s like to work at Deloitte and meet the people they will be working with. The initial stages of the application process will remain virtual.” 

Deloitte declined to say whether the FRC found any examples of cheating by candidates in online recruitment tests at the firm. One person familiar with the details said the firm “investigates matters” if there are concerns that its people are not demonstrating the “highest professional standards”.

Identity Crime

John Darwin famously sought benefits by faking his own death in a canoeing accident. Jesse Kipf decided to skip the cold water and relied on what a US court has addressed as Cyber Intrusion and Aggravated Identity Theft. 

The media release from the U.S. Attorney's Office, Eastern District of Kentucky states in part 

 The Defendant committed cyber intrusions, by hacking into state death registry systems to fake his own death to avoid paying his child support obligations. He also hacked into private businesses and attempted to sell access to networks on the dark web 

According to his plea agreement, Kipf intentionally accessed a computer without authorization and then obtained information from a protected computer for his own private gain and in furtherance of identity theft. Specifically, in January 2023, Kipf accessed the Hawaii Death Registry System, using the username and password of a physician living in another state, and created a “case” for his own death. Kipf then completed a State of Hawaii Death Certificate Worksheet, assigned himself as the medical certifier for the case and certified his death, using the digital signature of the doctor. This resulted in Kipf being registered as a deceased person in many government databases. Kipf admitted that he faked his own death, in part, to avoid his outstanding child support obligations. 

Kipf also infiltrated other states’ death registry systems, private business networks, and governmental and corporate networks using credentials he stole from real people. He then tried to sell access to these networks to potential buyers on the dark net, an overlay network within the internet that can only be accessed with specific software, configurations, or authorization and is commonly associated with the sale of illicit goods and services. ... 

“Working in collaboration with our law enforcement partners, this defendant who hacked a variety of computer systems and maliciously stole the identity of others for his own personal gain, will now pay the price,” said Michael E. Stansbury, Special Agent in Charge, FBI, Louisville Field Office. “Victims of identity theft face lifelong impact and for that reason, the FBI will pursue anyone foolish enough to engage in this cowardly behavior.” 

Under federal law, Kipf must serve 85 percent of his prison sentence. Upon his release from prison, he will be under the supervision of the U.S. Probation Office for three years. The damage to governmental and corporate computer systems and his failure to pay his child support obligations amounted to a total of $195,758.65.

The Darwin fraud is discussed in R v Darwin and Anor [2009] EWCA Crim 860 noted here.

Identity Crime

In Re Terei (No 3) [2024] VSC 423 Incerti J has addressed a bail revocation application, stating that 

Ms Terei is likely to be arrested and interviewed in relation to a charge of perverting the course of justice. This offence relates to Ms Terei claiming Aboriginality from her maternal line, knowing this to be untrue, during bail applications in this Court on 30 May and 17 June 2024 ... 

[6] There is in many ways nothing remarkable about this course of events. Ms Terei is a vulnerable person who presents to the Court with complex mental health issues, a history of family violence, serious drug abuse and a significant history of interface with the justice system. Her historical offending does not involve crimes of violence. Ms Terei was always going to pose a risk on bail, but it was my view that the risk could be ameliorated with strict bail conditions.\ 

[7] The unusual and troubling aspect is the allegation that Ms Terei has attempted to pervert the course of justice by lying about her Aboriginality. 

[8] Section 3 of the Bail Act 1977 (Vic) relevantly provides that: Aboriginal person means a person who – (a) is descended from an Aboriginal or Torres Strait Islander; and (b) identifies as an Aboriginal or Torres Strait Islander; and (c) is accepted as an Aboriginal or Torres Strait Islander by an Aboriginal or Torres Strait Island community; 

[9] Before this Court there was evidence by way of affidavit that Ms Terei inherited her Aboriginality from her maternal line and that her mother passed away when she was three years old. This evidence was obtained on instructions from Ms Terei. 

[10] In most cases, and certainly in my experience, proof of Aboriginality has not been an issue and is ordinarily not challenged. Evidence of a person’s Aboriginality is provided by affidavit as occurred in this case. This is an appropriate manner in which evidence of this kind is to be provided to the Court for the purpose of a bail application. I can see no reason why this should change or that an applicant or their legal representative should be required to do anything more than set out the basis of a person’s Aboriginality as was done in this case. The circumstances of this case are unique and allegedly involve blatant deception about an individual’s Aboriginality. ... 

[12] The evidence before me, arising from enquiries made following comments during these calls, is that Ms Terei’s mother is from New Zealand, is not Aboriginal and still lives in New Zealand. It is therefore alleged that Ms Terei claimed her Aboriginality from her maternal line, knowing it was untrue, ‘in order to have the Court consider s 3A of the Bail Act when she was not entitled to do so’. While this is not the time to determine the current allegations made against Ms Terei, the Arunta phone recordings provide strong evidence that Ms Terei is not an Aboriginal person and sought to gain some benefit in the bail application on the basis of identifying as an Aboriginal person.

Inexactitude

The Guardian reports that Townsville's mayor has  abeen  referred to the Queensland Crime and Corruption Commission last week after allegations he embellished his military record by stating he spent five years in the army, including time with “SAS Swanbourne”. 

 In an interview with A Current Affair on Thursday night, Thompson conceded he had not spent five years in the service, as he claimed during his campaign, and blamed “100-plus” concussions and epilepsy on his poor recollection. 

“Look, I honestly, hand-on-heart, thought it was five years,” he told Nine. “Those who know me know that I’ve had multiple concussions – 100-plus – and I suffer from epilepsy. “That’s not an excuse. But what it says is you’re going to forget things from time to time.” ...   

