They cleaned out the accounts of victims by exploiting a chink in bank security which allowed them to set up a linked account with nothing more than a forged signature, The Saturday Telegraph can reveal.

While some bank branches simply accepted the forgeries, others were misled after the syndicate took over victims’ mobile phone numbers by “porting’ them to new SIM cards to bypass the banks’ dual verification systems.

Once the new accounts were established, students acting as ‘money mules’ drained them by making rapid-fire cash withdrawals, visiting multiple branches in a single day and even flying interstate.

The revelations of the security lapses are a further embarrassment for the big banks in the wake of the damaging financial services royal commission.

Police have so far arrested 24 people and laid 288 charges involving the theft of $2.5 million after Strike Force Wilmot was set up in 2013.

The majority of the mules were in Australia on student visas from South Korea, India, China, Indonesia and other Asian countries.

Some told police they had been told their bosses were Russian.

Two men whom prosecutors told the courts were the ringleaders, TAFE masters student Yi Zhong, 27, and Peruvian ­national Amiel Rondon, 30, were jailed in the District Court this year.

Police believe it began with random emails purporting to be from banks but containing malware which revealed personal details. Mules were recruited and either handed over their own bank account details or opened false accounts.

Thai national Krittiyaporn Lomin, 25, said her landlord told her another tenant, known as Michael, had asked if she wanted to make money, documents tendered to court revealed.

Another mule, TAFE student Daniel Jognho Lim, 22, said he was approached in a coffee shop near Central Station and ferried about the banks by a “fat” Korean called Jason.

Courts were told that the ringleaders completed written forms to link the accounts of the mules to those of their victims.

At the time, the CBA and Westpac did not require both account holders to attend the bank and a signature was accepted.

When banks called the victims’ mobiles to check, they were answered by other mules who had taken over the number. Victims have since been repaid by the banks.

NSW Police cybercrime chief Detective Superintendent Arthur Katsogiannis said his officers had done a “tremendous” job using technology and other investigative tools.

After the victims’ accounts were emptied, some by as much as $560,000, and the money transferred into mules’ accounts, the mules were driven around bank branches in Sydney by “handlers” or flown to cities including Brisbane and Adelaide to make large cash withdrawals.

They travelled on false documents.

The banks helped trap the crooks by either keeping them talking or asking them to come back while they raised the alarm.

“We have worked very closely with the financial institutions in order to identify those responsible,” Det Katsogiannis said.

Some of the mules had already dropped out of their study courses and others have had their visas cancelled.

Zhong, of Killara, who completed a TAFE Certificate and bachelor degree in commerce, had been studying for his master’s before he was sentenced to a minimum of 20 months and a maximum of three years in January.

He had pleaded guilty to four fraud offences. He has lodged an appeal against his sentence.

Peruvian national Rondon was jailed in February for a non-parole period of 18 months with a maximum term of three years.

The banks have repaid their victims in full and upgraded security systems. All banks now require both account holders are now required to attend the branch to open joint accounts.

He urged people not to open suspicious emails and change passwords regularly.

“We are all vulnerable to becoming victims,” he said.

He said the masterminds were overseas and may one day be caught.

“This is one of the problems of cybercrime. It is seamless and borderless,” he said.