HELP PLEASE! Scammed out of nearly $100K

Hi everyone,

So I'd like to precede this by saying I already feel absolutely horrible. I feel like throwing up constantly just thinking about this, but thought I would put it out there to see if anyone in the OzBargain community might have had any similar experiences or any advice.

Long story short, it appears a scammer hacked either my conveyancer's or the other side's conveyancers email accounts. and from doing so, got my details as well as the details of my upcoming property settlement. They knew the amounts due in terms of stamp duty payments etc, as well as the dates these amounts were due. They created a near identical email account to my Conveyancer, who I was emailing around 5-10 times a day and so simply didn't notice anything out of the ordinary when I received the scammer's email. It popped up only with my Conveyancer's name and the email address didn't come up as 'new sender' or anything. I know that I should have checked the email address before doing anything, but I had just answered about 3 other emails from my Conveyancer and still had about 3 to go. I had 6 emails in a row from her on different matters and it didn't at all enter my mind that 1 of these 6 might not be like the others.

In short, I transferred nearly $100K at the direction of this scammer who I believed to be my Conveyancer to the account they directed in the email. I called the Conveyancer later that afternoon to discuss another matter, and mentioned to her I had transferred the stamp duty payment for this property. It was then we both realised what had happened.

I searched the BSB and realised it was a Bank X account. I called Bank Y first (my bank) to ask them to commence a scam investigation and try recover the funds immediately. They advised the funds had already reached the other account but they opened the Scam investigation immediately. I then went to Bank X and tried to have them freeze the account the funds were received into. They said the account was already closed and for some reason, they couldn't see any details in the system about who had opened or closed it (how is that possible?). That night, I attended the Police Station and filed a fraud/scam report.

I now have the Conveyancer's insurer, the Police and Bank Y/Bank X working on this case but I'm accepting the worst and not expecting to get anything back. In the off chance anyone here might have had similar experiences and have any advice, I thought I'd raise it to the OzB community. Again, please don't pile on me. I know and I feel horrible. I've barely been able to sleep and I am just hoping there may be some avenue I haven't thought of, even if its not likely to succeed.

Thanks in advance everyone

Mod: Edited for privacy

Comments

    • If the $100,000 the op lost involves violence, the police would probably make more effort.
      For non violent scams/ financial fraud, if you add another couple of zeros at the back, it might worth a bit more of their time.

      • +2

        Sadly, that is more then likely the scenario.

      • -1

        OP should pose as a woman and say that the scam is increasing the pay/wealth gap even more.

        Maybe that will get the pollies to create an international issue and get to the bottom of it.

  • +23

    Conveyancer insurer…have they said anything?

    Damn I feel sick too.

    A few years back I nearly got caught out.

    Had issues with nab and were in constant contact. Got an email asking me to fill out some details. Before I clicked submit, I felt something was off. The details they wanted, they should have them in their system!

    Checked the email and sure enough some mf tried to do one on me.

    I always check the email. If it's anything massive, I'll call them to confirm the details too.

    I sincerely hope you get your money back

    • +43

      Thank you mate! Conveyancer is trying their best with Insurance Comp A to get me cover under their Cybercrime policy which they have cover for. Only issue is it typically covers the insured (them) rather than 3rd parties like myself. They are trying hard though!

      Mod: Edited for privacy.

      • +46

        Regardless of the outcome, that's a great business to support. I'd encourage you to "name and praise" accordingly. There's plenty of hopeless ones out there, and a personal recommendation to every person you talk to from now on when they say they're buying a house is a small token of appreciation.

        From the bottom of my heart, I'm sorry to hear this has happened to you. I can understand how you didn't give it a second thought and you'll probably keep beating yourself up over it for years to come, but know the scam is so effective because it feels "expected" to have to transfer a large amount to a random bank account at some point.

        Thanks for sharing your story and hopefully helping someone else in the future take a second longer and question whether this could be happening to them to.

        For everyone else (me included) its a good reminder to use different passwords for accounts, with 2FA where you can.