In addition to embellishing his military record, Thompson also admitted he “never completed” university, despite describing himself as a “business graduate” during his campaign and claiming he had two degrees. Thompson’s LinkedIn account previously listed a bachelor of science, occupational safety and health technology with Curtin University and a bachelor of commerce, accounting and marketing from Griffith University. These degrees were removed from his profile after he was sworn into office.

Pseudologia

Serial identity offender Samantha Azzopardi is in the news again, with The Age reporting that she has been banned from stalking or attempting to locate a 'protected person', in addition to multiple identity charges (including obtaining financial advantage by deception). 

She is alleged to have dishonestly obtained $18,837 by portraying herself as being from Europe and in need of support services for family violence and child sexual abuse. Through that portrayal she is reported as having deceptively obtained accommodation, vouchers and medical costs from specialist family violence support services. 

Last week it was revealed that she had been arrested in Northcote following allegations of deceptive conduct in Dandenong, Brighton and Reservoir. Unsurprisingly, bail was refused.

As noted elsewhere in this blog she has previously pretended to be more than 70 different people, including a child orphan and a Russian gymnast. A year ago she was sentenced in Downing Local Court (Sydney) to been sentenced to 17-months behind bars - that time regarding claims she was a 14-year-old child abuse victim from France - but was out after three months.

Registration Fakes

AHPRA reports a woman has been convicted for the second time for holding herself out as a registered nurse to her employer, staff and patients, becoming the first Australian sent to jail for pretending to be a registered health practitioner. 

Alison Mibus, who has never been registered as a nurse, pleaded guilty to six charges relating to claiming to be a registered nurse. She was sentenced under the National Law to four months and 28 days imprisonment, to be suspended after serving one month. The ABC separately reports Mibus had also previously stolen $136, 290 from another workplace.

Mibus faced five charges of holding herself out as a registered nurse, and one charge of claiming to be qualified to practise as a nurse, in breach of section 116 of the Health Practitioner Regulation National Law 2009. 

In January 2019 Mibus applied for a job at as practice manager at a South Australian medical clinic. In her application she falsely claimed to be a registered nurse with years of nursing experience. The position did not require the registration but the claim appears to have given her an advantage over other applicants.

During employment from March 2020 to September 2020 Mibus represented herself as a registered nurse in multiple emails to a range of recipients, including SA Health. One apparently misled colleague allowed Mibus to administer vaccinations to his parents and himself. AHPRA states that Mibus lied to colleagues that she was undertaking clinical nursing shifts at another medical centre so that she could ‘maintain [my] registration'. 

 During an additional internal job application Mibus again falsely claimed to have nursing registration and qualifications. The  deception was discovered after she resigned.

Mibus had previously been prosecuted by AHPRA for claiming to be a registered nurse, being sentenced in February 2020 on three counts of holding herself out to be a registered nurse by administering vaccines and treating patients while employed as a practice manager at a different medical centre during 2017. She was fined $10,500 for that offending. At the time the maximum penalty was a $30,000 fine. AHPRA notes that Australian jurisdictions apart from WA have increased the maximum penalty to a fine of $60,000, three years imprisonment, or both. 

In 2016 the ABC  reported anotherAdelaide woman had passed herself off as a registered nurse for five years. 

 Jennifer Anne Reed  pleaded guilty to seven counts of deception by using the identity of a registered nurse to work at several aged care homes in South Australia between 2009 and 2014. Reed reportedly continued her offending in New South Wales until December 2014. 

She had worked as the director of nursing for Moonta Health and Aged Care in 2014 and was responsible for administering "drugs of dependence" at Trevu House. She received wages of almost $350,000 over the five years. 

 Prosecutors said Reed's deception involved producing fake documents to secure work, including a false CV and references. 

 Reed was sentenced to four years for deception offences and given a non-parole term of 14 months. She also was ordered to pay almost $30,000 to the ATO for undeclared earnings.

Digital Identity

The Explanatory Memo for the Identity Verification Services Bill 2023 (Cth), ahead of the foreshadowed privacy reforms noted in the preceding post, states 

1. Secure and efficient identity verification is critical to minimising the risk of identity fraud and theft, and protecting the privacy of Australians when seeking to access government and industry services and engage with the digital economy. The identity verification services are the only national capability that can be used by industry and government agencies to securely verify the identity of their customers. 

2. Identity verification services are a series of automated national services offered by the Commonwealth to allow government agencies and industry to efficiently compare or verify personal information on identity documents against existing government records, such as passports, driver licences and birth certificates. 

3. 1:1 matching services (the Document Verification Service and the Face Verification Service) are now used every day by Commonwealth, State and Territory government agencies and industry to securely verify the identity. In 2022, the DVS was used over 140 million times by approximately 2700 government and industry sector organisations, and there were approximately 2.6 million FVS transactions in the 2022-23 financial year. 

4. Examples of the current uses of the DVS and FVS include:

• verifying the identity of an individual when establishing a myGovID to access online services, including services provided by the Australian Taxation Office 

• financial service providers, such as banks, when seeking to verify the identity of their customers and to meet the 'know your customer' obligation under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) 

• Government agencies when providing services, disaster relief and welfare payments, and 

• Commonwealth, state and territory government agencies verifying identity in order to provide or change credentials. 

5. The Identity Verification Services Bill 2023 establishes new primary legislation that provides a legislative framework to support the operation of the identity verification services. The Bill will support the efficient and secure operation of the services without compromising the privacy of the Australian community. 

