Bank’s ‘dreadful’ move as $24k stolen

An Aussie man called his bank while scammers were still on the phone to him, draining his life savings. But what the bank did next left him appalled.

Brendan McKean was literally on the phone to his bank as an online scammer was draining his account of his life savings.

But even that wasn’t enough to stop the hacker stealing thousands of dollars more despite the bank putting a “lock” on the account.

It was a heart-wrenching time for the 72-year-old – losing Ann, his wife of 43 years just two week later – while also battling his bank to recoup the money.

In July 2023, Mr McKean received a message on his laptop from Microsoft to call them due to a virus.

He called using his mobile phone, with the person he was speaking with directing him to install a legitimate program called Anydesk.

Mr McKean had resolved previous issues with his laptop by allowing remote access so he didn’t think this was any different.

Megan McKean and her father in law Brendan who lost $24,000 in a scam. Picture: Supplied

The Queensland resident maintains he did not talk about banking with the person on the other end of the call – nor did he give out any passwords.

It was then he noticed messages on his mobile phone alerting him to transactions occurring in his account while still talking to the scammer. He immediately called Bendigo Bank on his landline.

Bendigo Bank manually locked the account at 3.29pm – but it was only to prevent further log-ins – and as a result an immediate transfer of $4900 left the account at 3.31pm.

A fraud block was only placed on the account at 3.39pm.

That’s why the McKeans are lending their support to news.com.au’s campaign People Before Profit, calling on the federal government to make it mandatory for banks to compensate scam victims – just like in the UK.

In October last year, the UK introduced world leading legislation making compensation mandatory for scam victims within five business days unless in cases of gross negligence.

IT’S TIME BANKS PUT PEOPLE BEFORE PROFIT. SIGN THE PETITION

Mr McKean lost $24,300 in total with the bank laying the blame entirely on him for the loss.

“They believed everything I told them apart from the fact that I didn’t give the scammers my password,” Mr McKean said.

“I never stored my password on the computer … I had the Commonwealth Bank and my superannuation on the computer and neither of those sites were hacked. No money was missing from them – there was no attempt to get into those accounts.”

The theft of the money has left Mr McKean devastated – and broke, having to borrow $5000 from his son Gareth and daughter-in-law Megan to pay for his wife’s funeral.

“$5000 was taken from his account after the bank had supposedly blocked it,” Ms McKean told news.com.au.

“However, he is apparently not entitled to that back as the scammers needed to log out of the account for the block to work. Why would they log out until they had drained the account?”

“Over $24,300 was transferred from his account by hackers, despite no passwords or sensitive information being shared directly.

“He did not log into his account whilst on the phone with the scammer.”

She said the scammer also increased the daily transfer limit from $6000 to $50,000 without any detection or red flags raised by the bank’s system and money was sent to accounts never used before.

Ms McKean claimed the family has encountered a “disturbing lack of accountability” from Bendigo Bank and the independent dispute resolution service the Australian Financial Complaints Authority (AFCA).

“Bendigo would not allow him access to his account until he had wiped his laptop and phone and provided evidence that it had been done,” she said.

“Which also meant he had no evidence that his password had never been saved to his devices – which they then used against him”.

She said there is a recording of her father-in-law’s initial phone call with Bendigo Bank while the scam was happening where he was adamant he hadn’t shared banking details.

“It broke my heart when I heard the last bit as it was obvious he had no idea how much money had been taken,” she said.

Megan and Gareth McKean. Picture: Supplied

She describes dealing with the bank as a “hellish process”.

“They did not stay in contact after the scam and Brendan was always having to chase them up,” she said.

“Eventually they recovered $20 and when they first put it back in the account they charged him $15. It was almost a second kick in the guts.”

When the matter was taken to AFCA, it ruled the “bank acted within a reasonable time frame (10 minutes) to lock the account completely” – and was not responsible for the $4900 transferred out of the account.

“Bendigo Bank missed deadlines with AFCA with no consequence while strictly enforcing those for us,” Ms McKean said.

“AFCA like the bank, never responded within the time frames given. Weeks and weeks would go by and the onus was always on my father-in-law or us to chase a response. Even the AFCA complaints department could not respond within their given time frame,” she said.

Ms McKean is also critical of the use of payment system OSKO, where transfers are immediate and irreversible.

“We believe this is a serious risk for all bank customers who are unaware of OSKO’s limitations,” she said.

“They should hold funds for a time if it is going to a new account to allow for recall should an issue arise”

“The general public need to understand – a lot of people think banks will look after them and they are secure but it’s not the case.

“Consumers really need to be made aware that if/when something goes wrong they will not help, they will not take any responsibility and they will blame their customers.”

When contacted for comment, a Bendigo Bank spokesperson said it protects the privacy of its customers and does not comment on specific matters.  

But the spokesman noted the bank will never ask for customer details, or request customers transfer money, download software or login via a link sent through email or SMS.

“It is important customers take steps to protect themselves and do not share their passwords or allow someone they don’t know or trust to log in to their computer remotely, as it is extremely difficult to recover money that has been transferred to scammers,” the spokesperson said, adding the bank stopped $34.4 million in fraudulent transactions in the 2023/24 financial year.

Gareth McKean and her father in law Brendan who lost $24,000 in a scam. Picture: Supplied

An AFCA spokesperson said it is “an independent and impartial ombudsman service” and claims that it “overwhelmingly rules in favour of banks” is a misapprehension and incorrect.

“We see every day the human cost of scams not only in financial terms but in the emotional and psychological impact. We take this work very seriously,” the spokesperson said.

“We are a strong supporter of proposed changes to enhance the law and introduce mandatory codes of practice.

“In the meantime, we believe banks, telcos and digital platforms shouldn’t wait. They should take all actions possible now to prevent, detect and disrupt scams, and to provide a fair response to customers harmed by scams,” the spokesperson said.

The AFCA spokesperson said more than 10,000 scam-related complaints were received in 2023-24, which was a record for that type of complaint.

[e-mail]