      • +17

        Odds are their account was compromised; small businesses are targeted a lot for this technique. Start the process now /w a layer and/or a digital forensics firm. The logs required typically only survive 90 days. ACSC might be able to point you in the right direction here.

        Only issue is it typically covers the insured (them) rather than 3rd parties like myself.

        You may need to go after the conveyancer for damages, which in turn they would pass on to their insurer if at fault.

        What email service do you use? All the major ones will have logging for your account, and will expose a fair bit to you.

        • +2

          I believe this maybe the right way to go about it.

        • I'm not normally sceptical of the resolution and really hopeful the OP recovers their money but….
          As someone who's company (employee not owner) was compromised by ransomware a couple of years ago - instant report to ASIC/Acorn and we're talking about 30-40k ransom demanded - ASIC did not contact us at all other than generic emails sending to their FAQ pages about security.
          They were next to useless. For a conveyancer which is even smaller, I doubt they would respond. Between them & OP, yes go and talk to a lawyer about what needs to happen ASAP.
          I also hope the police does something and keeps OP updated but again because of "privacy" reasons between them and NAB could be something the OP just isn't informed off until the time period for digital logs may expire. I really wish there is visibility in their proceedings and hope this works out for OPs sake.

      • +5

        If it was them that was hacked and someone fraudulently represented themselves as them, it could be argued that an insurance payout would be covering them. This surely sounds like it isnt going to be a simple process. I feel for you dude as do clearly alot of people here. This is a well orchestrated plan that sounds more like they were targetted and not you individually.

      • Does not make any sense as you need mailing address and identity proof to open any account I understand if they say account was open with identity theft and withdraw all money and close account.
        Here bank saying they do not have any details when all bank is liable keep 5 years of records.

      • +1

        Op, heres a thought, if you were able to prove that it was your conveyancers email that got hacked, then you should be covered as a 3rd party, because they are the victim of the crime directly.

        Perhaps your conveyancer has received emails from othe customers claiming to have received a fake email from them? That would be sufficient proof i would guess!

        Trying not to give you false hope here, just trying to help.

    • +6

      Please be aware that a well-crafted scam website will save anything and everything you type into it even if you don't click submit.

      Your basic 5-minute webforms job won't, and any no-script addons you run will do their job and interfere, but a sufficiently well developed site can automatically save every mouse movement and keystroke you perform on the page.

      • +3

        Yap I monitored all my accounts, credit checks, as well as changed passwords.

        Nothing has been done to me (this was about 2 years ago).

        Also have no script on Firefox.

        But you raised very good points. Hope people read and remember

    • -1

      Get legal advice. Issue proceedings against the Conveyancer. Very likely they have been hacked or have lax security. The scammer surely got your details from them. Probably an O365 hack.

      • This is a great point. Are they running an on premise exchange server?

      • Wake up and go to the dark web and see the millions of data on people for sale !

  • +55

    They said the account was already closed and for some reason, they couldn't see any details in the system about who had opened or closed it (how is that possible?).

    Are we just going to ignore this? That's suss as (profanity)

    • +15

      This is what really upsets me too! Surely it is negligent and below the reasonable standard the banks shoudl need to uphold to allow that. I can't believe they would allow this, especially after all the grief Bank Z went through last year with relation to money used in mule accounts for trafficking etc

      Mod: Edited for privacy

      • +7

        Having worked in large Australian companies before I wouldn’t say it’s in the realm of impossibilities sadly.

      • +15

        It would probably be against policy for them to divulge too much information to you as they don't know you either.

        • +6

          Well now that a police report has been filed, they better get a move on

          • +4

            @OzBarAnon: to be honest, a police report doesn't do much in terms of accessing personal data and disclosing it to third parties unless they take it further

        • +2

          yeah I was thinking along those lines too, i'm pretty sure they shouldn't give details to you on something not confirmed..
          But hopefully police can move something along with a warrant or similar?

