Cathy completed the payment instruction form he sent her and took a copy to the local branch of her bank where she told a teller she wanted to transfer $100,000 from her savings account to the overseas bank. She showed the teller the instruction form containing various details, including the account number at the New Zealand bank through which the funds were to be transferred. The teller helped Cathy complete the transaction, with the name of the overseas bank in the payment reference field.

A month later, the New Zealand bank to which Cathy transferred the money contacted her bank to say the payment was likely part of a term investment scam. The bank was able to recover $21,000, leaving Cathy with a loss of $79,000. She considered her bank was liable for the loss because the scam proved to be a well-known and much publicised one, and frontline staff should have detected it, especially if they had been sufficiently trained – which they clearly were not.

She also said the bank failed to detect the most obvious warning sign of all – that the overseas bank did not offer retail banking services in New Zealand, so the transaction should have automatically aroused its suspicions.

A further complaint was that the bank should have checked that the recipient’s name and number matched – and the presence of a data field in which to put the name of the recipient implied the bank conducted such checks. Alternatively, the bank should have warned her it did not carry out checks. Lastly, she argued the bank that received her money was also liable for her loss because it allowed a fraudulent payment to go through one of its accounts.

Our investigation

We examined whether anything about the transaction should have alerted the bank to a real possibility that Cathy was being defrauded. If a bank detects such a “red flag”, it is obliged to make inquiries about the transaction and, if warranted, warn the customer. At the time, the bank knew about the prevalence and hallmarks of investment scams and that the overseas bank was being impersonated by scammers. The Financial Markets Authority had issued a warning about such a scam involving the overseas bank, and the media had also reported on the scam. In addition, another of the bank’s customers had not long before been scammed in similar circumstances by someone impersonating the overseas bank.

The bank argued it was unrealistic to expect frontline staff to know about all scams active at any given time. We accepted that, but its staff should be able to recognise the hallmarks of widespread, well-known scams, as this one was. They should be trained to detect the hallmarks of scams without necessarily knowing the individual features of every scam that emerges.

The bank also argued there was nothing suspicious about Cathy’s payment instruction form. We disagreed. Cathy told the teller she was making an investment with the overseas bank, but the instruction form told another story. It showed the money was to go into a New Zealand bank account. Despite being branded with the overseas bank’s logo, the form contained nothing to suggest the funds would reach that bank.

The bank was therefore on notice of a real possibility Cathy was being defrauded. In such a situation, a bank must make further inquiries and, if warranted, warn the customer. Cathy’s bank failed to do this. Had it done so, it was more likely than not that Cathy would have uncovered the scam and not made the transfer.

However, the bank was not solely responsible for the loss. As the customer, Cathy had the prime responsibility for ensuring the legitimacy of the intended recipient of her funds. Information was readily available via internet searches about the overseas bank, including the Financial Markets Authority warning and media stories about scammers impersonating the bank. There was, however, no warning on the overseas bank’s New Zealand webpage at the time she made the payment. Accordingly, we found the bank was responsible for 70 per cent of the loss, and Cathy 30 per cent.

As for her complaint that the bank did not check that the account name and number matched, the bank was not obliged to carry out such a check. The bank’s terms and conditions explicitly warned customers that it used only the account number to identify the recipient of the payment.

We were unable to look at Cathy’s final complaint – that the bank receiving her funds was also liable for her loss by allowing a fraudulent payment to go through one of its accounts – because we lacked the power to do so. Our rules stipulate that we can consider complaints only about a bank from whom the complainant received a financial service. Cathy received no direct financial service from this bank.

Outcome

The bank reimbursed Cathy $55,000.