Banks are tracking your every click. It could save you thousands

When people open their banking app or log into their account to pay a bill, most will complete their task quickly so they can move on to something else.

But if a customer is being talked into transferring their cash to a scammer, there are subtle shifts in behaviour that leave a digital trail of clues. In these cases, banks say, the customer might spend longer than usual logged in, or they could move their mouse in a less purposeful way – such as by drawing circles on the screen – as they listen to the scammer’s instructions over the phone.

Banks can detect suspicious transactions from information such as how frequently a user is touching their screen.Credit: iStock

If the unsuspecting victim has allowed a scammer to take control of their computer, there can be other clues. The customer may not touch their phone’s screen as frequently as they usually do, or the criminal who has taken over might type faster than the customer usually does.

Banks can now see all these clues, and use that information to spot suspicious transactions.

“When I log in, and I know why I’m logging in, I behave with purpose,” says Tim Dalgleish, one of the architects of BioCatch Trust, a system that looks for data such as this to detect scams and fraud.

“In one of these scam scenarios, you’re basically being coached, coerced, tricked or bullied to do something different.”

Late this year, major banks signed up to the BioCatch system as part of the banking industry’s effort to stem a $2.7 billion wave of scams.

While it’s early days, it’s hoped these sorts of digital clues – alongside lots of other information – can be used to stop more scams in the milliseconds before a customer sends their cash, after which it can be much harder to retrieve the money.

The banking industry’s war on scams is a long-running fight in which businesses face fierce pressure to do more to prevent customer losses, but there are tentative signs of progress. It’s a battle in which speed is everything, and co-operation between banks, telcos, tech giants and authorities is vital.

‘Speed is everything’

Time is of the essence when fighting scammers. The rise of near-instant money transfers between bank accounts, which launched in Australia in 2018, means once someone is tricked into clicking “send” on a payment, there is very little time to put a halt on the transaction.

It is up to banks to sift through millions of transactions, detect the suspicious ones and raise a red flag, in near-real time. But how do you detect a payment to a scammer in mere milliseconds?

This is an area where banks have invested millions in systems that crunch reams of data and raise alerts or block payments from going through.

National Australia Bank’s executive for group investigations, Chris Sheehan, has high hopes that over time, the BioCatch system will make it very difficult for scammers to operate in Australia.

National Australia Bank’s executive for group investigations, Chris Sheehan.

More broadly, he says it is an example of collaboration that wouldn’t be possible in markets overseas – one due to Australian banks’ history of data-sharing to fight scams, as well as the fact our banking market is relatively small and concentrated.

“This type of industry-wide collaboration – it is a global first,” says Sheehan, a former Australian Federal Police senior officer. “And frankly, I don’t think anywhere else in the world can do it the way we’ve done it here.”

While banks’ anti-scam systems have historically focused on detecting and responding to scams, he says that won’t cut it any more. The BioCatch move is an example of where banks need to focus – on stopping scams before the money’s been transferred. “We need to be stopping the scam, stopping the crime, before it occurs,” he says.

More broadly, it’s also an example of the co-operation between banks that goes back to 2016, when the industry launched the Australian Financial Crimes Exchange (AFCX), a bank-backed group of which Sheehan is a director. The exchange allows member banks to quickly report fraud as well as share intelligence on scams with other businesses such as telcos or technology firms.

Sheehan says that when this intelligence loop is “fully mature”, it will allow a bank to pass on a scam URL or dodgy phone number to, say, Telstra or Google, and have the number or website taken down immediately.

Commonwealth Bank’s head of group fraud, James Roberts, says this scheme – known as “the loop” is another example of Australia leading the charge globally through fast sharing of information between telcos, banks, social media companies and regulators.

“Speed is everything. The faster we can take down a link or a dodgy advertisement … the less people will get scammed by it, so you’re reducing the blast radius,” says Roberts, who is also a director of the AFCX.

There will be extra refinements in the new year as banks face continuing pressure to curb scam losses. Australian Payments Plus (AP+), a payments organisation, will in 2025 launch an industry-wide name-checking system, which checks the name of accounts to which cash is being transferred. Some banks already offer this service. “The solution has been built. It’s in testing at the moment and will be going live across the banks throughout 2025,” says AP+ chief executive Lynn Kraus.

Losses still way too high

Of course, banks have been touting anti-scam technology for years, and it hasn’t stopped a wave of losses that hit $2.7 billion in 2023 – a 13 per cent fall on 2022 levels but a figure that is still far too high.

Will these new anti-scam measures make a more meaningful difference? Even banks don’t claim anti-scam technology can solve the problem on its own.

Assistant Treasurer Stephen Jones unveiled the government’s anti-scam laws in October.Credit: Dominic Lorrimer

There is widespread agreement on the need for closer work between banks and social media companies, and new laws unveiled by Assistant Treasurer Stephen Jones in October will require these businesses to report scams as soon as they are detected, with the threat of $50 million fines.

“Our scams crackdown will cut off the avenues scammers use to target Australians by setting a high bar for what businesses must do to prevent them,” Jones said.

Consumer advocates maintain there should also be more emphasis on requiring banks to compensate scam victims, an approach that has been adopted in the UK but resisted by the federal government.

Yet despite all the work still to be done, there are tentative signs of progress. CBA’s Roberts notes the banking giant reported a 50 per cent reduction in customer scam losses last financial year. Other banks have also reported declines.

NAB’s full-year results showed a 20 per cent fall in customer losses from scams, Westpac said scam losses were down 29 per cent, and ANZ reported a 46 per cent drop in customer scam losses.

Roberts says the reduction in scam losses seen in Australia is better than the situation in some peer countries, though he adds the problem remains significant.

“It does not mean the problem is solved – and it has tragic consequences for consumers, but at least there’s a trend directionally,” he says.

NAB’s Chris Sheehan also says the $2.7 billion in industry-wide scam losses in 2023 was “way too high”, and he stresses the battle against scanners must continue. But he, too, says there are some encouraging signs. Ultimately, he says, there is no silver bullet in the fight against scams and the bank expects to be constantly changing its defences as the scammers also evolve.

Scam-fighting is also a part of finance where banks put aside their commercial rivalry and frequently work together to share information against a common enemy.

Indeed, last year the competition watchdog gave the Australian Bankers’ Association and its members permission to talk together to develop industry standards for anti-scam measures.

Not only does information-sharing help to spot the scammers, there’s also no public benefit in a situation in which some banks have far better anti-scam systems than others, because you can be sure that the criminals will cotton on to any vulnerabilities.

“When it comes to fighting crime and preventing the impact of crime on our customers, we don’t compete on that,” Sheehan says. “We realise that we have to work together because otherwise we’ll just get picked off individually.”

The Market Recap newsletter is a wrap of the day’s trading. Get it each weekday afternoon.