          Really sorry to hear OP, absolutely disgusting for someone to steal so much cash that you've worked for.. Thats a tough one, i'd normally look for obvious scams etc, but given what was happening I dont know how you were supposed to pick that out.. I've done transfers in a similar way after conversing with a conveyancer I know by email (won't do it in future wow)

          Biggest problem would be if someone created account with a fake ID, though you'd think if it was recently created, they'd have some sort of extra checks if such a large amount was deposited/withdrawn then the acct closed.
          I know they have flags for very minor things like unusual withdrawals etc

      • +1

        yeah what nurries said. If the bank has allowed someone to create a bank account without proper procedure or collection of proper documentation, then they should be liable, as this is simply irresponsible, and they are technically a co-conspirator. They should have never allowed this to happen, and you should be able to lodge a case. I would get my full facts on what info they have and lodge this via the banking ombudsman who should be able to offer advice on whether you have reasonable case for escalation. They are completely neutral, and free.

        https://www.afca.org.au/

        • +1

          It's much more likely the account holder (entity or individual) is a victim of identity fraud and/or had their account unwittingly hijacked.

          Someone who has obtained access can just store the info for later until its utilized in an attack like this and suspension / closure of account might be due to real account holder requesting it after seeing the transaction.

    • +20

      Could be just a privacy thing. They'd get in trouble for giving out an account holder's details to a stranger.

      • -4

        Could be just a privacy thing.

        It sounds more like the bank didn't KYC the account.

        • +9

          Why the hell would you want your bank telling personal details to a random

          • +5

            @rover100:

            Why the hell would you want your bank telling personal details to a random

            Where on earth did I advocate banks handing out personal details about anyone's account to any stranger???
            That should only be provided to authorities who are conducting an investigation, otherwise it would constitute a serious breach of privacy.

            You obviously didn't read OP's post carefully, specifically the following part:

            they couldn't see any details in the system about who had opened or closed it (how is that possible?)

            If NAB had instead said we know the account holder, but we cannot divulge that information to you directly (due to privacy laws) then that is what the OP should expect to hear.

      • -7

        who cares about privacy, you lost 100k and you want to know who took it….

        • +2

          That does not matter in the eyes of the law. The privacy act does not allow their details to be divulged to a non account holder. Period.
          Only a court order or federal police can access this information if a crime/fradulent action has taken place.

          • -6

            @[Deactivated]: So if someone stole 100k from your bank which you saved up for over 20 years (so wont be chump change like some others would think) - you're perfectly fine letting that all go because "the law says so"?

            If someone broke into your house and stole your wife, you would be like "Yeah ok, take her I don't care either way, the law says I can't harm you to save my wife."

            If someone broke into your house, stole the keys to your 80k high yield investment vehicle which you had some attachment, mostly due to the value it will become once you sell it off later, and drove off in it; you'll be like "Fine, I don't care about the car anyways coz the law says I can't find out who stole my car."

            • +2

              @Zachary: No need to over-exaggerate, all I said is that it is the law, a Bank cannot break the law and divulge personal information to a non-account holder, is really is that simple.
              As I and many others have stated, the Federal Police are the only ones that can access this information via a Court Order when a criminal investigation has been lodged, you can't take matters into your own hands and expect a bank to give you the account holders information.
              If a staff member is caught exposing the personal information to a non-account holder (legal entity) they will end up losing their job, in court and a criminal record, along with a hefty fine for the bank itself.
              Anyone that works in banking knows how tight the Privacy Act is and what will happen if they break the law.
              Surely you understand basic law, such as the Privacy Act? There is no arguing it, it's set out in stone.
              No one is suggesting what has happened to the OP is not terrible, it is, and it would be very upsetting, and of course I wouldn't be happy letting it go, but it now needs to be left in the hands of the police, which is where it is now.
              The OP must now deal with the Police and get them moving on it as quickly as possible and I wish them the best of luck at getting the funds returned,

              • @[Deactivated]:

                No need to over-exaggerate

                Isn't "over-exaggerate" an over-exaggeration?