6. The IVS Bill will:

• authorise 1:1 matching of identity through the identity verification services, with consent of the relevant individual, by public and private sector entities. This will be enabled by: o the Document Verification Service which provides 1:1 matching to verify biographic information (such as a name or date of birth), with consent, against government issued identification documents; o the Face Verification Service which provides 1:1 matching to verifiy biometric information (in this case a photograph or facial image of an individual), with consent, against a Commonwealth, state or territory issued identification document (for example, passports and driver licences); and o the National Driver Licence Facial Recognition Solution which enables the FVS to conduct 1:1 matching against State and Territory identification documents such as driver licences. 

• authorise 1:many matching services through the Face Identification Service only for the purpose of protecting the identity of persons with a legally assumed identity, such as undercover officers and protected witnesses. The protection of legally assumed identities will also be supported by the use of the FVS. All other uses of 1:many matching through the identity verification services will not be authorised, and will therefore be prohibited. 

• authorise the responsible Commonwealth department - in this case the Attorney-General's Department - to develop, operate and maintain the identity verification facilities (the DVS hub, the Face Matching Service Hub and the NDLFRS). These approved identity verification facilities will be used to provide the identity verification services. These facilities will relay electronic communications between persons and bodies for the purposes of requesting and providing identity verification services. 

7. Subject to robust privacy safeguards, the Department will be authorised to collect, use and disclose identification information through the approved identity verification facilities for the purpose of providing identity verification services and developing, operating and maintaining the NDLFRS. Offences will apply to certain entrusted persons for the unauthorised recording, disclosing or accessing protected information. 

8. The Bill ensures that the operation the identity verification services and requests for the use of those services are subject to privacy protections and safeguards. These include consent and notice requirements, privacy impact assessments, requirements to report security breaches and data breaches, complaints handling, annual compliance reporting and transparency about how information will be collected, used and disclosed. Furthermore, privacy law and/or the Australian Privacy Principles will apply to almost all entities that seek to make a request for identity verification services. These privacy protections and safeguards will be set out in participation agreements. 

9. Government authorities that supply identification information that is used for the purpose of identity verification services will also be subject to the privacy protections and safeguards captured in the participation agreement. Breaches of participation agreements can lead to suspension or termination of the agreement, meaning that the entity would no longer be able to request identity verification services. 

10. States or territories seeking to contribute to the NDLFRS will be subject to privacy obligations and safeguards, which are required by the Bill and will be set out in the NDLFRS hosting agreement. 

11. The Bill requires parties to the agreement to agree to be bound by the Privacy Act or a state or territory equivalent, or agree to be subject to the Australian Privacy Principles. The Bill requires state or territory authorities to inform individuals if their information is stored on the NDLFRS (and provide for a mechanism by which those persons can correct any errors), inform the Department and individuals whose information is stored on the NDLFRS of any data breaches, establish a complaints mechanism, and report annually to the Department on the party's compliance with the agreement. The Bill enables states and territories to limit the use of identity information stored on the NDLFRS, and requires the Department to maintain the security of the NDLFRS. The Department may suspend or terminate access to the NDLFRS in the event of a party's non-compliance with legislative obligations. 

12. To protect the privacy of Australians, the Department will be required to maintain the security of electronic communications to and from the approved identity verification facilities, and the information held in the NDLFRS. This information and communications must be encrypted and data breaches reported. 

13. There will be transparency about the operation of the approved identity verification facilities, including through extensive annual reporting requirements and annual assessments by the Information Commissioner on the operation and management of the facilities. 

14. The Bill reflects and seeks to implement aspects of the Commonwealth's commitments under the Intergovernmental Agreement on Identity Matching Services (Intergovernmental Agreement). The Intergovernmental Agreement provides that jurisdictions would share and match biographic and biometric information, with robust privacy safeguards, through the identity verification services. 

15. The Bill will be supported by the Identity Verification Services (Consequential Amendments) Bill which amends the Australian Passports Act 2005 to provide a clear legal basis for the Minister to disclose personal information for the purpose of participating in one of the following services to share or match information relating to the identity of a person: • the DVS or the FVS, or • any other service, specified or of a kind specified in the Minister's determination. 

16. The Consequential Amendments Bill will also allow for automated disclosures of personal information to a specified person via the DVS or the FVS. In combination, this comprehensively authorises the operation of the DVS and FVS in relation to Australian travel documents regulated by the Australian Passports Act.

Profiling and Matching

The Explanatory Memo for the Identity Verification Services Bill 2023 (Cth) states 

 Identity verification services are a series of automated national services offered by the Commonwealth to allow government agencies and industry to efficiently compare or verify personal information on identity documents against existing government records, such as passports, driver licences and birth certificates. 

1:1 matching services (the Document Verification Service and the Face Verification Service) are now used every day by Commonwealth, State and Territory government agencies and industry to securely verify the identity. In 2022, the DVS was used over 140 million times by approximately 2700 government and industry sector organisations, and there were approximately 2.6 million FVS transactions in the 2022-23 financial year. 

Examples of the current uses of the DVS and FVS include:

• verifying the identity of an individual when establishing a myGovID to access online services, including services provided by the Australian Taxation Office 

• financial service providers, such as banks, when seeking to verify the identity of their customers and to meet the ‘know your customer’ obligation under the Anti-Money Laundering and Counter Terrorism Financing Act 2006 (Cth) 

• Government agencies when providing services, disaster relief and welfare payments, and 

• Commonwealth, state and territory government agencies verifying identity in order to provide or change credentials. 

The Identity Verification Services Bill 2023 establishes new primary legislation that provides a legislative framework to support the operation of the identity verification services. The Bill will support the efficient and secure operation of the services without compromising the privacy of the Australian community. 

