Our bank accounts have been hacked! Rather than feel ashamed (as many of the 116 reported cases per day do), I’ve decided to share how it happened “play by play”, and what it has cost us. If you think this won’t happen to you, wait until you read how they did it…
We’re not IT security experts, but we’re more security conscious than most and thought we had the safeguards in place.
Monday, 4.30pm. My wife receives a text from Bank C saying her mobile details have been updated. She’s driving, and texts like this are often scams, so she doesn’t action it immediately.
We have a max daily transaction limit and Multi-Factor Authentication (MFA) to approve payments. Yet at 4.58pm, a transfer much higher than our daily limit goes from Bank C to our son’s account at Bank A. It fails – pure luck, as our son had closed that account 5 days earlier to get a better interest rate (it still appears in our Bank A online accounts list though).
Our banking is complicated, with multiple accounts across multiple institutions. After Bank A changed ownership, we spent the past year moving to Bank C – a long, complicated process, largely due to ID regulations – while also winding up our SMSF.
At 5.00pm, another large transfer goes from Bank C to our Super account at Bank A. We’d never paid that account from Bank C before, and recently any large payment to a new payee had been held for 48 hours unless a small payment went through a day earlier. Neither happened this time.
Prompted by the text, my wife checks our Bank C accounts and gets on the phone – there’s been no notification of the transfer and no approval through the App. Bank C confirms our mobile number and contact details were changed just over half an hour earlier. With activity still happening on our login (as the logs later showed), after some back and forth with the overseas call centre, all our Bank C accounts are locked down.
As the transfer went to Bank A, we log in there. The transfer has arrived – but hang on, the other balances look wrong, and there’s a new account with a naming convention we don’t use. We call Bank A.
Now the s@#$ really hits the fan. We’ve had no notifications from Bank A, and all our accounts are joint, with app authorisation required for transactions. In short, someone with a surname nothing like ours (Garcia) has set up a new account (let’s call it account G) in my wife’s name and his own under our profile, using a different email, address and mobile number for authorisations. He’s also been given access to all our internet-linked accounts (something even I didn’t have).
This person is obviously much smarter than me. Over the prior 3 days, they moved money from our Bank A accounts into account G in medium-sized parcels, never zeroing an account, so in a busy banking environment nothing looked out of place, except the balances all being low. From account G, the funds went to a long list of outside accounts in reasonably small amounts (to avoid bank alerts, we presume), spaced out over time, many via Osko (so instant).
The scammers started on the Friday. We hadn’t spent anything over the weekend (except a couple of credit card purchases), so had no reason to check our accounts. Should we check every day – several times a day? Honestly, who does? And still not a single payment authorisation request or change notification from Bank A. Bank A’s fraud department (very good, but the horse had already bolted) confirmed it was a very sophisticated attack, suggesting an email or mobile phone compromise, possibly spyware or keystroke recognition software. We understood several receiving accounts were also at Bank A; our access to the fraudulent account was quickly removed so we can’t verify that, but we were told all of them were being locked.
Fortunately, very good friends in internet security help lock down our emails, wifi etc, and over the next 24 hours sweep our devices and systems. We get a clean health check – it wasn’t something we had done.
By now, we are paranoid. We change every password (already all different – so many we confuse ourselves) and run through the suspects. The $899 telco transaction we stopped – an e-SIM? (No, a visit rules that out.) Online shopping, a skimmed card, card details given over the phone? Missing mail? The suss Bank A staffer who was supposed to close our son’s account? The old mobile we traded, or the printer we threw out? We don’t splash our lives on social media, but you wouldn’t need to be Sherlock Holmes to piece plenty together. Yet how did they pass security questions that even trip us up? (Was our first pet the goldfish or the dog – is a goldfish even a pet? And did we use the full name or the nickname?)
One of the criminals’ first moves was to run statements, so we did a credit search on ourselves (Equifax). Three online credit/loan providers had already checked our credit worthiness, and 2 loans had been taken out in our names. The lenders say we aren’t liable as we contacted them quickly – but we may be legally liable for loans we don’t even know about… We’ve blocked credit checks for the next month and will renew that every month (meaning we can’t apply for loans either).
For the next 3-4 weeks, we have little or no access to banking and funds while the banks investigate. Verifying identities, changing IDs, changing all the automatic withdrawals – the list goes on. We (mainly my wife) have already spent over 50 hours navigating the maze.
How do we feel? ANGRY!!!