              • @[Deactivated]:

                No need to over-exaggerate, all I said is that it is the law, a Bank cannot break the law and divulge personal information to a non-account holder, is really is that simple.

                It won't be if you were the one they stole 100k, wife or car from…..

                Surely you understand basic law, such as the Privacy Act? There is no arguing it, it's set out in stone.

                No I don't and if someone stole my 100k, wife or car, I will hunt them down….

                • @Zachary: lol, okayyyyyyy enough said.

                  • -2

                    @[Deactivated]: Find, I won't chase the guy who stole 100k, my wife or my car…happy?

            • +1

              @Zachary: It's not your job to investigate and get it back, whether you believe in the relevant authorities or not.

              • -1

                @Serapis: Officer: "Sorry, I couldn't get back your 100k, I guess this is a lesson learnt to not hand over money so hastily."
                You: "Wha-what? I thought I believe that you could??! Now 100k is gone for good/!??!!?"
                THE END.

        • +2

          hey it's me ur customer's scam-ee, can i hav the bank details of ur this acc pls?

      • +2

        They'd get in trouble for giving out an account holder's details to a stranger.

        Then the answer would rather be " Sorry due to privacy policy, we cant give you the detail of that accounts" Instead of what they gave OP. Certainly, no one in their right mind and speaking/understand English would spin it to "Could be just a privacy thing" LOL. Sorry for the broken gramma, English isnt my native language …

    • +14

      Banks are absolutely complicit in these things and basically just say the money is gone. Push them harder and you’ll get excuses about privacy and blaming the other bank, just pointing you to the police.

      Imagine if it was the banks money lost, all hell would break loose.

    • +3

      Privacy Act. They can only give details of an account to the Police or your bank and your bank can't tell you either.

      • -1

        On what basis do you think they will suddenly be more helpful with the police? Are you conflating police with courts?

        the entity must not use or disclose the information for another purpose (the secondary purpose) unless:
        6.2(b) the use or disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order

        • Usually the police operate within the law and follow the law (such as an information request allowed under an act). Obviously the bank would insist on lawful reasoning.

          • -1

            @surg3on: Usually? Obviously? What is this mysterious law you’re talking about?

    • +3

      Are we sure he called NAB and not the scammers?

  • +18

    Wow my absolute condolences OP. No amount of reassurance from us is going to make you feel better until you can recover that money back. Could you trace how the theft happened and how they spoofed your conveyancer's details? If there ever was a need for a police cyber crimes unit, this would be it.

    • +8

      This is definitely in progress with Insurance Comp A. They are analysing both the servers of my conveyancer and the other side's too. Unfortunately the Police have been SO slow. I've been so disappointed by how slow they've been!

      Mod: Edited for privacy

        • +13

          Yes, they should as there will be no point in investigating this once the trail grows cold

        • +12

          We all know cops only go after soft targets they can fine.

      • +2

        Time for both of you to consider using end-to-end encrypted emails with signature signing. Emails from unverified senders will warn you.

        There are providers like ProtonMail and Tutanota to get started.

        • +6

          That would only help if the scammer was spoofing the conveyencer's email. More likely they actually got into their account given they knew enough information to make such a convincing email.

          • @Quantumcat: Jeez, the conveyencer has more serious problems and shouldn't be doing business. If the endpoint has actually been compromised, it's already game over.

          • +5

            @Quantumcat: Not the case. If you read the OPs full description, they state that it came from an email address almost identical to the conveyancers - not the same email address.

