HELP PLEASE! Scammed out of nearly $100K

Hi everyone,

So I'd like to precede this by saying I already feel absolutely horrible. I feel like throwing up constantly just thinking about this, but thought I would put it out there to see if anyone in the OzBargain community might have had any similar experiences or any advice.

Long story short, it appears a scammer hacked either my conveyancer's or the other side's conveyancers email accounts. and from doing so, got my details as well as the details of my upcoming property settlement. They knew the amounts due in terms of stamp duty payments etc, as well as the dates these amounts were due. They created a near identical email account to my Conveyancer, who I was emailing around 5-10 times a day and so simply didn't notice anything out of the ordinary when I received the scammer's email. It popped up only with my Conveyancer's name and the email address didn't come up as 'new sender' or anything. I know that I should have checked the email address before doing anything, but I had just answered about 3 other emails from my Conveyancer and still had about 3 to go. I had 6 emails in a row from her on different matters and it didn't at all enter my mind that 1 of these 6 might not be like the others.

In short, I transferred nearly $100K at the direction of this scammer who I believed to be my Conveyancer to the account they directed in the email. I called the Conveyancer later that afternoon to discuss another matter, and mentioned to her I had transferred the stamp duty payment for this property. It was then we both realised what had happened.

I searched the BSB and realised it was a Bank X account. I called Bank Y first (my bank) to ask them to commence a scam investigation and try recover the funds immediately. They advised the funds had already reached the other account but they opened the Scam investigation immediately. I then went to Bank X and tried to have them freeze the account the funds were received into. They said the account was already closed and for some reason, they couldn't see any details in the system about who had opened or closed it (how is that possible?). That night, I attended the Police Station and filed a fraud/scam report.

I now have the Conveyancer's insurer, the Police and Bank Y/Bank X working on this case but I'm accepting the worst and not expecting to get anything back. In the off chance anyone here might have had similar experiences and have any advice, I thought I'd raise it to the OzB community. Again, please don't pile on me. I know and I feel horrible. I've barely been able to sleep and I am just hoping there may be some avenue I haven't thought of, even if its not likely to succeed.

Thanks in advance everyone

Mod: Edited for privacy

Comments

        • When I send over 2k it takes over a day. For 100K it should have taken at least 2 days to clear surely…

          I reckon the scammer was hoping OP wouldn't realise for a couple days? Will be following this story

      • How do you know it was your emails hacked, and not your conveyancers emails?

  • +6

    Have you reported it to:
    https://www.cyber.gov.au/acsc/report

    • +2

      Thanks mate. Yes I have. Haven't received any update as yet from these guys nor from NSW Police or Bank Y :(

      Mod: Edited for privacy

  • +12

    You poor thing! I hope you can recover the money! It sounds like you've done all you can. Don't accept getting fobbed off, keep calling all the banks and the police to try and get any new info and if there's anything else you can do. The more annoying you are to them the more likely they are to do what they can. I think CBA are usually pretty good with this sort of thing. Hopefully they'll put enough pressure on NAB for them to act promptly. Maybe even make an appointment to see someone in your local commonwealth bank branch.

  • +110

    Thanks everyone. To answer a few of the questions, yes indeed everyone in the fraud detection professional that I have spoken to has told me the same thing - that apparently where someone transfers out an amount of over $10K and then seeks to close the account almost immediately, it should trigger a fraud warning. Unfortunately, Bank X either didn't uphold this or ignored it and allowed this person to close the account. I also find it INCREDIBLE to imagine that they don't have any ID on file for the person who opened the account and then closed it, and to then not be able to retrieve any info about it, seems beyond belief.

    Funnily enough, the scammer emailed me again yesterday informing me 'your final payment before settlement is due this Friday.' Knowing the Bank X account is now closed, I asked them to confirm if it was the same account. They advised it is a 2nd 'trust account' and this one is a Bank Z account from a BSB check. I called Bank Z to plead with them to put an alert on this account to flag 'suspicious activity' and thereby prevent it being allowed to be closed. They said they cannot take my word (understandably) and either the Police or my bank need to make the request. Unfortunately, since filing the scam report with the Police and Bank Y last Tuesday, I've heard barely anything despite following up multiple times a day. One member of Bank Y told me 'please just relax and wait 21-45 days for an update.' Surely they can understand how much this hurts!