The IVS Bill will:

• authorise 1:1 matching of identity through the identity verification services, with consent of the relevant individual, by public and private sector entities. This will be enabled by:

 the Document Verification Service which provides 1:1 matching to verify biographic information (such as a name or date of birth), with consent, against government issued identification documents; 

the Face Verification Service which provides 1:1 matching to verifiy biometric information (in this case a photograph or facial image of an individual), with consent, against a Commonwealth, state or territory issued identification document (for example, passports and driver licences); and 

the National Driver Licence Facial Recognition Solution which enables the FVS to conduct 1:1 matching against State and Territory identification documents such as driver licences. 

• authorise 1:many matching services through the Face Identification Service only for the purpose of protecting the identity of persons with a legally assumed identity, such as undercover officers and protected witnesses. The protection of legally assumed identities will also be supported by the use of the FVS. All other uses of 1:many matching through the identity verification services will not be authorised, and will therefore be prohibited. 

• authorise the responsible Commonwealth department – in this case the Attorney General’s Department – to develop, operate and maintain the identity verification facilities (the DVS hub, the Face Matching Service Hub and the NDLFRS). These approved identity verification facilities will be used to provide the identity verification services. These facilities will relay electronic communications between persons and bodies for the purposes of requesting and providing identity verification services. 

Subject to robust privacy safeguards, the Department will be authorised to collect, use and disclose identification information through the approved identity verification facilities for the purpose of providing identity verification services and developing, operating and maintaining the NDLFRS. Offences will apply to certain entrusted persons for the unauthorised recording, disclosing or accessing protected information. 

The Bill ensures that the operation the identity verification services and requests for the use of those services are subject to privacy protections and safeguards. These include consent and notice requirements, privacy impact assessments, requirements to report security breaches and data breaches, complaints handling, annual compliance reporting and transparency about how information will be collected, used and disclosed. Furthermore, privacy law and/or the Australian Privacy Principles will apply to almost all entities that seek to make a request for identity verification services. These privacy protections and safeguards will be set out in participation agreements. 

Government authorities that supply identification information that is used for the purpose of identity verification services will also be subject to the privacy protections and safeguards captured in the participation agreement. Breaches of participation agreements can lead to suspension or termination of the agreement, meaning that the entity would no longer be able to request identity verification services. 

States or territories seeking to contribute to the NDLFRS will be subject to privacy obligations and safeguards, which are required by the Bill and will be set out in the NDLFRS hosting agreement. 

The Bill requires parties to the agreement to agree to be bound by the Privacy Act or a state or territory equivalent, or agree to be subject to the Australian Privacy Principles. The Bill requires state or territory authorities to inform individuals if their information is stored on the NDLFRS (and provide for a mechanism by which those persons can correct any errors), inform the Department and individuals whose information is stored on the NDLFRS of any data breaches, establish a complaints mechanism, and report annually to the Department on the party’s compliance with the agreement. The Bill enables states and territories to limit the use of identity information stored on the NDLFRS, and requires the Department to maintain the security of the NDLFRS. The Department may suspend or terminate access to the NDLFRS in the event of a party’s non-compliance with legislative obligations. 

To protect the privacy of Australians, the Department will be required to maintain the security of electronic communications to and from the approved identity verification facilities, and the information held in the NDLFRS. This information and communications must be encrypted and data breaches reported. 

There will be transparency about the operation of the approved identity verification facilities, including through extensive annual reporting requirements and annual assessments by the Information Commissioner on the operation and management of the facilities. 

The Bill reflects and seeks to implement aspects of the Commonwealth’s commitments under the Intergovernmental Agreement on Identity Matching Services (Intergovernmental Agreement). The Intergovernmental Agreement provides that jurisdictions would share and match biographic and biometric information, with robust privacy safeguards, through the identity verification services. 

The Bill will be supported by the Identity Verification Services (Consequential Amendments) Bill which amends the Australian Passports Act 2005 to provide a clear legal basis for the Minister to disclose personal information for the purpose of participating in one of the following services to share or match information relating to the identity of a person:

- the DVS or the FVS, or 

- any other service, specified or of a kind specified in the Minister’s determination. 

The Consequential Amendments Bill will also allow for automated disclosures of personal information to a specified person via the DVS or the FVS. In combination, this comprehensively authorises the operation of the DVS and FVS in relation to Australian travel documents regulated by the Australian Passports Act.

The Memo also states

... subclause 6(4) of the Bill ensures certain types of information are excluded and cannot be sought or requested through the identity verification services. This information is: 

•  information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a trade union, sexual orientation or practices, or criminal record (paragraph (a)) 

• health information about an individual (as defined in section 6FA of the Privacy Act) (paragraph (b)), and 

• genetic information about an individual (paragraph (c))

Identity Resilience

The new National Strategy for Identity Resilience replaces the 2012 National Identity Security Strategy. It features Shared Principles for Resilient Identities -

 1 Seamless Commonwealth, state and territory digital ID systems will support identity resilience 

Digital IDs provide a highly secure credential which can be used to prove identity online. They can reduce the amount of information you share, as they allow you to share only the information needed, which means you do not need to share all the details of a valuable identity document such as a passport. Governments will work together to achieve interoperability between digital ID systems and credentials so that Australians can access services in any jurisdiction. 

2 Identity needs to be inclusive 

Australian governments are committed to supporting vulnerable cohorts to access services, and to supporting Australians that choose not to use digital services or credentials. Indigenous Australians, people from culturally and linguistically diverse communities, and people with disabilities are disproportionately targeted by certain types of scams, and may also have more difficulty accessing or understanding ways to remediate compromises to their ID. Older Australians are also vulnerable and reported the highest losses to scams in 2021, and may be less likely to adopt digital credentials or other technologies. Where practical, Australian governments are committed to providing digital and non-digital options so that individuals have a choice in how they manage their identity. 

