Bill Hall lost $26,000 in an invoice scam after an email from his builder was intercepted and resent with new payment information.
The fraudulent invoice looked exactly the same as one sent by Mr Hall's builder a couple of months earlier, except for the bank account number.
After transferring $26,345 to the Citibank account listed on the new invoice, Mr Hall thought his builder had been paid.
It took about three weeks for his financial institution Bendigo Bank and Citibank to tell him they thought he'd been scammed.
“I was shocked, I thought ‘how can this happen?’,” Mr Hall said.
When he asked why the banks hadn't checked the name of his builder against the fraudulent account number, he said Bendigo Bank and Citibank just passed the buck.
“They just didn’t seem to care, they washed their hands of it," Mr Hall said.
“The responsibility should always be [on the banks] to tally up the name and the number on the account. It is so simple – It can't be that hard.”
About a month after his money disappeared, he got a partial refund from Citibank of just over $6,000. He was told that’s all that was left in the scammer’s account.
When Mr Hall lodged a complaint with the Australian Financial Complaints Authority (AFCA), they did nothing because he was not a customer of Citibank.
“You go, ‘well, what are they there for?’ They’re toothless,” Mr Hall said.
The retiree has no idea who owned the Citibank account he transferred his money to. Neither does Citibank, it seems.
“Someone has been able to open an account and they haven't been able to track him, it would appear, which I think is ridiculous,” he said.
'Make the banks pay'
Consumer advocates argue banks should be responsible for reimbursing scams, arguing it will drive greater investment in stopping fraud.
Australians lost more than $2 billion a year in scams last year, but advocates say the real figure is likely much higher because the shame and embarrassment some victims feel mean they don't come forward.
“The key reform is to shift that liability from individual consumers to banks, when it comes to scam losses,” Consumer Action Law Centre chief executive Gerard Brody said.
The ACCC has similar views and is putting pressure on banks to adopt a UK-style confirmation of payee (CoP) scheme which it said would reduce frauds by $420 million a year.
In other words, it wants banks to check that the name of the recipient matches the name of the account when money is transferred online.
“People probably don't even know that when you do a bank transfer and you enter your BSB and account number.”
“They [banks] ask you for the account name, but they don't actually check.”
But instead of a mandatory CoP, banks want more customers to take up the optional PayID technology, which allows customers to see the name attached to a BSB and account number.
Mr Brody said it was clear the optional system that puts the onus on customers to stop scams isn't working.
He said changes to make banks liable for card skimming and ‘card not present’ fraud had resulted in a reduction in losses, because banks have invested in the technology to stop it.
“We have seen the losses associated with that sort of fraud come down over the last five years," he said.
"It used to be about 70-80 cents per $1000 in card transactions were lost, and now it is down to about 55 cents.”
“So we know that once the banks have that incentive, that they are the ones that bear the losses and they do invest in measures to fix the problem.”
The UK has introduced legislation to mandate the conditional reimbursement of scams and the payments, and the regulator has powers to force banks to reimburse customers.
$2.6 million gone
Sylvia Chou was looking forward to a comfortable retirement before she fell victim to an online investment scam, that she said her bank NAB should have stopped.
The 55-year-old lost $2.6 million she sent to GG Capital Group Limited, trading as BlueLexus via BPAY from her NAB account between January and June 2019.
BlueLexus was later identified as a possible scam by ASIC’s moneysmart website. BlueLexus’ website has been closed down, and ASIC lists the company's address as on the island of St Vincent and the Grenadines in the Caribbean.
Ms Chou, a practising accountant and former financial adviser, saw an advertisement for BlueLexus on Facebook.
She believed it was operating a foreign currency trading exchange. The ad also falsely used the endorsement of Australian commercial television business program Shark Tank.
Ms Chou expressed her interest in the exchange by submitting her contact details on BlueLexus’ website. A few days later she was called by the company and spoke to a range of people who she believed were high-level account managers based in London.
Her first transaction to BlueLexus was $10,000 in January 2019. The company matched every dollar spent in credits for trades.
She was also given access to a trading platform which showed she was making gains on her investment.
“He [the account manager] said if I'm not going to put additional money into my account, whatever I invest is going to be all gone.”
Over multiple transactions from her NAB account, Ms Chou transferred $200,000 of her own personal savings to BlueLexus to keep her account open.
When she tried to cash out, she was told her she was also in debt to BlueLexus and had to pay the amount she had put in and the credit owed to them before getting a refund.
Ms Chou's debt spiral worsened. Believing she would lose it all, she borrowed $1 million from family and friends because she thought she could repay them when she cashed out.