    Thanks everyone for the suggestions and the kind words/wishes. It is greatly appreciated at such a difficult time. I've saved since I left uni 6 years ago to be able to buy my first home and so this is just incredibly deflating. I'm not someone who wastes money, I've done my best all my life to help others and in fact most of the money that didn't go to this deposit went to a charity myself and some friends founded and run. So more than anything, I just feel I've done my best all my life to help others only to have life deal me a cruel blow, so just hearing words of comfort has helped. Thank you

    Mod: Edited for privacy

    • +30

      Unfortunately, NAB either didn't uphold this or ignored it and allowed this person to close the account. I also find it INCREDIBLE to imagine that they don't have any ID on file for the person who opened the account and then closed it, and to then not be able to retrieve any info about it, seems beyond belief.

      Methinks it's a two-person job with an insider at NAB or the person who scammed you also works at NAB

      • +26

        Yep, something definitely seems fishy at NAB.
        100 points of ID needed to open an account.
        Transfers over $10k need to be reported to AUSTRAC.

        Surely there's got to be some info there.

        • +22

          AUSTRAC reporting i.e. TTR is not applicable in this case as no cash is involved in bank transfer.

          As others said, this transaction and account closure should have breached transaction monitoring rule and NAB should have triggered ECDD straight away. It's a clear failure on OCDD requirement of AML/CTF Act. NAB failure to do their due diligence or NAB employee is involved here.

          OP, lodge a complaint with AUSTRAC that NAB didn't KYC customer who scammed you for $100K and allowed to close an account without any red flag. They might not help you but this is definitely AML/CTF Act beach, so they will reach out to NAB separately for an explanation.

    • +8

      21-45 days! That's awful in itself - not only such a long period of stress but you might lose your dream property that you carefully decided on.

      • +6

        21-45 days

        What a joke! By that time, the money will be beyond recoverable.
        OP, you should also report NAB when the dust settles for their egregious lack of compliance with AML legislation.

    • +3

      really sucks. Banks service here is bad. NAB should have checks in place to stop this crap

    • +20

      Without revealing too much about myself, I do know a bit about banking practices and normally trace and transaction reversal requests are handled between bank to bank, so in your case CBA to NAB. CBA should be doing whatever it can to resolve the situation with NAB. Usually this involves both banks talking to the owners of each of the respective accounts and relaying the information to each other. In the first instance, the recipient bank normally contacts their customer to politely ask for them to return the funds. If this fails, I recall there was a mechanism by which repayment could be enforced if the recipient bank could be provided with enough evidence to suggest the transfer was a genuine mistake. There were some grey areas too unfortunately. For instance, if the recipient is on Centrelink, the law basically protected them in the main from having to immediately repay money accidentally paid to them. I was going to say something fairly political but I will refrain… Sorry for rambling, but essentially the rules that govern how these things are handled are in the Bulk Electronic Clearing System (BECS) procedures that can be found here: https://www.auspaynet.com.au/resources/direct-entry. Unfortunately the copy that is made available to the public has had some of the confidential information removed, which unsurprisingly includes Recall Requests at 5.14 because things tend to get fairly sensitive around these. You could try to look around for an unedited copy but it might be fairly difficult to obtain without the right credentials. I did however find this summary on the Australian Payment Network's (formerly APCA) web page that does spell out the basic details: https://auspaynet.com.au/resources/direct-entry/mistaken-pay…. It talks about the ASIC ePayments Code, so that is another lead if you are looking for further ammunition for your cause. I am concerned because there are some key dates that do not line up with those that you have been provided. For instance certain actions are required to occur within 5-10 days. From what I recall, the key response timeframes regarding complaint resolution are generally around 21-45 days, so for some odd reason your matter may actually be going through as a complaint or both. Someone at CBA might have their wires crossed if that makes any sense?

