Three scams and one innocent victim: a cautionary tale

For years, we were warned to look out for emails containing poor spelling and grammar, or links to popular sites with letters or characters that were almost, but not quite right. You could argue that back then most scams were relatively easy to spot.

Fast forward to today and things are very different. Scammers and scams have evolved to the point they pose a risk to everyone who has a mobile phone, email address, social media account or penchant for online shopping.

According to Consumer NZ’s latest research, over half of New Zealand households have been targeted by a scammer in the past year. That’s not surprising. Many people receive dubious text messages every week. What is alarming is that one- in ten households have lost money to a scam in the past year, highlighting the sheer scale of the problem.

There’s no agreed figure on the size of scam losses in New Zealand. The most widely quoted figure is $198 million per year, which is huge. Chances are, the actual loss incurred by New Zealanders is much bigger. There’s stigma and shame attached to being scammed, meaning many people don’t report it.

That wasn’t the case with Heather*, a Wellington-based website developer who banks with the Co-operative Bank. Since early 2023, Heather has been caught up in three scams.

Scam one – card details stolen

The first time Heather was scammed was because someone, somehow, got hold of her debit card number and used it to do some online shopping at her expense.

“I still have no idea how that scammer got hold of my card details, I never left my physical card anywhere,” said Heather.

After Heather noticed a flurry of unexplained transactions on her statement, she contacted her bank, and the bank retrieved some but not all her lost money.

This type of scam is known in banking circles as unauthorised push-payment fraud. Unauthorised in the sense that Heather didn’t authorise the transactions; someone stole her details.

Under the New Zealand Banking Code of Practice, Heather should have been fully reimbursed for her loss, but wasn't until we got involved. If she had authorised the payments, Heather would not have been eligible for reimbursement.

Scam two – Marketplace nightmare

In late 2023, Heather listed some baby items for sale on Facebook Marketplace.

A person wanted to buy one of the items, and asked Heather to arrange the postage, saying they would reimburse her for the costs. The buyer sent Heather a link to NZ Post.

“As far as I was concerned the link I clicked was NZ Post, the logos, everything about it looked legitimate. As a website developer I have an eye for that sort of thing,” said Heather.

The fields Heather filled in were exactly what she expected, plus a link to pay for postage. However, the link started to play up and the site wouldn’t load properly. When Heather contacted the buyer to say she would arrange the postage herself, the buyer said she would send other links to try. One of the links took Heather to a site identical to the one her local council used for payments – she had no reason not to trust it.

After the buyer had sent multiple links, all of which looked legitimate, Heather had the sinking realisation they might not be genuine. She called her bank straight away to tell them what had happened.

The bank said they would never ask for the information she had entered into the online payment gateways in the links the buyer sent her.

After that, Heather started receiving bank authorisation requests via text message. The buyer, a scammer, now had access to Heather’s online banking and was trying to access her money.

“I could see all this happening, so I called the bank back. I was on hold for ages and when I eventually got through to them, they didn’t take me seriously.”

Although the scammer moved money between Heather’s accounts, they did not manage to steal any from her. The scammer also removed Heather’s mobile number from the account, but was unable to update it to an alternative number.

After the incident, the bank apologised and explained the first person Heather spoke to had not followed protocol.

Although Heather didn’t lose any money this time, she was locked out of her account while she had her devices security checked and got a case number from the Police.

Scam three – bank impersonation

In April 2024, Heather’s bank called to query a suspicious payment attempt from her account. She received a four-digit verification code via text and was asked to repeat it back. The caller then asked Heather to confirm her last few payments.

“They all sounded right apart from one. A payment of $1,000 to George Michael, I knew that wasn’t me,” said Heather.

The caller convinced Heather to share some of her personal banking details and reassured her the payment had not gone through. She was transferred to a specialist team who said they would close the online access to the account , although Heather could still use her debit card to make payments and withdraw cash.

“The call came from an Auckland number and the conversation followed the exact script of chats I had with the bank before, all very professional and logical.”

Heather then received an email asking her to verify the blocked payment was not requested by her, and a text message with a verification code for a payment of $12,000.

“At this point I was suspicious and said I was going to call the bank back myself.”

Heather called her bank to ask for help. The person who answered sounded junior and wanted to transfer her to someone more senior who could help.

“But the phone transfer system wasn’t working, so they said they would call me back.”

When Heather explained that was not acceptable, she had lost trust in calls from “her bank”, the customer service agent suggested agreeing on a code word for the bank to use. Understandably, that wasn’t enough to reassure Heather.

“All the time I was on the phone to the bank I can see there’s someone else in my account, moving money around, until suddenly I am locked out of my own account.”

Again, Heather didn’t lose any money to the scammer, but she continued to receive verification requests from the bank as the scammer tried to shift her money. The emotional and psychological impact was huge.

Eventually the bank closed her account and handed the case to its fraud team, which at that stage had a 4-to-6-week turnaround time.

“The bank didn’t offer me any solutions to manage without access to my account, other than using my husband’s card to access our joint account.

“I have to travel for work, cash handouts from my husband for weeks on end is not a sensible solution.”

Bring back the ‘princes’

Reflecting on her experiences, Heather felt like she had to shoulder all the accountability, “which is a bit of a joke”.

“I would like the bank to have some accountability for all this, it should be on them.”

As for advice for others, Heather said it’s so hard because she followed all the advice out there.

“I can’t fathom the sophistication – the links to sites that looked exactly like the real thing, the phone call that sounded exactly like my bank.

“I used to think scammers were a bit of a joke because their attempts were so obvious. It is so different now.”

After three scam attempts in just over a year, Heather thinks she may need to change her bank and her phone number too.

Yet, she is not alone in being targeted multiple times. The Ministry of Justice’s 2023 NZ Crime and Victim Survey found that, in the space of a year, 55,000 New Zealanders were repeat victims of a scam. Likewise, recent stats from the UK show that one in five victims of fraud will become repeat victims.

Statement from The Co-operative Bank

The Co-operative Bank told Consumer it is committed to helping to reduce the risk and impacts of scams. It encourages all its customers to tell them if they think they’ve been scammed; their concerns will always be taken seriously.

The bank noted the increase in frequency and sophistication of bank impersonation scams, and said it would never call a customer and ask for a password, pin or card details. That information is only requested if a customer calls the bank. If you receive a call and are asked for these details, hang up immediately and call the bank’s official 0800 number.

---

*Heather's name has been changed to protect the victim's identity.