Banks told to up fight against fraud as Aussie abroad fleeced $44k in mobile phone theft

When a Melbourne financier’s phone was stolen out of his hand in London it led to him losing $44k and being told he was to blame as he chased his bank for answers — and a refund.

When Karl Smith’s mobile phone was stolen out of his hand in London while the Australian was tracking his Uber ride on his phone, it led to a series of bank transactions that he never thought possible.

Because the device was locked and password-protected, Mr Smith, who works in finance, did not expect the thieves would be able to transfer money internationally with relative ease.

However, the thief managed to access his banking apps and transfer $44,000 from his HSBC account to a British account.

“The next thing I know they tried to access several accounts because I bank with multiple institutions and couldn’t access my UK account because it has a greater security system. They were able to access HSBC and send $44,000 overseas,” he said.

Mr Smith, from Melbourne, phoned HSBC and reported the theft to the police. He said his bank investigated but found him liable for “disclosing his pin” and prevented him from accessing his money for nine months.

“Everyone accepts it was an unauthorised transaction and my account was locked for an extended period, but there was almost zero compensation avail­able,” he said. “HSBC denied anything is their fault or that they have a poor security system that did not stop an offshore transfer.”

Mr Smith is just another victim of the growing problem of mobile phone fraud, and banks need to do more to address the threat, according to Consumer Action Law Centre chief executive Stephanie Tonkin.

“If you drop your credit card, it is pretty careless, but if someone picks it up and uses it, it falls within the payment code and you’re reimbursed because you did not authorise it. Having your phone stolen would be even less culpable,” she said.

Consumer groups are urging Labor to follow the example of Britain and force banks to compensate customers that are scammed or the victims of financial fraud, as criminals become increasingly sophisticated.

Experts say criminals are getting smarter at targeting victims, with many exploiting human behaviour and developing elaborate schemes that are hard to detect.

The Australian Securities & Investments Commission found the number of Australians reporting scams increased by 18.5 per cent in 2023 to 601,000, with losses totalling $2.74bn, which was down 13 per cent.

HSBC told Mr Smith he was liable for his loss because he “disclosed his password”. Picture: Jeremy Piper

Ms Tonkin said banks have the power and resources to do more to prevent Australians being targeted by criminals who were innovative, sophisticated and well resourced.

“Scammers are coming to Australia because we’ve got a weak system. They’re successful, so more keep coming and stealing billions from consumers who are left footing the bill,” she said.

“The frontline of defence in this country is the banks. They can identify patterns of behaviour, they have the information about which accounts are scam accounts, and they set up ­accounts.”

Britain passed laws last year that make banks liable to reimburse customers within five days if they are victims of scams, split 50/50 between the sending and receiving bank. The Albanese government plans to introduce mandatory industry codes that will require banks, social media giants and telcos to have measures to prevent, detect, disrupt, respond to and report scams.

Australian Banking Association CEO Anna Bligh said banks had world-leading anti-scam protections, but focusing liability on the sector risked undermining an entire-scam-chain approach.

HSBC told The Australian that it was doing everything to protect customers and would work with the ABA to implement initiatives outlined in the Scam Safe Accord.

“We understand being a victim of a scam is a stressful and distressing situation. Protecting our customers from criminals is critical and we continue to significantly invest in our fraud and scam prevention, detection and response,” HSBC said.

Consumer Action Law Centre chief executive Stephanie Tonkin.

The Albanese government plans to introduce mandatory industry codes which will require banks, social media giants and telcos to have measures to prevent, detect, disrupt, respond and report scams.

“The government says reimbursements aren’t right because Australians will be careless, but that’s a red herring,” Ms Tonkin said.

“The government’s plan won’t happen until the end of 2025, but there is no reason to rebuild something when it exists in the UK and we have people in the meantime losing housing deposits and their life savings.”

Banks are progressively rolling out the Scam-Safe Accord, which includes added protections such as more warnings and delays when paying someone new or increasing payment limits, as well as biometric checks when opening a new account.

Australian Banking Association CEO Anna Bligh said banks had world-leading anti-scam protections, but focusing liability on the sector risks undermining an entire scams chain approach.

“Our industry strongly supports a framework that clearly sets out obligations for banks, telcos and social media platforms. It must also provide clarity and certainty about proportionate liability across the entire scams chain, where obligations have not been met,” she said.

“Winning the war against scammers can only be achieved through a collective effort across the economy, including from the government, banks, telecommunications companies and social media platforms.”

Australian Banking Association chief executive Anna Bligh.

HSBC told The Weekend Australian it was doing everything to protect customers and would work with the ABA to implement initiatives outlined in the Scam Safe Accord.

“We understand being a victim of a scam is a stressful and distressing situation. Protecting our customers from criminals is critical and we continue to significantly invest in our fraud and scam prevention, detection and response,” HSBC said.

Former JPMorgan banker-turned-University of Adelaide adjunct senior lecturer Daniel Rossetto said banks need to replace text message two-factor authentication with biometric measures, as well as more checks on offshore or large transfers.

“An authenticator requiring fingerprints can stop criminals because they can’t replicate your fingerprints. This has advantages in an environment where our whole lives are contained in our mobile phones,” he said.

Dr Rossetto said criminals have become better at cracking human behaviour and Australians need to ensure they are in private locations where personal information might be visible on the screen, similar to how public Wi-Fi should not be used for banking, or covering your pin at an ATM.