      This business of the account being closed and having no KYC in place really does expose NAB and while this is a breach of the law via which ASIC and APRA may seek to impose fines, concentrating on this failure does not exactly confer liability upon them to refund the monies to you directly, so you're better focusing initially upon your consumer rights. Whether the money is laundered or used to fund terrorism is by-the-by in terms of your immediate concerns. As others have stated, you could try and get some data from your email host but it would probably only help to assist the police and forensic accountants to investigate. Perhaps the money may still be in the country but I'd bet they'd be trying to get it offshore ASAP. To do this, they might have transferred it to another local account with the right permissions to transfer large amounts overseas without question. If the money is gone, there may still be avenues of recovery and many are cost effective. NAB's own investigation may find that their own processes were deficient and they were in breach of the BECS Rules, leading to reimbursement. If they aren't so forthcoming, you could try exerting pressure on CBA to enforce the rules and recover your funds from NAB. Failing that, you could go to the Australian Financial Complaints Authority (AFCA), which is the replacement for the old Financial Ombudsman Service. The police may come up trumps and if the money has headed offshore, you might be lucky if it is domeciled in a country that will enforce the law and repatriate your funds. There are many nations that won't or can't though and these are the places a lot of the scammers tend to lurk. Going to the media and pursuing your conveyancer's insurance provider would then appear to be the next free options before seeking legal advice. There is quite a lot of legislation and regulation surrounding financial services and I have found from time to time there is more than one way to skin a cat when it comes to proving a breach of fiduciary duty to the customer. I hope what I have said is useful and that I'm not doubling up on comments already made but the devil is always in the detail. I really wish you well in recovering these funds and really have to shake my head in disbelief if what you've heard from NAB so far is the whole truth. I have to say though that some of the software upon which many banks operate is fairly archaic and lack functionality. You may find that your request might need to be escalated to people in the Bank with the right access or the ability to do stuff like interrogate the back end database. It still seems highly unusual based on my experience and common sense of course regarding the way in which banks are expected to run, as everyone here has already pointed out.

      • +3

        Appreciate your time to share your knowledge 👍.

      • +4

        Yes as icantremember said, really appreciate your time to share your knowledge. So valuable and greatly appreciated!

      • Really some great valuable information here! Thanks.

        • +1

          Glad a few people appreciate. I am a person who likes to help others, so I tend to provide as much info as I can. A lot of other people apparently don't like this on Ozbargain and they've had a go because there is an unwritten expectation that comments only extend to 2-3 lines max. It kind of discourages people with expertise and knowledge from spending their time to pass on the bits and pieces they know. I think there are only a handfull of people really who work in this area and have detailed knowledge of the BECS Rules. Really interested to hear how this whole thing plays out, once the ins and outs are truly exposed.

    • In most jurisdictions, for the stamp duty to be $100k you would be purchasing a home in the vicinity of $1,800,000 to $2,000,000. Did you mean you transferred stamp duty and deposit, or did you buy a really expensive property for your first home?

      • why does any of that matter?

    • I would have placed one cent into this new trust account to give it some activity!

  • +6

    I feel for you. You could have bought 1.32275 Bitcoin with that money.

    Seriously though, it’s a lesson to us all to never let your guard down when transferring large sums of money.

    • +2

      This wouldn't have happened if OP used multisig.

      • +1

        OP didnt pay with bitcoin

        • +1

          They wouldn't have this problem if they did.

  • +6

    Sorry to hear about your situation OP, hope it all works out for you.

    If you haven't already, make sure you change your email password to something secure and enable two-factor authentication to prevent further access.

    • +9

      Thanks mate. I have already done that and I've had 2 factor authentication on for years, which is why I'm convinced it wasn't hacking of my account. Any time I sign into a new device, it triggers an alert on my main phone asking me if I just signed in and I then need to press yes or no to allow the sign in. Praying Insurance Comp A does find the hacking came on one of the conveyancer's servers

      • Good man - you're keeping on top of it and that's all you can do right now. Best of luck.

      • +2

        The email address is definitely the conveyencer's? You should get someone here that's knowledgeable about such things to tell you how to see the email headers and have a look at them for you to see if it was spoofed or actually came from the conveyencer's email account. Might make you feel better if you know the hacker came from the conveyencer's side as then their insurance is more likely to cover you

      • +2

        I don't know if this is relevant.

        With the recent Shopback hack, my Outlook account has been repeatedly attacked and was twice successfully sync'ed (I don't know what this means because I then got a notification from Microsoft saying my account has been suspended so did it go through or not?) via IMAP into the hackers' desktop mail client.