3 Individuals, industry and government have a role to play 

Individuals, industry and government all have roles to play in achieving identity resilience. Individuals need to know how to protect their identity and be empowered to proactively respond to identity misuse. Industry and governments can strengthen identity resilience by adopting best practice for preventing, deterring and responding to identity misuse, and by actively coordinating efforts to improve and promote education on identity resilience, secure cyber practices and support services. 

4 All jurisdictions will work towards consistent high national standards 

Individuals need to have secure and trusted identity credentials regardless of who they are issued by. Australian governments will develop stronger, nationally consistent standards for issuing physical and digital credentials. Australian governments will also ensure that identity credentials have security measures that make them resilient. 

5 Biometric establishment and verification of identity with consent can improve resilience 

Where appropriate, and with an individual’s consent, Australian governments will use biometrics to make it harder for criminals to misuse identity credentials. Combinations of biographic attributes (e.g. name, date of birth and licence number) do not adequately protect Australians from identity crime, and can be exposed in a data breach. Passwords can be forgotten, stolen or compromised. Australian governments will protect personal privacy and secure data in regards to the use of biometrics. 

6 All jurisdictions will allow an individual to update their information conveniently across agencies 

Currently, an individual who changes their name or moves house has to update each credential individually, and often does not. As a result, their personal details may differ between government agencies and jurisdictions, which increases the potential for identity fraud. Australian governments will work towards enabling individuals to update their credentials in a more streamlined and convenient way, if the individual wishes to do so. 

7 Less data collection and retention 

Large data breaches have demonstrated the risks associated with large stores of personal information and of retaining copies of credentials. We need to consider the likelihood of future data breaches when deciding what we collect and retain. Digital IDs, digital credentials and government services like the Document Verification Service, allow government agencies and businesses to verify identity while minimising their collection of personal information. Australian governments will support businesses and government agencies to collect and retain less personal information where appropriate. This will be balanced against existing and legitimate needs relating to law enforcement and regulatory regimes. 

8 Clear data-sharing arrangements 

To support individuals impacted by large scale cyber incidents and data breaches, governments need to be able to collect and share data. Australian governments will work to put in place data-sharing arrangements to better protect victims of cyber incidents and data breaches. 

9 Consistent revocation and re-issuance 

Across Australia there are different processes for revoking and reissuing credentials. This makes it harder for a victim of identity crime to recover, especially when they have to engage with multiple Commonwealth, state and territory agencies and the private sector. Australian governments will work towards streamlined and consistent processes for remediating compromised identity credentials to reduce the burden on victims. 

10 Clear accountability and liability 

Liability for the cost of remediating credentials compromised in a data breach, cyber-attack, or other identity crimes needs to be clear, along with appropriate enforcement actions. The lack of clear accountability can delay mitigation measures when responding to a data breach. The solution should minimise further harm to the individual whose data was compromised.

the Strategy document states 

Building on existing work and being future ready 

To give effect to the above principles, Australian governments have committed to the following short, medium and long term initiatives. Plans for implementing the initiatives will be considered by the Data and Digital Ministers Meeting. The Data and Digital Ministers Meeting, a sub-committee of National Cabinet, will also oversee the implementation of the initiatives. Building on the innovative and leading edge work of the Commonwealth, states and territories, the initiatives include the elevation of existing projects to the national stage. They complement initiatives that support identity resilience, which are in development or already in operation, but have not been included in this Strategy. These include, for example, the Commonwealth’s myGov and myGovID systems, the Trusted Digital Identity Framework, ID Support NSW, and the Australian Death Check. 

Short term initiatives (Up to 12 months to implement) 

Update of the National Identity Proofing Guidelines 

Australian identity proofing standards need to be fit for purpose and used consistently across the country. The National Identity Proofing Guidelines (the Guidelines) provide guidance for government and private sector organisations on proofing the identity of individuals. The Guidelines will be updated and aligned with the Trusted Digital Identity Framework to support consistent processes across digital and non-digital credentials. This will help to address longstanding inconsistencies in identity management practices between jurisdictions; support less collection and retention of data; and build confidence in the use of Commonwealth, state and territory digital ID systems. 

Cohesive national approach for responding to the identity security aspects of data breaches 

Large-scale data breaches and cyber incidents have demonstrated the need for a cohesive national response to the identity security aspects of data breaches, to minimise the damage caused and to expedite the recovery of individuals’ identities. This initiative will seek to establish a Centre of Excellence to increase the speed and efficiency of responses to the identity security aspects of significant data breaches. This will be a single and highly visible point of expertise that supports the management of the identity security aspects of breaches at a Commonwealth level, and works with state and territory bodies, to minimise the harm for individuals, businesses and governments. 

Identity resilience education and awareness 

Education and awareness can help build individual, industry and government resilience. A range of education and awareness programs exist across the Commonwealth, states and territories. These include the Australian Competition and Consumer Commission’s Scamwatch and awareness information delivered by ID Support NSW. Improving consistency and coordination at a national level will increase the effectiveness of these programs. This initiative will focus on amplifying and coordinating existing education and awareness efforts to better protect Australians. 

Medium term initiatives (1-3 years to implement) 

Credential Protection Register 

When a credential is discovered to have been compromised it can take a long time to remediate. During this time, criminals can continue to misuse the credential. In October 2022, the Commonwealth established the Credential Protection Register to prevent the Identity Matching Services verifying a compromised credential that has been listed on the Register. This initiative will seek to further develop the Credential Protection Register, for example to allow individuals to have better control of their credentials, and also to improve the sophistication of the Register. 