            • +1

              @trankillity: @celtics889345 can you clarify whether the email address was the same as your conveyencer's or different? If they didn't get into their email account it is hard to see how they would have the information needed to craft that email

              • @Quantumcat: Surely either the conveyancer or OP's email was directly accessed to get this info - even if they made a fake domain with a 0 for an o or something, they still got all the info to fake the email somehow. So one of the two endpoints or servers in between has to be compromised, or an inside job from someone at the working for the conveyancer perhaps? Whether their staff or an IT contractor

                • @smashman42: OP said he was using 2-factor. And there are loads of hackers trying to get into office 365 tenancies targeting businesses so that seems more likely than someone putting in the effort to get into a random individual's Gmail or whatever with 2 factor enabled and whom they have no idea whether there's a chance of getting any money from. Plus OP never mentioning any phishing attempts on him he noticed (that would mean the very first attack they ever try works and it was so good he has no memory of it). Vs a conveyencer that might be using office 365 and who deals with large sums of money regularly so good chance of hacking them being worthwhile, and easier to get into.

  • +2

    Damn :/

  • +12

    I just had settlement for my property on Friday. My heart goes out to you, OP.

  • +11

    Yeah that’s shit. Really hope you get it sorted. Please keep us updated

    • +6

      Thanks mate and will do!

  • +8

    That's rough
    Hopefully NAB shuts it down before it happens.

    I work in the government sector and this is becoming a huge issue as computer fraud/hack protection gets better the scammers find the next weakest link which unfortunately is the human brain. It's quite surprising how easily they can get access to your account through a few checks of your facebook, instagram or anything else freely available without you knowing.

    This exact scenario was played out to us and it's remarkable how they plug information from your life into hacking your account on the backend or even guess your password from a combination of your pets/parents names and birthdays. They then just sit there waiting for months, even years reading emails until the appropriate time to substitute out the bsb and account number.

  • +3

    hmm i heard / read similar case about a year ago?…. but the hacking part is on the convey side something like that.

    • +2

      It happened to Mike Sheahan (AFL journo) a couple of years ago, there's articles on the net

    • +4

      This is the article you are referring to: https://www.9news.com.au/national/masterchef-contestant-dani…

      • 8:04pm Jun 27, 2018

        One would like to think that PEXA could have implemented ways (by now) to further reduce the risk for their clients from fraudsters.

        OP, hopefully you can in some way “recover” you money.

        • +5

          PEXA have. This is unrelated as it appears to be a transfer direct to the (purported) conveyancer's trust account in order to pay stamp duty.

  • +39

    Ouch. My condolensces. Makes me feel better than when I had to pay the deposit for a house I bought over the phone (i was travelling), I didnt just take the word of the agent's SMS with bsb/acc numbers, I called the actual real estate office where he worked and asked them to confirm payment details for their trust account - which were the same.

    At the time I thought I was being paranoid. Turns out, Paranoid is the way to be !

  • +12

    Have a read of the following pages and go through with making the complaint(s) ASAP:

    https://www.ausbanking.org.au/for-customers/how-to-complain/
    https://www.afca.org.au/

    Good luck.

    • +10

      Yes making the biggest stink you can as quickly as you can is the best bet - going to be easier to get your money back if it hasn't yet left the country.

    • Thank you Andy!

  • +3

    Dear lord.. that's terrible.

    They said the account was already closed and for some reason, they couldn't see any details in the system about who had opened or closed it (how is that possible?).

    This certainly shouldnt be possible.. Either way, with the authorities involved, I hope it gets resolved and you get your money back in full.

    Best of luck! My prayers are with you, 100k is an immense amount of money to lose.

    • +1

      Thank you mate!

    • +11

      The bank just bamboozles you with these red herrings to keep your brain occupied with mysteries and conspiracies then two weeks later will say “sorry that wasn’t quite correct, turns out we followed process and there isn’t anything we can do”.

      • +4

        Thats a weird way to look at it..

        Proportionality doesn't work here since you don't know his networth. Are you suggesting that someone worth.. say.. $500k shouldn't stress too much if they misplace/lost/scammed out of $10000, cause proportionally, its no worse than (insert silly comparison here).

          • +2

            @abb: This is fairly stupid comment to be honest.

            The OP has lost 100K of deposit. It's not 20c or 10K, which statistically we have to work our assess off for, even 10k.
            So yeah it's 5% in theory or 20% of the purchase price, you have no idea as it wasn't stated doesn't matter.