        2 Factor Authentication was effectively bypassed because of this.

        If for example your email was managed to get sync'ed, it would be logical to think the hacker would have access to your prior email about buying property and that might explain why the hacker knows the amount due by heart. Conveyancer's email could have been spoofed and so on.

        I am hoping this is not the case but nevertheless, possible.

        Really must be prepared to force your case against the banks if insurance didn't go through.

        I really hope you will get your money back.

        • -1

          2 Factor Authentication was effectively bypassed because of this.

          Please explain how this is possible. Are you saying M$ sucks at implementing MFA/2FA?

          • +2

            @DoctorCalculon: Ms allows creation of an application password which is different to your normal username and password. The main purpose of this is.. guess what? To bypass 2fa for mail clients which need direct login to your mail account.

            • @wyrmy: yep, sadly many apps and older protocols simply do not or cannot support MFA and therefore there needs to be some sidechannels around it, but these must be created using your MFA'ed account.

        • +1

          It's from an app password. You need to generate a new one.

    • +2

      With respect I don’t think you understand what happened.

  • +5

    My first PayID hold 24 hours even if I do about $500 and here bank did everything in the matter of hours. 😞

    • +1

      I think CBA has a standard policy of 24hrs hold whilst doing a first transfer to any third party account. If the transaction was done via netbank you are able to call the bank and stop the transaction within a few hours due to the hold they put. I feel bad for you OP. 100k is a lot of money, I would have had a heart attack tbh!

  • +4

    When I bought my properties, everything is down with bank cheque from the bank, I have never need to transfer more than 10K by direct transfer.

    Even with cash purchase, all are made by cheque

    • -1

      Me too

    • +1

      Yes, only 3 years ago I refinanced a property and was pissed that I actually had to get bank cheques and deliver them to the CBD myself ( there was no mortgage/bank involved to exchange documents) rather than do an online transfer. But after reading this very happy.

      • +1

        Bank cheque cost $10 but you got to personally deliver for the safest option, if we are talking about $100k here, I will say it is the best option.

        After seeing what happen to OP's, I think I will stick with bank cheque for life unless thing change in the future.

  • +28

    Last time I transferred $100k the bank called me for an explanation within an hour, pretty shameful from NAB

    • +7

      Agree, I wonder if the bank also has some responsibility by law to do security checks on large transactions. A quick phone call confirming the name of recipient on this occasion probably would have been enough

    • +3

      Why the hell would NAB call a CBA customer to ask - Hi OP, I know you are a CBA customer and we worked hard to find out your name and phone number but did you really mean to transfer $100k to one of our customer's accounts?

    • +1

      Well OP is lucky that didn't happen otherwise the bank could then claim "well.. we called you and you reassured us the transfer was legit as you said it is going to your conveyancer".

    • I think you mean CBA?

    • +1

      That is very unusual. I transfer large sums and have never been called. Although Citi is harassing me regularly to do KYC checks. Which are PITA.

  • Yes I have heard of this happening a lot in Europe.

    It almost happened to me when I was importing from China. I was about to make a payment to my supplier for $30k, ready to press send and decided to call the supplier in China as I thought it was strange the account number had changed!

    So her emails got compromised, she should certainly involve someone to secure everything before it happens to another one of her clients!

    • -6

      Are you sure if it is not an organised crime?

      Anything can happen to anyone like this in China

      • +4

        Organised crime exists in Australia too, and this happened on Australia lol

  • +5

    None of the banks will tell you the identity of the account owner…
    From now it's in their hands and still follow standard fraud and AML procedures.

    Unfortunately, whilst $100k is a lot to you, for the banks and case managers, this would not be a high priority. The amount is quite small transaction wise.

    From NABs side, standard AML controls would have kicked in and it is unlikely that the full amount could have been withdrawn on the same day.

    Talk to your bank and ask for a case manager to be assigned and get them to email you. CBA is actually really good when it comes to having an Australian managing cases and they'll understand from a personal view to get it moving.

    • +12

      Unfortunately, whilst $100k is a lot to you, for the banks and case managers, this would not be a high priority. The amount is quite small transaction wise.

      This is absolute codswallop.

      Source: Work in Fraud and Scam prevention.

      • +2

        It’s great to hear someone who works in fraud and scam prevention call out BS as they see it.