Mobile phone trust scores 

Mobile phone numbers can be integral to identity authentication (for example when used in multifactor authentication) and as an alternative to using email and social media to contact a client. However, they can also be used for identity takeover and fraud. A ‘Mobile phone trust score’ system would allow telecommunication providers to assign trust scores to mobile phone numbers based on risk factors such as recent sim swaps, tenure of phone plan and virtual private numbers. The trust score will help to prevent mobile phones being used to facilitate fraud. 

Long term initiatives (3-5 years to implement) 

Reissuing Digital Credentials through Digital wallets 

Digital Credentials (for example Working with Children Checks or mobile driver licences) are important for identity resilience. It is cheaper, easier and quicker to reissue a digital version of a compromised credential than a physical one. The development of digital credential standards is vital to ensure consistency of data, user experience and interoperability, while maintaining choice and privacy. This initiative will look at addressing technical and legislative differences and barriers across jurisdictions to help reduce fraud, improve customer experience and reduce duplication of effort. This initiative can also inform upcoming digital credential projects so that they are ready for digital wallets at launch. 

No wrong doors for identity remediation 

Individuals should be able to engage with one government organisation in order to fully and quickly recover their identity. This could include regaining control of online accounts, revocation and re-issue of credentials, and protective measures for compromised credentials. Some states and territories have already established comprehensive support services that operate within their jurisdiction. This initiative will focus on a cross-jurisdictional approach to improve the experience for individuals, reduce further harm and enable full identity recovery. 

Strong, consistent commencement of identity records 

Commencement of identity records such as birth certificates, and immigration records for Australians born overseas, are issued by different jurisdictions and are not always linked to change of identity (e.g. change of name) processes in other jurisdictions. This initiative will explore how jurisdictions can work together to improve the integrity of identity records, and provide every Australian with an accurate commencement of identity record updated for life events. 

Implementation 

Realising the intent of the Strategy will require a strong focus on cross jurisdictional collaboration, application of the principles, and the implementation of the initiatives. Under the oversight of the Data and Digital Ministers Meeting, and in close collaboration with all Australian governments, the Commonwealth, through the Department of Home Affairs, will coordinate the implementation of this Strategy. A detailed plan, including resources required, will be developed for each initiative for consideration and approval by the Data and Digital Ministers Meeting. 

Assessing effectiveness 

In implementing this strategy, effectiveness will be assessed by progress made towards implementation of the initiatives, and the effectiveness of these outcomes. An annual report will be provided to the Data and Digital Ministers Meetings on the effectiveness of the Strategy, associated policy and legislation, and follow-on actions required to ensure that Australians’ identities are resilient.

Fraud

The NSW Sentencing Council report on Fraud features a useful overview of fraud and identity offences.

Fraud offences 

The general fraud offences: s 192E of the Crimes Act 

The general fraud offences are found in s 192E of the Crimes Act. This provides that a person is guilty of fraud if they, by deception, dishonestly: • obtain another’s property, or • obtain a financial advantage or cause a financial disadvantage. The maximum penalty is 10 years’ imprisonment. 

Section 192E and the remainder of part 4AA of the Crimes Act commenced in 2010.2 The provisions in part 4AA replaced over 30 existing offences, which targeted specific fraudulent conduct 

Other offences under part 4AA of the Crimes Act 

The other offences under part 4AA apply when: a person dishonestly destroys or conceals an accounting record with the intention of obtaining another’s property or obtaining a financial advantage or causing a financial disadvantage – maximum penalty: 5 years’ imprisonment4 a person dishonestly makes or publishes (or concurs in making or publishing) any statement (whether or not in writing) that is false or misleading, with the intention of obtaining another’s property or obtaining a financial advantage or causing a financial disadvantage – maximum penalty: 5 years’ imprisonment, and an officer of an organisation, with the intention of deceiving members or creditors about its affairs, dishonestly makes or publishes (or concurs in making or publishing) a statement (whether in writing or not) that to their knowledge may be false or misleading – maximum penalty: 7 years’ imprisonment. 

Other fraud and fraud-related offences in the Crimes Act 

In addition to the main fraud offences in part 4AA, there are several other fraud and fraud-related offences in the Crimes Act. 

Stealing and similar offences 

Part 4 of the Crimes Act covers stealing and similar offences, including larceny and embezzlement. There is some overlap between these offences and fraud. 

Larceny is a crime where a person takes and carries away another’s property, with the intention of permanently depriving them of it. A key element is “fraudulent intent”, which means the person did not believe they had a legal right to the property. However, larceny does not require deception. 

If a person is charged with fraud under s 192E of the Crimes Act, an alternative verdict is a conviction for larceny and vice versa. The offence of fraudulent appropriation is an alternative verdict to a charge of larceny. 

There are several specific fraud and fraud-related offences in part 4 of the Crimes Act. Many of these offences predate the 2010 reforms that introduced s 192E and cover specific fraudulent conduct. One example is embezzlement, which involves the fraudulent appropriation of property by a person to whom it has been entrusted. These offences include where: • a person in temporary possession of property fraudulently takes or converts that property, for their own, or others’ use11 • a “clerk or servant” (that is, an employee) steals or embezzles property, and • a “public servant” (that is, a person employed in the Public Service) steals or embezzles property. 

The maximum penalties for these offences vary, and include 10 years’ imprisonment, 5 years’ imprisonment, 3 years’ imprisonment,16 and 1 year’s imprisonment. 

Identity offences 

In addition to part 4AA, the Crimes Act includes offences that criminalise the misuse of a person’s identification information.  Identification information includes a name or address, driver licence, passport, credit card or digital signature. 

