Simon Elvins and his wife were excited – they had spent 10 years saving for their first home and they had finally got there. The New South Wales man had just been sent an invoice from his conveyancer, asking him to pay the first lot of his home deposit for a property in the Blue Mountains.
In two transactions on 5 and 8 May, he sent the money and waited. After a few days, he had not heard back, so he emailed the conveyancers.
After a back and forth with the conveyancers and the real estate agent over five days, they worked out what had happened – but it was too late. Scammers had intercepted the email, changed the account details on the invoice and stolen his deposit.
With two quick transfers, Elvins lost $274,311.57.
“We were just emailing back and forth, and then we get an email saying, ‘This is the account you need to pay the money into’,” he says. “I had quite a reasonable relationship with the conveyancers. So I just didn’t think anything of it … It was getting close to completion.
“I just paid it. There was no warning to ring them before I pay.”
Elvins and his wife had fallen victim to a payment redirection scam, where a criminal impersonates a business or its employees via email and asks you to make a payment to an account the criminal controls.
The data suggests these scams are on the rise. Scamwatch data shows that small and micro businesses lost $13.7m to scams in 2022, a 95% increase compared with the previous year – and the biggest contributors to these losses were payment redirection scams, also known as business email compromise.
But the scammers also target individuals. Elvins’ money had been transferred from his Westpac account to an account with NAB and was gone within hours.
“Once we realised, we did something … We had to raise a case with Westpac and Westpac raised the case with NAB, and then, you know, seven, eight, nine weeks later, we still hadn’t heard anything,” he says.
“And then suddenly, $93 dropped into our account.”
In total, they received just $270.72 back.
In March, Westpac announced it would launch Verify, which alerts customers if there is a potential account name mismatch for payments to a new BSB and account number via the new payments platform.
At the time the bank said it would be rolled out over a month, but it is understood not all transactions have the new layer of security.
The bank would not comment on Verify but said customers were urged to use PayID, which has the best protections.
“We are continuing to see fraudsters target Australians through payment redirection scams,” the spokesperson said. “This is where scammers gain access to a compromised email account and issue invoices or emails requesting payment to a new or updated bank account.
“Customers should always verbally confirm payment details with a business before sending any money, or use PayID, which links bank details to an authorised mobile number, email or ABN so you know money is going to a legitimate account.”
NAB’s executive of the Group Investigations and Fraud unit, Chris Sheehan, said if it took the bank 10 days to be alerted to fraudulent activity, it made it very difficult to recover funds.
“Once we were advised of the event, NAB acted quickly to freeze the remaining funds and report the disputed transfers to the receiving banks. Our recovery efforts are ongoing,” Sheehan said.
“We’re seeing a growing number of scams featuring money mules, where a person receives money stolen from a scam victim and allows their accounts to be used to move the funds to another person or account.”
Money mules may also be scam victims themselves, operating accounts unwittingly and acting on a third party’s instruction, Sheehan said.
The mules can sometimes receive a commission for allowing their accounts to be used by scammers.
“Our team will always do whatever it can to get stolen money back. However, in a lot of instances, this can be extremely difficult, given the sophistication of scams and the speed at which funds are moved,” Sheehan said.
Stephanie Tonkin, the Consumer Action Law Centre chief executive, says Australian banks need to follow the lead of the UK, where transactions go through a confirmation of payee process.
“I’m just not sure that this case would happen if there was confirmation of payee being used over here,” she says.
“It’s a very different culture and approach to the whole problem. I think people in the UK would be quite alarmed to hear the way that it’s approached and the victim blaming that goes on over here.”
Elvins and his wife had already paid $110,000, a 10% deposit to the real estate agent, so have been able to keep their house.
But they are wrestling with a larger mortgage than they had hoped. “Financially, we’ve been crippled,” he says.
“The onus is on the customer to go and do all these checks – the scammers are very sophisticated. I can’t see anywhere where the banks are being held accountable.”