        But I’m also intrigued that someone who has worked in the area contribute nothing else, so far, in this thread.

  • +3

    For someone who is just about to settle on a property in the next few weeks, this is a terrifying read :(

    • +1

      but could save you lots of money!

    • +8

      The old fashioned way of bank cheques driven over in thr car and given a receipt is quite good. Unless you are scammed and drive to a fake office…

    • did you read about the water damage to an apartment too?

      • I did, a good building inspection is one of my highest priorities as well because we are building.

  • -7

    How exactly could someone know that you were preparing to buy a property and transfer a large sum of money, right at the perfect time?

    It sounds like your conveyancer was in on it.

    • +5

      Nah super easy. A number of conveyancy offices have next to zero IT security now - eg just use Google Gsuite or O365 without 2fa - or just plain old hacked on prem email. The hackers phish the email accounts and just monitor the email and lie in wait for a nice whale to come in (a few hundred k transaction ) and go for it.

      • That's it!

        That would have been the reason why they want to IMAP sync your hacked email to their mail client so they can monitor the email and pounce at the right time.

        Oh Lord!

    • +6

      The conveyancer waa hacked.

        • +9

          Yes correct that’s how we know they were hacked.

  • +11

    OP I’m so so sorry.

    These scammers are so evil and it can happen to any of us. I worked in tech, had been trained to watch out for these scams and almost got done myself. Was so close to transferring the money. When you are in a rush, stressed, super busy etc…. that’s when they get you. I couldn’t believe I’d almost fallen for it despite being the last person who should have. Don’t beat yourself up, put the energy towards fighting NAB who should never have closed that account without questions. It shouldn’t have even got through their money laundering rules. All transactions over a certain about are meant to get checked and I’m pretty sure the threshold is less than $100k.

  • +13

    How did they transfer 100k out and close the account so quick. I can’t even transfer $100 without some pain and you have to call the bank and wait on the phone for 4 hours to close an account or you go into the branch to do it in person - let alone opening an account. Your scammer managed to navigate all this in a day.

  • +4

    Unfortunate story, hope you get it resolved.

    Thanks to your post, I'm going to take my business away from NAB, and migrate to someone else who doesn't claim they 'know nothing' about the accounts and information they should have on people.

  • +7

    As someone who is currently building a home, i feel so, so sorry for you OP. The amount of time it takes to save a deposit, the sacrifices, the anxiety of going through a home buying process, only for this to happen, its disgusting to be honest.

    I think you should also try to talk to someone about whats happening, just to help you cope. I know i would go to a really dark place if this happened to me. I lose my shit when it comes to getting ripped off for a small amount of money and $100k is no laughing amount.

    This scam might be a common practice tho, as i specifically got an email from my solicitor early on saying before i transfer any money, to call her directly and confirm the bank details and if any transaction was actually requested.

    Also, keep calling the bank/police/whoever every single day. They wont rush to solve the case on your behalf, you need to keep on top of them.

    Good luck man, really hoping you get that money back.

  • +1

    From now on have every message sign with digital certificate. Only the real person will have the private key to sign the message and the public key will be used to verify the sender signature.

    • +2

      Or just call them first. It's what I do. I was only transferring 20k to a contractor and I called them and went through the amount and confirmed their account details that were on the invoice before I transferred any money.

    • +5

      Unfortunately, I have a hard time seeing PGP encryption become used everyday by normal people for communication. Email providers/clients would need to make it mandatory before the average user even wants to think about it. Convenience always wins out over security.

      • +2

        Plus many people would just keep the private key on their computer and if your computer is hacked then the signature means nothing

  • +5

    If the scammer wants to transfer the final settlement fee to another westpac account are you able to alert police and set a trap?

    I hope police pick up and do something. This is crap.

    • yeah get the cops to transfer the amount to them and trace the the bank acccount and then pounce on them!

  • Sorry to hear about your circumstances. Hope they catch the culprit and you get your money back. What about the sale? You don't mention that at all in your post

  • Can’t really add much as I don’t know anything about this sort of scam but I really hope you get your cash back OP. That’s just absolutely disgusting. If you peruse reddit the r/Ausfinance subreddit might be able to give you decent advice.