Making, supplying or using such identification information, with the intention of committing an indictable offence, carries a maximum penalty of 10 years’ imprisonment. Possessing identification information for this purpose carries a maximum penalty of 7 years’ imprisonment.  The relevant indictable offence could be any offence and does not necessarily have to be a fraud or fraud-related offence. 

There is also an offence of possessing equipment to make a document that contains identification information. The maximum penalty is 3 years’ imprisonment. 

Forgery offences 

Forgery involves making or using false documents. The Crimes Act contains some general forgery offences. 

The main forgery offence is making a false document to induce another person to accept it as genuine, and thereby obtain another’s property, obtain financial advantage or cause financial disadvantage, or influence the exercise of a public duty. The maximum penalty is 10 years’ imprisonment. 

There are also offences of using or possessing a false document, knowing it is false, which also carry maximum penalties of 10 years’ imprisonment. 

A further offence involves making or possessing equipment for making false documents, which carries a maximum penalty of 10 or 3 years’ imprisonment, depending on whether the person intends to use the equipment to commit a forgery offence. 

Other offences 

The Crimes Act includes various other fraud and fraud-related offences, across different parts. Some of these include: • making false or misleading statements to obtain an authority such as a licence, permit or registration, or in an application to obtain a benefit, and • producing false or misleading documents to comply with a state law. 

There are also offences contained in the part of the Crimes Act that deals with crimes against property which may also be classified as fraud or fraud-related. The offence of dishonestly destroying or damaging property “with a view to making a gain” is subject to a maximum penalty of 7 years’ imprisonment. When that offence is committed and the destruction or damage is caused “by means of fire or explosives”, the maximum penalty is 14 years’ imprisonment. 

Fraud and fraud-related offences in other legislation 

There are numerous fraud and fraud-related offences in legislation other than the Crimes Act. These relate to the many provisions that require statements, documents or other information to be supplied in order to obtain certain benefits, including, for example, a payment, grant or licence. This carries with it a risk of fraudulent conduct. 

Some of these statutes also cover the conduct of employees, employers, contractors and public officers. These people often have access to information or control of money or decisions, that they could fraudulently use for their, or others’, benefit. 

These offences cover specific conduct and situations relevant to the subject matter of the statute. However, the conduct may also be captured by the broad fraud offence in s 192E, or one of the other fraud, stealing, identity or forgery offences in the Crimes Act (see above).

In discussing s 192E the Council states 

 Our survey of cases in the Local Court shows a broad range of offending charged under s 192E. For example, in addition to high level frauds involving accounting and low level offences involving credit cards (in particular tap and go offences), there is:

• failure to provide goods and services by car repairers 

• tradespeople performing work they were not licensed or qualified to do 

• renting houses for use as drug premises 

• failure to pay for accommodation, meals, or petrol 

• dishonestly cashing in TAB and casino tickets 

• selling non-existent goods (like concert tickets) on online trading platforms 

• making false insurance claims 

• falsely stating that proceeds from a barbecue would be given to a local sporting team 

• using false identity documents to obtain goods on credit 

• submitting false time sheets as an employee 

• seeking refunds for goods that had not been purchased 

• using another person’s prescription to obtain a restricted substance, and 

• acting as a rideshare driver without authority. 

Because their coverage is so broad, the s 192E offences account for both the most charges and the most finalised charges for fraud and fraud-related offences. 

In 2019, 19,125 charges (for state and federal offences) were finalised in NSW courts in relation to fraud, deception and related offences. The most frequently charged state offence was the offence of dishonestly obtaining property by deception under s 192E(1)(a) with 6824 charges. This was followed closely by the offence of dishonestly obtaining financial advantage or causing financial disadvantage by deception under s 192E(1)(b), with 6502 charges. These two offences represent 70% of all fraud and fraud-related charges in 2019. 

In 2021, of the 12,425 finalised charges in the Local Court for fraud and fraud-related offences in the Crimes Act, 10,263 (83%) were for offences under s 192E. There were only 2162 finalised charges for the other fraud and fraud-related offences.

Scams

The Qld Office of Fair Trading - with a media release titled 'Not so ‘helpful hands’ lands fake charity in court' - reports that it froze the bank accounts of a man found guilty of illegally collecting donations 

A New South Wales man has pleaded guilty to two counts of breaching the Collections Act 1966 after an investigation by the Queensland Office of Fair Trading (OFT). 

David Oneeglio from Pottsville, New South Wales, has been prosecuted and fined $750 in the Brisbane Magistrates Court (12 June 2023) after requesting donations without approval. He was also charged with failing to produce requested information and records to account properly for money and equipment received. 

In March and April 2022 Mr Oneeglio made numerous daily public statements asking for donations to be made via websites www.aussiehelpers.live and www.aussiehelpinghands.com to assist flood affected communities in northern New South Wales. 

Pleas for donations were made across a variety of social media platforms and websites. 

As a result of investigations, the OFT took swift action and froze three separate bank accounts containing donations. 

The Office comments 

 Queenslanders are urged to make sure the charity is registered by checking on the Queensland Government’s “check a charity” website and the Australian Charities and Not-For-Profits Commission website before they donate.

In the US the federal Attorney's Office, Eastern District of New York in a media release states 

 A 13-count indictment was unsealed today in the United States District Court for the Eastern District of New York charging George Anthony Devolder Santos, better known as “George Santos,” a United States Congressman representing the Third District of New York, with seven counts of wire fraud, three counts of money laundering, one count of theft of public funds, and two counts of making materially false statements to the House of Representatives. ... 

