Media clips: "I realised that the scammer took $49,900, which is my whole life savings."
"Life savings - it's hard to swallow when you lose all that money over 1 little transaction."
"He asked exactly the same verification questions as a HSBC representative.
I thought I was genuinely speaking to a HSBC employee."
Gillian Bradford: Now, the people you just heard are real victims of a bank scam that turned their lives inside out.
And if you've been following along at home, you'd know last year Inside ASIC actually kicked off with an episode all about scams, and this year we really wish it wasn't so.
But we're actually talking scams again because the people ripping us off are finding new ways to do it and ASIC keeps having to adapt and fight to find justice for the victims.
Hi, I'm Gillian Bradford and welcome back to Inside ASIC.
Now that case that ASICS taking against the Australian arm of global banking giant HSBC is still before the courts and it's just one piece of the work the Commission's doing to try to protect consumers from scams.
And I'm very pleased to say I'm joined now by Sarah Bower, who's the senior manager of enforcement and compliance at ASIC.
Sarah, Hi.
Sarah Bower: How are you, Gillian?
Gillian Bradford: And Sam Riggall is a senior lawyer with the scams team.
Sam, Hey.
Sam Riggall: Hey.
Gillian Bradford: Sarah, let's start with one of the scams that's top of mind right now.
Whether you call it SMS masking or spoofing, this is what many HSBC customers experience.
Talk us through exactly how this scam was catching people out.
Sarah Bower: Yes, we'd start by saying, Gillian, that many of these people that we've spoken to are intelligent, educated people who would tell you they are not the type of people who would fall for scams.
They'd never fall for a romance scam, they'd never buy a fake fixed income bond, they'd never buy cryptocurrency.
What they were doing was they were following a protocol of reporting suspicious transactions to their banks and as a result, losing in many instance, $50,000 in a matter of moments.
And for those listening that might say, well, this wouldn't happen to me.
I can just paint the picture of how some of these scams are operating.
Gillian Bradford: Yeah, tell us the hook that gets people in.
Sarah Bower: So, most people listening, Gillian, could pick up their phone right now and they would see a string of text messages from their bank.
Legitimate text messages.
Many of these bank impersonation scams include something called alpha tag spoofing, which involves a scammer interrupting a legitimate thread of text messages with a fraudulent message.
And those messages, the good ones, are balanced, they use balanced language like a bank would - they don't have typos, they have good English - notifying the customer that an online transaction has taken place, for example that they've just bought something on Amazon or a new phone has been linked to their account and it usually includes text like.
If you did not authorise this transaction, call the bank on, provide the phone number and quote the following reference number.
Gillian Bradford: Okay, so you think it's real, you call the bank. What happens then?
Sarah Bower: So, they - the scammer - might say something like, oh, I can see that you just transferred $10,000 in the last hour.
Is that correct?
And of course the customer panics and assures the bank officers that they didn't.
And it's at that point the bank officer swoops in to save the day.
They tell the customer that they'll immediately freeze the transactions and recall the funds.
And it's in that moment of crisis that the scammer tells the customer to go on their banking app and read out a one time passcode or something similar, which they say they need to stop the payments from going out of their account.
And unfortunately, it's during that moment of crisis that the customer makes the mistake of providing the one time passcode or other security information and the scammers in their account and start stripping money out.
Gillian Bradford: Sam, I want to go to another type of scam that's front of mine for ASIC right now, and that's dodgy investment scams.
Let's just take a listen to this scam investment ad using an AI version of the PM, Anthony Albanese.
Media clip: Thanks to machine learning, Quantum AI has achieved a high success rate of 94%.
This project is open now for Australians and the minimum investment amount is 350.
Gillian Bradford: And this is another one using Sky News presenter Chris Kenney and mining billionaire Andrew Forrest.
Media clips: Mr Forrest also claimed that none of the investors would lose their money.
I am so confident in the project's stability that I'm prepared to compensate any losses and pay $50,000 to anyone who loses money on my platform.
Gillian Bradford: Sam Riggall, what sort of challenge do these type of deep fakes pose for ASIC?
Sam Riggall: The scams are becoming increasingly sophisticated to the point where anyone could fall for them.
Yes, sometimes the videos that you'll see, they stutter a little bit.
They're not perfect, they are getting better at a very quick rate.
But it's - you've got to remember a lot of people these days are using internet from their mobile phones.
So they're looking at a small screen, they're not paying attention.
They click the link and the second stage of what is quite a sophisticated programme kicks in.
They're then at a website.
It looks whiz bang and they provide their contact details.
Gillian Bradford: So, for people who have scrolled right by and haven't clicked on them, what is the basic MO of the scammers?
Like how are they persuading people they're legit and getting them to hand over money?
Sam Riggall: There are a number of different types of websites but the main one people would first see is 1. attempting to get contact details because the next step in the process is to have someone call you from the scam call centre and walk you through the process.
Apply high pressure tactics and get the sale.
Often that sale is a small amount, a couple hundred bucks to get you started.
So, people are not as aware and risk sensitive as they would be if they thought this is something I'm going to invest lots and lots of money into.
They even go as far as showing you the investment returns you've made and maybe even refunding a small amount because it's giving you a payout to show this is legit.
So, I think the really important thing is just not trust what you see on your screen.
Like you can see a fully functional program that shows the amount you put in, shows the daily trade results, shows your money growing.
But it's so easy to fake that these days.
And as soon as you give your money to the scammer, it's not in that system, that system is completely fake.
The money has been pocketed from day one.