  • +3

    Damn. I'd feel terrible too. That's a lot of money. Best to remind yourself it'll set you back a few years but in the long long long term your house will have increased by more than $100k. Try to think of it as paying a premium.

    I'm probably more concerned about your mental health than the money. If it keeps playing on your mind, you should go and see a GP, get a referral to see a therapist.

    • +4

      Does that assume OP can still buy the house?

      • Yeah good point. Hopefully they can still navigate a way through if they're still interested in buying.

    • +3

      Thanks mate. Its a good way to think of it and thats essentially what I've been trying to say to myself. You're right though that its probably just as much the mental health side of things as the money. I juts can't get it out of my mind and keep waking up thinking its just a nightmare. Sadly, its all too real

      • +1

        If you have your proofs up. Start a GoFundMe and put your evidence there. I’m sure there are kind people out there who collectively be able to help you out. I also hope that NAB does not get away with this and get punished hard.

  • +4

    Sorry to hear OP

    In short, I transferred nearly $100K at the direction of this scammer who I believed to be my Conveyancer to the account they directed in the email. I called the Conveyancer later that afternoon to discuss another matter, and mentioned to her I had transferred the stamp duty payment for this property.

    is the stamp duty on your first home nearly $100k 😱 Is your first home over $2m?

    • Probably the 20% deposit = 500k?

    • In Sydney an average 2 bedroom home now costs $1.3 million.

      Thats just sh#t box on average street in an average suburb. So $2mill while shocking is quite possible.

      And to OP hope they find the duckhead who got your money and they get jail time and you get your money back.

  • I hope you do get your funds back. May just take awhile, which I also assume has now stuffed your settlement. These scammers are scum. I recently had my credit card hacked and picked it up quickly as my card didn't work at an efpos. Checked and account had max'd out the limit. Sone little shit was holidaying in the South of Italy at some resort. Bank told me the investigation would take 28days. Card replaced. My case was a bit different as it wasn't my money lost. I didn't need to pay it as they have since cancelled the debit. The bank mind you still never called or emailed me though about it being closed out.

  • -4

    When you transfer the money didnt you check the name of the account?

    • +7

      The name literally does nothing. You can type anything in, go try it.

      • Correct. Likewise, for credit card payments.

        At least with PayID transfers, the name is looked up automatically before you confirm.

    • +5

      You can put incorrect name on account and the transfer still goes through.

  • OP - firstly I want to say how sorry I am that this happened to you. Sadly the world is full of asshats.

    I know of someone who had $20k transferred out of their CBA account by a scammer by changing the Optus password and phone number to approve the transfer. Presumably the bank account details were hacked somehow??

    CBA were brilliant to deal with and the money was refunded to them. This only happened a few weeks ago. Once the bank received information from Optus to confirm the account details had been changed, it seemed to expedite the outcome. Maybe your conveyancers could provide written advice of their version of events to the bank.

    I wouldn’t be surprised if your conveyancers email was hacked. Hopefully they have someone looking into that?

    • i think cba does not allow changing of mobile unless you visit a branch.

      • naa have done it over the phone not long ago

  • +1

    Sounds to me that NAB did the wrong thing and this might be an expensive mistake for them.

  • +7

    OUCH - OMG.
    Someone tried this on at my work for a six figure transfer but we stopped it quick enough at the bank.

    It was a hacked email account. They can do simple things if they get into someone's account like setup a rule just to forward copies of emails to them and then delete that from sent box. The rule sits there forever sending copies of all emails to a duplicate mailbox even if you change passwords. They monitor it for keywords such as property settlements then intercept and send a copy of the email with changed details. If they still have access they can delete the legit email too.

    Then they tried it again. It was easier for me to identify as I had received the real details then got a separate email saying the account details had been changed which sparked my interest. Reported it to the police. Our IT department implemented two factor authentication and audited all access logs to the accounts.

    I think the NAB should have better records and maybe try on them for at least partial liability.

  • +4

    I feel for you OP. I think I would have had multiple panic attacks and hospitalized if I were in your place. I made a similar transfer amount recently to my conveyancer, I would have been destroyed if this happened to me.

    Stay strong. From the sound of it, you seem to have a good enough case to get your money back from NAB.

  • Feel for you. Hope you manage to get insurance to pay

Login or Join to leave a comment