- At the people who stole a significant amount of money from us and upended our lives.
- At the two banks that gave a stranger access – especially Bank A, where a new account could be set up to facilitate the whole debacle.
- But mostly at our GOVERNMENT. You take more and more of our money in taxes, put on more and more public servants, and NOTHING is getting any better. Massive and increasing regulatory burdens make law-abiding citizens jump through cumbersome hoops, yet seemingly do nothing to stop the criminals. It took us months to change banks (as you advise, to “get a better deal”), but a criminal can circumvent all this in minutes?
We doubt our hack is among the 116 a day – why would banks report it and get punished by the Government for the breach? Better for everyone to fix it internally. And estimates are only 1 in 10 cybercrime victims report it anyway.
When did you last hear of these criminals being arrested, let alone locked up? There are no easily found statistics. By comparison, Workplace Health and Safety prosecutions led to 308 convictions nationwide in 2025, down from 321 in 2024. Credit card losses alone exceed $1 billion a year, but I bet nowhere near 300 people a year are convicted of all fraud combined.
Think about it: I don’t know a single employer who sets out to harm their greatest asset, their people. They’re generally law-abiding, building a future, paying taxes and contributing. Meanwhile, people who set out to destroy lives through fraud are hardly pursued – and in cases like this, mental health issues and possibly suicide wouldn’t be far-fetched.
Yet the Government clearly puts far more resources into penalising employers than catching real criminals. About 75 people nationally cover all fraud investigations (a much broader scope than ours). Compare that to 7,000 Workplace Health and Safety Inspectors (who “achieved” just over 300 convictions yet can’t prove they prevented a single injury), and close to 1,000 National Heavy Vehicle Regulator inspectors doing mostly paperwork checks and fines.
Granted, internet issues can span the globe. But I fail to understand how:
- Setting up a bank account or mobile phone takes lots of ID steps. Stolen money ends up in a real person’s account, and goods bought with fake details still reach someone – so how can they NOT find the criminals? Every bank account in our case (including the ones the money went to) is in Australia.
- Every computer has an IP address. Every email account requires ID. How can they not find these people?
As far as we can establish, nothing we did could have prevented this. We rely more and more on the internet and AI, yet that’s what is making us less safe. Our information was likely found on the dark web after recent data breaches (many at Australian Government agencies and large companies – the ones we’re supposed to trust). We also suspect theft of physical mail.
So how do we protect ourselves? A week later, we have no idea if we’ll get the funds back, but Bank A has told us how it happened. Someone called pretending to be my wife (sounded young – sorry my dear, doesn’t match your DOB). They were asked for her Date of Birth and address, then failed the password test twice, then to confirm a recent transaction – not even the amount (we think they just said the name of a Utilities provider everyone in this part of Qld uses). How hard would it be to find that out about you? Virtually any retail database, plus many other places.
In that same call, they changed the mobile number and email address. All they had to do then was log on from any computer and click “Forgot password”. The accounts the funds went to most likely belonged to foreign students in Australia paid to set them up. Isn’t our “4th largest export industry” Education sector absolutely fantastic for Australia? Minions or not, they should face charges to stop others doing it. All I can say to the bank is, we had better get our money back…
Still, we count ourselves lucky. We didn’t lose everything – we’d held only what we needed for cash flow and locked the rest into term deposits and other asset classes. We also use some cash, so could still put food on the table. We’ve added extra security to our banking (yet another inconvenience) and registered with credit reporting agencies so nobody can set up loans in our names.
One thing is certain: this won’t be the last time. We’re building a society where everything (infrastructure, communications, banks etc) can be destroyed through digital disruption, and AI will speed this up. Come to think of it, maybe our Government’s grand plan to keep us safe is the continued roll out of an unreliable energy grid? They fail to plan, so they plan to fail. And we wear the consequences.
(P.S. 2 weeks after the breach, bank A returned the funds to our accounts and gave us access back to our accounts. We understand that the person who took the call no longer has a job. But still don’t know what information they had and from where that got us into what is still a mess…)
Words from the wise
“The nine most terrifying words in the English language are: ‘I’m from the government, and I’m here to help.'” – Ronald Reagan
“It has been far safer to steal large sums with a pen (or computer) than small sums with a gun.” – Warren Buffett
“A banker is a fellow who lends his umbrella when the sun is shining and wants it back the minute it begins to rain.” – Samuel Clemens
As always, Onwards and Upwards!
Fred Carlsson
General Manager