Gillian Bradford: And Sarah, on this HSBC case, we must emphasise it's very much before the courts, but as a journalist I was very much aware of a number of news stories about HSBC customers losing amounts probably late into 2023.
And what's ASIC alleging in this case?
Sarah Bower: So, as you said, Gillian, it's really important to say at the outset that these are allegations by ASIC, they're not proven.
But our case in the Federal Court has three elements:
The first is that we allege that HSBC failed to have adequate controls in place to protect their customers from scam related losses.
Secondly, we allege that it took them too long to investigate reports of unauthorised transactions.
And we found that in 66% of cases it was taking HSBC 100 days or longer to investigate a report of an unauthorised transaction.
And thirdly, we allege that it just took too long to get customers back to banking.
It took on average 95 days from the date a customer first reported an unauthorised transaction to get most customers back to banking for the period we looked at.
And we just say that's too long for customers to be locked out of banking.
Gillian Bradford: Sam, finally, to you it might seem like a bit of a game of whack-a-mole at some point.
Do you feel like ASIC's actually making a difference with these scam websites?
Sam Riggall: I do, and I think we are having a demonstrable impact in hardening the Australian environment.
We can't necessarily control what happens globally, but we can make Australia a less attractive target for scammers.
Websites play a key role in the chain of the scam ecosystem.
Without a website to collect the contact details, the process stops and without a website to host a fake investment platform to convince the consumer that their funds are growing, it stops.
If we shut down that website after the consumers deposited a few hundred dollars and before they make a big deposit, well that's we've saved that consumer our achievements in that working together with the National Anti Scam Centre and the whole of ecosystem approach that Australia has as starting to show dividends.
We've had a reduction in scam losses for two years running and we're actually also starting to see a reduction in the numbers of investment scam websites we're detecting.
So we do think the work we're doing is having an impact.
Gillian Bradford: Sarah Bauer, Sam Riggle, thank you so much.
Fascinating conversation, thank you.
Sarah Bower: Great to meet you, Jillian.
Sam Riggall: Thank you very much.
Gillian Bradford: Now, next up, we're going to be joined by consumer advocate Steph Tonkin to talk to us about the human cost of some of these scams.
And I'm joined now by Steph Tonkin, the CEO of the Consumer Action Law Centre.
Steph, you are with us in Season 1, and I'll include a link to that chat in the episode notes.
And today it's another really huge issue, Steph.
There would barely be an Australian who hasn't been touched by a scam.
Tell me what you're seeing at the frontline, how people have been affected.
Steph Tonkin: I think my main reflection on that question is, of course, there's financial fallout very significant for some people, people losing their life savings and the future that they planned for.
But also, there's a very significant, sometimes more so, emotional toll, psychological toll that being scammed can cause.
So, we speak to people who report that their parents are changed forever.
Lack of confidence transacting online, lack of confidence, engaging with other people, just a real sense of distrust after falling victim to a scam.
And very much that feeling of shame. Shame that they have been so silly in their own minds, which of course we know isn't true.
Scammers are highly expert criminals, but it doesn't mean that people don't feel shame and incredible grief at the loss after being scammed.
Gillian Bradford: Now, you dealt with a lot of HSBC customers.
For you, it's not just about the fact that these customers were scammed out of money, but how the bank dealt with them.
Steph Tonkin: When people were reaching out to their bank for help and again remembering people are losing huge sums of money and are in shock at the time that they're trying to get help, they were told they were stupid or the transaction they authorised it.
There's nothing you can do, Take better care next time.
What our clients report to us, quite sadly, is that their treatment by the bank when they are reporting a scam.
Sometimes after waiting hours holding online trying to speak to someone, or while on hold driving to a bank branch to try and speak to a bank representative, they find that the treatment by the bank sometimes is as bad as the scam itself.
Gillian Bradford: Steph, ASIC's done a couple of big reports on banks big and small, and I think it found something like 96% of total scam losses, you know, customers end up paying.
Is that good enough?
Steph Tonkin: Absolutely not.
It has to be incumbent on the businesses who have the resources and the scams intelligence.
It has to be incumbent on them to prevent the scams and only in really limited circumstances, in my view, should consumers have to pay.
Absolutely, there should be compensation when a business fails to keep their customers money safe.
In the HSBC case, there was some investigative journalism which identified that in some of those cases there were logins simultaneously or at the same time from two different hemispheres on a particular account.
Now, the technology exists to be able how to identify that, why didn't those flags go off? The HSBC scam again, it ran for many, many months.
And in fact, that same scam had happened at HSBC in the UK as well years prior. So they were on notice.
Yet what frustrated me about that particular case was that despite all of that, and despite the scam continuing for so long and hundreds of customers being impacted, the bank still said there was nothing they could do.
They could not have prevented the scam until right at the end.
Gillian Bradford: Steph, how important is it that ASIC took enforcement action in this case?
Steph Tonkin: This case involved widespread consumer harm.
Hundreds of people fell victim to the HSBC scam and lost significant sums of money.
That enforcement action should also serve as a deterrent and warning to other banks and financial services that aren't stepping up and protecting their customers in a way that they're required to under the law and in the way the community expects.
Gillian Bradford: Steph Tonkin, it was terrific to have you with us again. Thank you.
Steph Tonkin: Thanks for having me.
Gillian Bradford: I'm Gillian Bradford, thanks for listening to Inside ASIC.
Don't forget you can catch up with the latest episodes and all of last season wherever you get your podcasts.
Bye for now.