Need to know
- Like so many others, the Commonwealth Bank Securitisation Advisory Services scam started with a sponsored fake ad on Google
- When the scammers sent through Jake's login for the fake SAS customer portal, it looked legitimate
- Bankwest: "We have done our best to recover the funds, but unfortunately, we have not been able to do so"
The scammers had the patience of seasoned criminals, luring their victim step by step.
The documents they used, the protocols they followed – it all convinced Jake that he was dealing with the real Securitisation Advisory Services (SAS), a subsidiary of Commonwealth Bank.
That illusion abruptly evaporated about seven months later when he attempted to log on to the fake SAS customer portal to check on the $100,000 he'd invested.
The site was no longer there. The scammer's phone number was disconnected. His money was gone.
Commonwealth Bank had posted a warning about the scam on 17 February 2023, but Jake didn't see it at the time. He fell for the ruse in late April.
I never thought that a criminal organisation could pose as a clone of a household name like CBA, and they wouldn't be swift to take action to bring it down
Scam victim 'Jake'
Jake, a 47-year-old project manager with an executive role in the Victorian Government, doesn't understand why CBA had not found a way to stop the scam in the intervening months.
"It was two months later and this organisation was still out there masquerading as Commonwealth Bank, taking people's money. I never thought that a criminal organisation could pose as a clone of a household name like CBA, and they wouldn't be swift to take action to bring it down."
Fake Google ad sets the stage
Like so many investment scams, it started with a sponsored fake ad on Google. Jake was looking for a better rate of return on his savings, one without too much risk.
After filling in the contact form on the fake SAS site, he got a call from a woman with a British accent who Jake describes as "very personable and financially literate".
Several phone calls and emails later, he agreed to invest in what he thought were investment bonds for Infrabuild, a Victoria-based steel manufacturer.
He was familiar with the business, which had large facilities in Melbourne.
At 12% fixed interest it seemed like a better idea than a savings account.
To open his SAS account, Jake had to send a photo of himself holding his passport along with proof of address, and fill out detailed application forms. There was no sense of urgency from the scammers.
In late April 2023, Jake sent the money from his Bankwest account in four $20,000 transactions and one for $19,999.
When I logged in, I could see my investment details like a normal banking or account management platform
Jake, scam victim
But he first crossed over into the scammers' hands with a $1 test transfer at their request.
The continuing attention to detail strengthened Jake's belief he was dealing with the real Commonwealth Bank Securitisation Advisory Services.
When the scammers sent through his login for the fake SAS customer portal, that too looked legitimate.
"When I logged in, I could see my investment details like a normal banking or account management platform. I accessed the portal about once a month to check my portfolio, and everything looked normal."
Everything about the website and the process of investing seemed legitimate to Jake.
Loss sets victim back five years
When the customer portal was suddenly not there one day in late November 2023, Jack said to himself, "this is looking really bad".
"It's about three years worth of savings, so it's probably set me back about five years in terms of heading towards retirement. It's depressing, obviously, to think that you went to work for a number of years and essentially just gave away the equivalent of all that."
He reported the scam to Bankwest, and the employee he spoke to was sympathetic.
"She was very aware of the mental health implications of someone losing a large amount of money," Jake says.
But any hope was short-lived.
In early February 2024, Bankwest emailed Jake "we have done our best to recover the funds, but unfortunately, we have not been able to do so".
'Vigilance the first line of defence'
Bankwest says their process involves contacting the bank the money was sent to and asking if there's any money left in the scammer's account.
If not, "recovery is not possible," the spokesperson tells us.
Bankwest showed us the scam warnings it now displays online before customers raise the limit on transfer amounts.
This measure wasn't in place when Jake was scammed in April 2023, but Bankwest says customers were still sent warnings to confirm account details before they sent money.
Vigilance on the part of customers is the first line of defence, the spokesperson tells us.
Commonwealth Bank says the fake SAS website lacked official CBA branding, which limited the bank's ability to have the site removed.
We encourage customers to remain vigilant and reject suspicious calls, emails or texts
CBA spokesperson
"CBA and Bankwest cybercrime teams take down sites that impersonate or use company branding in an unauthorised manner," the spokesperson says. (Bankwest happens to be owned by CBA.)
CBA says it has also taken recent steps to protect customers from scams, including 'CallerCheck', which lets customers verify through their CBA app whether a call claiming to be from CBA is legitimate.
But the scammers still keep coming.
"We encourage customers to remain vigilant and reject suspicious calls, emails or texts," CBA says.
Account name matching may have stopped the scam
Before sending any money, Jake checked that Securitisation Advisory Services had a legitimate Australian Business Number and financial services licence. He now knows that was not enough.
"I thought I was diligent and careful," he says.
He also assumed Bankwest would flag $100,000 worth of transactions over a few days if they were going to a questionable account.
But Bankwest apparently didn't undertake a confirmation-of-payee check, which involves matching the account and BSB number to the name on the recipient account to make sure the money's not going to a criminal.
I have come to realise I do not have enough knowledge about the checks required or understand how deep these scammers and cybercrimes can penetrate
Scam victim 'Jake'
This is not currently a legal requirement for banks in Australia, though the industry recently committed to introducing a confirmation-of-payee system sometime in the next two years. In the UK and other countries, account name matching has proven an effective anti-scam measure.
But any forthcoming scam prevention steps in Australia will be too late for Jake.
"I have come to realise I do not have enough knowledge about the checks required or understand how deep these scammers and cybercrimes can penetrate."
(Editor's note: 'Jake' is a pseudonym.)
Stock images: Getty, unless otherwise stated.
