NAB to lead way as government aims to fight fraud via hyperlinks in SMS messages

The Albanese government wants to extinguish all unprompted text messages to customers with embedded hyperlinks, a key way in which scammers lure unsuspecting customers.

NAB chief executive Ross McEwan, right, and Finance Minister Stephen Jones meet with the bank’s scams and fraud team at NAB’s Melbourne offices this week. Picture: Jesse Marlow

The Albanese government wants to extinguish all unprompted text messages to customers with embedded hyperlinks, a key way in which scammers lure unsuspecting customers.

Financial Services Minister Stephen Jones said the step would be important to ruin one of the key ways in which criminal networks impersonate legitimate organisations to mislead victims at scale.

“Desirably I’d like to see this all across the economy” including by the government, he said. “Embedded URLs in SMS messages are a key vector for distributing scams and frauds.

“It’s how at scale industrialised criminal networks send dangerous messages through the economy.”

National Australia Bank will be the first big bank to phase out the over 40 million texts with URL links it sends every year, from the end of July.

“We need all parts to move together in unison,” Mr Jones said, adding that banks, companies, government and individuals all had to lift their game, with Australians losing over $3bn a year to scams.

NAB chief executive Ross McEwan, left, and Finance Minister Stephen Jones. ‘We need all parts to move together in unison,’ Mr Jones says. Picture: Jesse Marlow

The efforts come a week after the government opened Australia’s new National Anti-Scams Centre, and while it works on a mandatory multi-industry best practice code for banks, telecommunications and social media platforms to set high standards and obligations about customers’ data security.

Once the code is in place, companies would avoid liability for reimbursing fraudulent payments if they meet those standards, in which the government will consult over the next two months.

It also follows efforts to implement an SMS sender ID register, similar to those that operate in the UK and Singapore, to block cyber criminals from sending texts appearing to be from legitimate organisations.

NAB chief executive Ross McEwan said the bank would have to invest in more people for its call centres to implement the change, which came about after a staff member pointed out the bank’s communication strategy was at odds with its practices.

“It’s hard to send the message of ‘don’t use a link’ if we’re sending them out,” Mr McEwan said.

“So it came to us, we have to lead the charge on this and we’ve stopped sending out the links so that we can send very clear simple messages: we will never send you a link.”

The bank makes 1 billion payments worth $3 trillion per year and says about 10,800 of those had been related to scams, a figure that had grown by about 30 per cent a year.

Links on messages that, for example, notify customers when an account is about to be overdrawn or a new debit card had been posted, will be replaced with directions to the bank’s website, to call the bank, or to go to the NAB app.

It is one of about 64 projects of work at the Melbourne-based lender to help address what it considers to be a global scam epidemic.

The Australian Banking Association said the industry is working on measures to disrupt and respond to scams, “including how banks can limit the use of links in SMS messages”.

The Commonwealth Bank late last year changed its marketing guidelines requiring links be excluded from all marketing texts.