            Would you just shrug if you got scammed 100k because it's only a few percent (or 20?). We don't have the information if this was saved for 10 years for, 3 years or even inherited, still doesn't matter.

            • -5

              @bobs burgers:

              you have no idea as it wasn't stated

              It was stated as the stamp duty. Which is under 5%.

              Would you just shrug if you got scammed 100k

              I got scammed more than that lulz, we move on with life.

              • @abb: Yes of course you move on, but that sort of loss has got to hurt. And probably take some time to get over

  • +58

    Yep happened to my mum about 2-3 years ago where she lost double that… Ended up going through the conveyancer insurance as bank and pexa wouldnt take responsibility.

    They traced the issue back to the real estate agents email which was hacked…

    In our case it was found and charged a mule (in Sydney where we are Melbourne based) that opened an account and transferred the money over to Thailand. He was charged and sentenced.

    Good luck OP, was a pain and very stressful time for us, its more common than people think…

    • +9

      Thanks Paul. This gives me some hope and hoping I have a similar outcome to your Mum!

    • +7

      did they get the money back?

      • +22

        Yes we did.

        Cba was great to work with, nab and anz were terrible. CBA was able to stop the transfer and freeze the account to reverse the transaction sp was able to recover some money quickly.

        The other 2 however were terrible and didnt want a piece of it. Had to go via the conveyancers insurance to lodge a claim which took almost a year to come through.

        We actually interviewed with a few news agencies as at the time it was when PEXA was being deployed. Im sure you could uncover the article if you really went digging.

        • +2

          I remember your story. Glad it worked out.

    • +1

      First time I’ve read about this. That is (profanity), stupid real estate agents can’t even keep their emails secure, probably too busy browsing porno websites instead of doing actual work.

      • +1

        It was the conveyancer and not the real estate agent. Something list this happens a lot in Australia and is generically called "Business Invoice Compromise" by bodies like IDCare.

        • +2

          paulpavs said it was the agent:

          They traced the issue back to the real estate agents email which was hacked

          • @abb: That’s what google entries described too when I googled this scam.

            Some people had issues where their conveyancer was the problem and some had issues with their real estate agent. As per OPs comments they mentioned the REA.

  • +4

    Did the banks/conveyancer/police indicate whether this kind of hacker attack has happened previously?

    I only ask as I recall a 2018 media report where hackers stole $250,000 from the proceeds of their home sale while it was being settled on Australia’s new online property transfer system, owned by the big banks and state governments

    • So my conveyancer said its become fairly common in the industry but it was the 1st time its happened to them. They're trying their best for me to get me cover under their Insurance Comp A insurance which includes protection for Cybercrime. Unfortunately, it may only cover the insured party (them) and not include 3rd parties like myself, but they are trying their best

      Mod: Edited for privacy

      • I can only imagine the stress you are feeling over above the usual stuff when making a property purchase and all that it involves. Hopefully, your money will be recovered and soon.

      • +12

        You’re not covered directly.

        I’m only guessing but it seems like they were hacked. So you sue them, then they’re covered. Maybe.

        Might be worth seeing with a lawyer if there is any merit in this.

        • They may not have been hacked it could have been OP being hacked - but typically they would hack conveyancers and monitor the email and strike when the time is right.

      • +4

        If their insurance only covers them, then you make a claim against them since the hacker was very, very likely sitting on their side on their compromised system waiting for opportunities.

      • +7

        It seems odd if you contacted your Bank within the day it happened. Banks transfer money in batches, electronically, and not usually during the day. It may “leave” your account immediately, ie you don’t have access to it, but typically the transfer inter Bank happens later that night. My Mum was the victim of a scam a few years back, (older citizen, thought she was talking to Optus), but my brother walked in, they called NAB, froze the outgoing monies to Westpac. Your question for your bank should be, when did they release the money, and if this sum is unusual for your account, why did they not contact you to verify the transfer? Sorry for the difficult position you were in, but squeaky wheel etc here may pay dividends ( pun intended).

Login or Join to leave a comment