Jenny Ng and Jian Lim often received text messages from their bank, HSBC, so it didn't ring any alarm bells when a message about fraudulent activity was sent from the bank's number.
The text, sent last October, appeared in the same thread as previous messages from the bank, so Jian thought it was genuine.
Even when he called the provided number to follow up, nothing raised any red flags.
The scammers used information gleaned from speaking with Jian to get access to his account, then called Jenny to try and fleece even more money.
Jenny said the scammer asked the same security questions the real bank normally would and knew things about their account that only a bank would know.
"They knew the system really well," she said.
It was only when the couple visited the bank in person, that they realised they had been tricked.
"We just couldn't figure out what was happening at that point because to us it was real HSBC staff contacting us and telling us they are helping us ... and it turned out everything was set up by the scammers," she said.
"My body was shaking and I just had no words at that time."
All up, Jenny and her husband lost a combined $138,000 from their bank accounts.
The scam they fell victim to was the HSBC "spoofing" text message scam, which fleeced customers of $6.3 million in the eight months to March 2024 alone.
Loading...
'Immense consumer harm'
With scams growing in numbers— and sophistication —Jenny and Jian are far from alone having been defrauded last year.
The Australian Competition and Consumer Commission's (ACCC) latest scams snapshot, released on Sunday, revealed Australians lodged more than 601,000 reports about scams in 2023 -- a record amount and an increase of 18.5 per cent compared to a year earlier.
Overall, reported losses equated to $2.74 billion. That's a 13 per cent fall from 2022's record of $3.1 billion, but almost $1 billion more than 2021.
The federal government has pointed to the 2023 figures as proof of the effectiveness of new measures, such as the national anti-scam centre launched last July.
"The government is absolutely determined to keep Australians' money safe from these criminals," Financial Services Minister Stephen Jones said in a statement.
"This report shows that our plan is working, but every dollar lost to a scam is a tragedy and we will continue to roll out our anti-scam program."
Consumer Action Law Centre CEO Stephanie Tonkin said despite reported scam losses falling in 2023, $2.74 billion was still "unacceptably high".
"That figure [represents] immense consumer harm," she said.
"Scams have become so sophisticated now ... it's near-impossible for individuals to identify and protect themselves."
Ms Tonkin said far more work and investment was required to make significant inroads into scam losses.
"The level of investment needs to be far, far greater than what we're seeing now."
"If we're seeing certain demographics losing more money to scams, then that should be a risk factor identified by businesses in adding friction, in adding in check-ins with their own customers, to see whether they need to make a particular transfer."
A 'nightmare every time I call'
Having opened her first account with HSBC when she was 12, Jenny said she expected a better response from the bank.
She said she made daily calls to HSBC immediately after the fraud, during which the bank told her the case was under investigation by the Fraud Mitigation team and she shouldn't worry.
When she was finally able to contact that team, five days after the money was taken, she said it told her that her case had not actually been passed on.
"It's impossible to speak to someone just who can actually help me," she said.
"Every time when I go through the [HSBC fraud] call centre, it's an ordeal— hours on the phone, speak to someone who doesn't know what's happening and give me some generic responses.
"It's just a nightmare every time I call."
More confusion and frustration followed, so Jenny and Jian officially complained to HSBC in late October.
Earlier this month, they were offered a $2,000 goodwill payment. The bank's investigation is still ongoing.
Jenny and Jian last month lodged a complaint with the Australian Financial Complaints Authority (AFCA), the dispute resolution scheme for financial services, which also remains ongoing.
Jenny said she was disappointed by the speed and transparency of HSBC's investigation and concerned about its security infrastructure.
A HSBC spokesperson said the bank could not discuss specific cases, but it understood being a victim of a scam was distressing.
"HSBC takes customer security seriously and aim to investigate each case of fraud thoroughly, while simultaneously trying to recover the stolen funds," they said.
"The frauds and scams landscape is rapidly evolving and becoming more sophisticated. Every industry, telco, government across the world must work together with customers to remain vigilant to prevent scammers."
The bank said it tells customers it would never ask them to provide personal information in response to texts or emails, that protecting customers was "our priority" and it was enhancing existing anti-scam initiatives and implementing new ones.
'They were just too good'
Six months on, Jenny still feels numb and ashamed when she thinks about the scam.
One of the accounts that was drained was the couple's mortgage offset account, which has put back their repayments and their life plans.
The couple also had to cancel some of the activities they had enrolled their three-year-old daughter in and can no longer afford to send financial support to Jenny's elderly parents.
"I feel really, really shameful. I just wanted to beat myself up. I blame myself so much," Jenny said.
"But when I think of it, when I play it back, I wouldn't have picked it up because the scam was just really professional ... They were just really too good."
The ACCC's report says increased cooperation between banks and authorities has helped in the fight against scammers.
But major consumer protections remain outstanding.
Many banks don't have name-checking technology, known as confirmation of payee, which means people aren't warned when entering bank account details that are different to the person they believe they're paying and are instead paying scammers. The industry says this will be in place by 2025.
There are also concerns about other vulnerabilities in the system— the ABC recently uncovered examples of registered companies being used to launder scam victims' money through Australian bank accounts.
Scams also remain widespread across social media platforms, with claims some tech giants have failed to do enough to detect and prevent them.
The government has flagged introducing new mandatory codes for banks, telcos and digital platforms, which will place new obligations on them to prevent, detect, disrupt, and respond to scams.
Mr Jones said on Monday companies would face "significant" penalties if they didn't comply with those codes, and victims would receive compensation if a company did the "wrong thing".
Jenny said victims needed more support from government and banks should "prioritise their customers over their profit".
"The burden of scams should not be on the shoulders of Australian residents who work hard and save up for a better life here in Australia, "she said.
"We are already facing enough challenges such as the cost-of-living crisis. We don't have the minds to keep up with the scammers and I think the banks and the government can do much more."
Loading...
Posted, updated