“This indictment seeks to hold Santos accountable for various alleged fraudulent schemes and brazen misrepresentations,” stated United States Attorney Peace. “Taken together, the allegations in the indictment charge Santos with relying on repeated dishonesty and deception to ascend to the halls of Congress and enrich himself. He used political contributions to line his pockets, unlawfully applied for unemployment benefits that should have gone to New Yorkers who had lost their jobs due to the pandemic, and lied to the House of Representatives. My Office and our law enforcement partners will continue to aggressively root out corruption and self-dealing from our community’s public institutions and hold public officials accountable to the constituents who elected them.” 

“The Criminal Division’s Public Integrity Section is committed to rooting out fraud and corruption, especially when committed by our elected officials,” said Assistant Attorney General Kenneth A. Polite, Jr. of the Justice Department’s Criminal Division. “As alleged, Santos engaged in criminal conduct intended to deceive and defraud the American public. As this indictment reflects, the Department of Justice will hold accountable anyone who engages in such criminality.” 

“As today's enforcement action demonstrates, the FBI remains committed to holding all equally accountable under the law. As we allege, Congressman Santos committed federal crimes, and he will now be forced to face the consequences of his actions. I would like to commend the diligent efforts of the investigative and prosecutorial teams in this matter,” stated FBI Assistant Director-in-Charge Driscoll. 

“At the height of the pandemic in 2020, George Santos allegedly applied for and received unemployment benefits while he was employed and running for Congress,” stated District Attorney Donnelly. “As charged in the indictment, the defendant’s alleged behavior continued during his second run for Congress when he pocketed campaign contributions and used that money to pay down personal debts and buy designer clothing. This indictment is the result of a lengthy collaboration between law enforcement agencies, and I thank our partners at the U.S. Attorney’s Office, the Department of Justice and the Federal Bureau of Investigation for their dedication to rooting out public corruption.” 

Mr. Peace also thanked the U.S. Department of Labor, Office of Inspector General, the New York State Department of Labor (NYS DOL), and the Queens County District Attorney’s Office for their assistance. 

As alleged in the indictment, Santos, who was elected to Congress last November and sworn in as the U.S. Representative for New York’s Third Congressional District on January 7, 2023, engaged in multiple fraudulent schemes. 

Fraudulent Political Contribution Solicitation Scheme 

Beginning in September 2022, during his successful campaign for Congress, Santos operated a limited liability company (Company #1) through which he allegedly defrauded prospective political supporters. Santos enlisted a Queens-based political consultant (Person #1) to communicate with prospective donors on Santos’s behalf. Santos allegedly directed Person #1 to falsely tell donors that, among other things, their money would be used to help elect Santos to the House, including by purchasing television advertisements. In reliance on these false statements, two donors (Contributor #1 and Contributor #2) each transferred $25,000 to Company #1’s bank account, which Santos controlled. 

As alleged in the indictment, shortly after the funds were received into Company #1’s bank account, the money was transferred into Santos’s personal bank accounts—in one instance laundered through two of Santos’s personal accounts. Santos allegedly then used much of that money for personal expenses. Among other things, Santos allegedly used the funds to make personal purchases (including of designer clothing), to withdraw cash, to discharge personal debts, and to transfer money to his associates. 

Unemployment Insurance Fraud Scheme 

Beginning in approximately February 2020, Santos was employed as a Regional Director of a Florida-based investment firm (Investment Firm #1), where he earned an annual salary of approximately $120,000. By late-March 2020, in response to the outbreak of COVID-19 in the United States, new legislation was signed into law that provided additional federal funding to assist out-of-work Americans during the pandemic. 

In mid-June 2020, although he was employed and was not eligible for unemployment benefits, Santos applied for government assistance through the New York State Department of Labor, allegedly claiming falsely to have been unemployed since March 2020. From that point until April 2021—when Santos was working and receiving a salary on a near-continuous basis and during his unsuccessful run for Congress—he falsely affirmed each week that he was eligible for unemployment benefits when he was not. As a result, Santos allegedly fraudulently received more than $24,000 in unemployment insurance benefits. 

False Statements to the House of Representatives 

Finally, the indictment describes Santos’s alleged efforts to mislead the House of Representatives and the public about his financial condition in connection with each of his two Congressional campaigns. 

Santos, like all candidates for the House, had a legal duty to file with the Clerk of the House of Representatives a Financial Disclosure Statement (House Disclosures) before each election. In each of his House Disclosures, Santos was personally required to give a full and complete accounting of his assets, income, and liabilities, among other things. He certified that his House Disclosures were true, complete, and correct. 

In May 2020, in connection with his first campaign for election to the House, Santos filed two House Disclosures in which he allegedly falsely certified that, during the reporting period, his only earned income consisted of salary, commission, and bonuses totaling $55,000 from another company (Company #2), and that the only compensation exceeding $5,000 he received from a single source was an unspecified commission bonus from Company #2. In actuality, Santos allegedly overstated the income he received from Company #2 and altogether failed to disclose the salary he received from Investment Firm #1. 

In September 2022, in connection with his second campaign for election to the House, Santos filed another House Disclosure, in which he allegedly overstated his income and assets. In this House Disclosure, he falsely certified that during the reporting period: He had earned $750,000 in salary from the Devolder Organization LLC, a Florida‑based entity of which Santos was the sole beneficial owner; He had received between $1,000,001 and $5,000,000 in dividends from the Devolder Organization LLC; He had a checking account with deposits of between $100,001 and $250,000; and He had a savings account with deposits of between $1,000,001 and $5,000,000. 

As alleged in the indictment, these assertions were false: Santos had not received from the Devolder Organization LLC the reported amounts of salary or dividends and did not maintain checking or savings accounts with deposits in the reported amounts. Further, Santos allegedly failed to disclose that, in 2021, he received approximately $28,000 in income from Investment Firm #1 and more than $20,000 in unemployment insurance benefits from the NYS DOL.