“That's the trust and the credit my family and friends gave to me -- I have always been a responsible person," she said.
BlueLexus called Ms Chou daily and convinced her that if she did not continue to transfer money her investment would be lost.
In May 2019, she eventually resorted to refinancing her family home and two investment units from NAB to Westpac for $1.5 million.
Two days after she sent that money to BlueNexus from her NAB account, she got a letter from NAB which said they urgently needed to contact her.
It was too late.
Because Ms Chou transferred the money for refinancing her properties before the settlement went through, she now has two mortgages on each property.
She owes $1.5million to Westpac, $1.3 million to NAB and $1million to her family and friends.
“What people don't understand is that once you are hooked, you just get lost,” she said.
“Quite often people will say, ‘come on, I'm not so stupid’ and that's the biggest danger.”
But Ms Chou also questions why NAB, which like all banks is supposed to adhere to anti-money laundering laws, did not raise the alarm about her transactions until the money was gone.
"There were a lot of suspicious transactions," she said.
At times Ms Chou was making multiple transactions of $20,000 a day from her NAB account to the BPAY account linked to BlueLexus.
Previously she’d made less than 10 transactions a month.
In contrast, Westpac blocked a $50,000 transfer Ms Chou tried to make to the same BPAY account BlueLexus used.
"They [BlueLexus] just told me they had an issue with Westpac, but not to worry because NAB was okay," she said.
Ms Chou is still in negotiations with the banks over how she can repay the debt owed. It will most likely result in the sale of her properties.
She's currently packing up her family home of 13 years where she raised her two children.
“I'm a single mum for 20 years, I raised my kids since they were two and five on my own so this money is not only my family and friends is also my kids,” Ms Chou said.
“I'm not sure where my life is going to head to at this moment.”
Ms Chou’s complaint to the Australian Financial Complaints Authority mostly ruled in the banks’ favour.
She wants laws to protect consumers.
"All banks need to be proactive, the scammers are proactive but not the banks, not the authorities," Ms Chou said.
"That says something needs to change."
The BPAY account used by the scammers was closed by Commonwealth Bank in July around the same time as AFCA closed her case.
UK bank refunds scam claims
Consumer advocates in Australia point to the UK’s TSB Bank as an example of a financial institution that’s doing the right thing by victims of scams.
TSB has a Fraud Refund Guarantee policy and refunds 98 per cent of received claims.
“The actual amount that we refund is not a number that we tend to go public with, we share that data with our trade body,” TSB director of fraud prevention Paul Davis says.
“However, the amount of money that's lost to scams of this type is kind of several million pounds every day across the whole of the UK – so this is a significant issue.”
TSB does not refund fraud when the customer is knowingly involved in committing an offence themselves, when a customer has made repeated claims, or the money has been lost from an account the customer holds with a different bank.
“These exceptions only make up a very small proportion of the fraud claims our customers raise,” he said.
The bank also blocks exchanges to cryptocurrency exchanges by bank transfer or card.
“Because we were on the hook for the very large growth and customer losses [involving crypto scams] that we were seeing. To us, it was a no-brainer to simply not allow those payments to be made anymore.”
Mr Davis said while the UK was ahead of Australia in fraud prevention there was still a lot of work to do.
“I think it's important that these other sectors; technology, social media, and telecommunications, also stepped forward to stop these scams happening in the first place, and then bearing at least some of the costs of reimbursing the victim.”
In Australia, the federal government pledged during the election to bring in tough new industry codes for banks, telecommunications providers, social media providers and government agencies to protect consumers against scams.
Scam prevention is expected to be high on the agenda when consumer affairs ministers meet with their federal counterpart on Friday for the first time in more than two years.
Banks defend scam prevention
In response to details of Mr Hall's scam, a spokesman for Bendigo and Adelaide Bank said they take cyber security very seriously.
“We would like to take the opportunity to remind customers of the important role they play in keeping their information secure as we continue to look for new ways to detect and neutralise threats to their online security," they said.
Citi was purchased by NAB in June. A spokesman for NAB, Ben Rix, responded to questions about Mr Hall and Ms Chou's cases.
“While we can’t comment on individual cases, we’ve seen a significant increase in scams in recent years and it’s upsetting to see the devastating effects these can have on the impacted victims," he said.
“We encourage customers to use PayID and BPAY when possible in making payments to provide reassurance their funds are going to the recipient intended.
"PayID can help prevent scams like business email compromise and invoice fraud. Customers should also call the intended recipient of the payment on a known phone number to confirm the payment details."
NAB said anyone who anyone believed they had been a victim of a scam or noticed any fraudulent activity should contact their bank immediately.
