Despite this, and concern that Sarah sounded much younger than Ana’s recorded age, the staff member agreed to Sarah’s request to reset Ana’s internet banking password. Sarah then accessed Ana’s accounts and stole $5,000. The bank said Ana caused the loss by failing to keep her password safe.

We looked into whether the nature of Sarah’s phone calls to the bank should have raised sufficient doubt that Sarah was not who she said she was. We thought the bank should not have allowed her to change the password in those circumstances. We advised the bank to meet Ana’s entire $5,000 loss.