CBA scammer’s trick: Hacker impersonates Tasmanian man to steal $40k in savings

A Tasmanian man, who was caught up in the Medibank hack, has been left in an “extreme” amount of stress after his entire savings was stolen in a matter of minutes.

A Tasmanian man nearly crashed his car when he received a notification from his bank that his transfer limit had been increased to $50,000 – something that left him “shocked” as he had not requested it.

But the horror continued for Syed Rizvi, as he pulled his car off the highway on December 22 last year and logged into his Commonwealth Bank account, he discovered that $30,000 had been transferred out.

The electrical engineer “panicked” and instantly called the bank but while he was on hold he saw a further $9860 emptied from his account – his entire savings accumulated over four years lost in the matter of minutes.

The man lost his entire life savings after someone rang the Commonwealth Bank and impersonated him. Picture: Supplied

The Tasmanian man saw almost $10,000 disappear from his account while he was logged in. Picture: Supplied

The almost $40,000 had been transferred into a CoinSpot account – but two factor authentication did not kick in as he had already made a previous transfer to the cryptocurrency exchange.

The 26-year-old said he then drove straight to the police station to the report the crime before finally speaking to a CBA customer service representative an hour and a half later when his account was frozen.

“I was left with no money and just before Christmas. I didn’t even have money to put petrol in the car,” he told news.com.au.

“I planned to go on a holiday during the new year but I couldn’t go as I was left with no money. I had to get a loan from a friend to put petrol in the car and buy some groceries.

“It’s been very hard for me, those days were so stressful for me. I called my mum and she even went to the hospital as she was so depressed as she said you lost all your savings.

“I couldn’t pay my rent as well. Now I don’t know … if I will get my money bank.”

Have a similar story? Continue the conversation | [e-mail]

He was told shocking news by the bank’s fraud team. Picture: David Crosling/NCA NewsWire

Shockingly, Mr Rizvi was told by the CBA’s fraud team that someone had called and impersonated him, supplying personal details and increasing his transfer limit from $1000 to a whopping $50,000.

“I was very angry when I found this out. I was very surprised – the bank should have some sort of software to distinguish the voice. They ask only three questions your full name, date of birth and residential address so any person can know these things,” he said.

“I was very shocked that the bank doesn’t have any technology to distinguish who is calling them. My number is registered with Commonwealth Bank, they should have realised this is very strange that a person is calling from a different number and pretending to be me.”

He was also told the payment could not be stopped, leaving him in an “extreme” amount of stress and feeling mentally “tortured”.

His transfer limit was increased to $50,000 with just one phone call. Picture: Supplied

But he had no idea how the scammer had gotten his details and “wiped out” his savings.

He ran antivirus software on his phone but found nothing.

However, dark web monitoring revealed his details had been leaked as part of the Medibank hacking scandal, including his passport, date of birth and email details.

“I informed the bank within 10 minutes of the incident happening. I went to the police station straight away. I should get the money back – it was not my fault. I couldn’t do anything else,” he said.

“I can’t even imagine that I don’t get my money back. I have done nothing wrong, I saved up money working two jobs. My whole family will suffer because they depend on me – I am sending money back home.”

He had also planned to use the money to launch his dream of running a food truck business and is now worried it will never happen.

He was caught up in the Medibank hacking scandal. Picture: Christian Gilles/NCA NewsWire

Mr Rizvi added the CoinSpot fraud management team had told him money had been deposited from four other accounts into the same wallet on the day his savings were stolen – suggesting multiple other people were scammed.

A CoinSpot spokesman said they were aware of a potential matter related to an act of bank fraud.

“We will continue to work closely with the relevant authorities in respect to any ongoing investigation,” he said.

“CoinSpot does not provide specific details relating to individual accounts on our platform.”

He suggested the CoinSpot account could have money stolen from multiple people. Picture: Supplied

While Mr Rizvi was initially told by CBA that the fraud investigation would take as long as 45 to 90 days, news.com.au understands that he will now be refunded the money by the bank.

A CBA spokesperson said the security of its customers’ remains a top priority.

“We invest in state-of-the-art fraud prevention and detection technology and have a dedicated team who actively monitor unusual or suspicious activity,” they said.

“Another way we try to keep ahead of the curve is working closely with other banks to share information and understand potential threats.

“We are always very concerned when we are made of aware of frauds and scams affecting customers and the wider community. Despite the commitment and best efforts of regulators, law enforcement agencies and the banking industry, such frauds and scams sadly still occur.”

CBA said scams were becoming increasingly common. Picture: David Geraghty/NCA NewsWire

The CBA spokesperson said they review frauds and scams on a case-by-case basis.

“However it is widely recognised that scams are becoming increasingly sophisticated which has prompted increased investment across the sector in resources, systems, data and intelligence to combat scams and alert the Australian public to the risks the community faces,” they said.

The spokesperson added where there is fraudulent activity, CBA’s process is to fully reimburse customers as quickly as possible to minimise inconvenience.

Originally published as CBA scammer’s trick: Hacker impersonates Tasmanian man to steal $40k in savings