Ollie received a text message from his bank after ending the call, along with a number at the bottom of the text. He called the number to check it was indeed the bank’s number. When the caller called back, he repeated that there had been suspicious transactions on Ollie’s account and confirmed Ollie’s 16-digit card number. Ollie disclosed one of the codes texted to him. In fact, the code completed a payment of $6,078. When the caller began to talk about Ollie’s debit card, Ollie realised that, if the caller really was indeed from the bank, he would have known Ollie did not have a debit card. Ollie ended the call and rang the bank, but it was unable to recover any of the money. The bank offered $3,050 as a goodwill payment towards his loss. Ollie sought full reimbursement, but the bank refused.

Our investigation

We considered Ollie had not acted negligently in sharing the code. Had he acted negligently, the bank would not have been required to reimburse any of his loss. We considered Ollie had taken reasonable steps to protect his banking credentials for the following reasons: First, the scammer had all of Ollie’s card details when he made the call. Secondly, Ollie was convinced the caller was from the bank because he had Ollie’s card details when he had yet to use the card; the caller knew about the text messages Ollie would receive; and in between the calls, Ollie called the number in the text and went through to the bank’s legitimate customer service centre. Thirdly, the text message with the code contained nothing about acceptable use of the code or a warning not to share it with anyone, including bank staff.

Outcome

We recommended the bank reimburse Ollie’s full loss.