In March, Cain called his New Zealand bank to say he wanted to make an international money transfer equivalent to AUD$300,000 and asked for his internet banking limit to be increased to enable such a transfer. The bank put a temporary increase in place. That day, Cain followed the payment instructions he had received from the scammer and transferred the equivalent amount in New Zealand dollars to an account at an Australian bank. Several days later, Cain’s New Zealand bank called to confirm the transfer details before releasing the money.

A few days later, Cain was contacted again by the individual claiming to be from the Australian bank and offered another investment with an 11 per cent return. Cain became suspicious – the rate seemed too good to be true. He contacted the bank directly and discovered the scam.

His New Zealand bank contacted the Australian bank and recovered the equivalent of AUD$136,000.  Cain asked it to reimburse him the balance, saying it had failed to act on clear warning signs, or red flags, indicating a scam. He said the bank had not asked what the payment was for when it called to confirm the transfer details. However, it did confirm his and his wife’s names as payees during his call, which Cain said created a false sense of security that the bank was checking that the account name and number matched. The bank declined to reimburse the loss, and Cain asked us to investigate.

Our investigation

The bank had two potential opportunities to detect the scam – during the call Cain made to raise his limit and during the bank’s call to confirm the transfer details. We found nothing in those calls to give the bank grounds to suspect a scam. If a bank detects a possible scam, if must make inquiries about the transaction and, if warranted, warn the customer about the possibility of a scam before processing the transaction. However, we were concerned at the bank’s communication during the calls. In the first call, the staff member failed to follow the bank’s internal procedure for raising of daily limits, that is, the staff member failed to confirm the nature and purpose of the payment, check for possible red flags, and read or email the required scam warning. As for the second call, the bank said this had two purposes: to check that the customer intended to make the payment, and hadn’t mistyped the payment details.  We found the staff member failed to carry out the second part of the purpose: verifying payment details. Cain was clearly out walking his dog and did not have the account number to hand. Also, the staff member told Cain he could see the payment was being made to Cain and his wife. Stating this fact did not imply the bank could check, or had checked, that the account name and number matched, but Cain understood from that statement that the bank could, and had done so.

The bank agreed that its communication could have been better in both calls and agreed to reimburse Cain NZD$80,000 of his loss.

Outcome

Cain accepted the bank’s offer.