I like to think that I am fairly savvy when it comes to online scams. I know not to click on weird links or give out my personal information, and that people can call and impersonate my bank. I also work for an organisation that is extremely proactive when it comes to cybersecurity. And I’ve even worked for a bank, so if you’d asked me two weeks ago, I would have said that I know what to look for.
Yet last week I suddenly found myself the victim of a highly sophisticated cybercrime. I feel incredibly embarrassed and stupid – the sense of shame has been quite overwhelming – but I feel that the only way I can regain some sense of agency is to share what happened, in the hope it stops it from happening to others.
It started with an SMS from what I believed was my bank, saying that someone had tried to set up a payment to a new payee. The text message said that if this wasn’t me, I should call the number provided. It looked completely legitimate and, because it was from a number I had previously received verification messages from, I had no reason to doubt it. (I have subsequently learned that this is called “ID spoofing”.)
I called the number and the first thing I heard was a message saying it was the bank’s fraud line and that due to an increase in cybersecurity breaches, there may be some delay in answering my call. The recorded message and music sounded exactly like my bank’s.
I soon spoke to a person who sounded like a bank employee. He got me to look at my account to see if there had been any other suspicious transactions – there weren’t – and after some time spent doing checks and putting me on hold to speak with “technical experts” he determined that it looked like I had been infected by a virus.
This was incredibly alarming as it was our mortgage offset account, so my mind leapt to the fear of a significant amount of money being at risk. The man I spoke to said it would be fine because we had stopped it just in time. But because it was a significant breach, he explained, we would have to change my BSB and account number.
I was then assigned a “case manager” to make sure everything was in order with my accounts. I received a text – again, to the same number I’ve received verification codes – with her name and email address.
After more than half an hour of going through this process – which I now realise was part of the process of gaining my trust – he told me that to finalise everything I needed to transfer an amount of money to the account manager, and that the amount would be randomly generated.
At this point I balked and said that didn’t sound right, and he very kindly and empathetically explained that he understood, that it was just part of the process, and that it would soon be resolved, and all of the stress would be done with. The number that was “randomly generated” was around the $22,000 mark. I was extremely anxious about doing this, and said as much, but again, he reassured me. “How would we be able to message you through the same SMS number?” he said. “It’s basically impossible”. Once I made the transfer, he explained, the new account would be set up, and it would all be resolved. I’d receive a confirmation SMS and everything would be back to normal.
So I did it. And I thanked him for his help.
After no SMS arrived, I quickly became nervous and called the bank, where I found out it was a hoax. A very elaborate, very professional, very sophisticated hoax.
Within 30 minutes I had reported it to to the bank. They told me it would take six to eight weeks to investigate and that there was no guarantee that I’d get my money back.
I felt physically ill. I cannot remember a time in my life that I have ever felt more shame for being so gullible. When I play it back in my mind, I can clearly see points where I should have twigged what was going on, but everything – the messages, the advice, the friendly conversation – all made me blind to the signals and go against my gut.
It’s hard for me to write this and read it back, because I know that if I was reading it about someone else, part of me would think, What. A. Dummy.
I spent the following day in tears, berating myself for being so stupid, wishing I had done things differently. I told a few close friends but pleaded with them not to tell anyone because I was so ashamed and so embarrassed about what I’d done.
I still feel this, but what I have realised is that I am a victim of a crime, and that by saying nothing, I won’t be helping myself or anyone else.
I’ve reported the fraud to the bank but they have given me no assurance that my money will be refunded. The police have simply directed me to the bank; and filling in a scam watch report with the ACCC doesn’t seem to prompt any action either. All I can hope is that by sharing my story I can at least help others.
The author is a senior marketing professional based in Melbourne
