Wanna buy a bridge? Too late, scammers have moved on…

The call centre has processes, the latest technology and maybe even a clear desk policy. Sound normal enough?

" Scammers are known to be patient and monitor an individual or business’s activity to determine the best time to strike.”While this could be any call centre, it isn’t. It’s the emerging face of scams.

As banks have continued to invest in hardening their defences, so too have fraudsters changed their focus to target businesses and individuals directly, recognising it is easier to extract money directly rather than trying to bypass banking controls. Similar to how a petty criminal will break into the house with unlocked windows or no dog or CCTV.

Scam call centres are unfortunately real and whilst they are not trying to sell you the Brooklyn Bridge, their schemes range in complexity and take measures to ensure they are believable.

Adaptable and changing

According to the latest ACCC Annual Scam report, in 2018, almost half a billion dollars ($A489 million) were lost in over 378,000 scams reported to the ACCC, the Australian Cybercrime Online Reporting Network (ACORN) and other state and territory government agencies.

“These losses represent an increase of 44 per cent over the $A340 million reported in 2017 and demonstrate that the impact of scams on the Australian public is worsening,” the report said.

Scammers target everyone, are sophisticated and well-funded. The scammers have predefined scripts and approaches to convincingly trick people and businesses into parting with their money.

They are highly adaptable and regularly change their approach to optimise their success.

Scammers are also known to be patient and monitor an individual or business’s activity to determine the best time to strike, gathering personal information, monitoring emails, payment patterns, expected future large expenditure; watching social media activity to identity times you will be overseas or travelling making it harder to stop and report transactions.

This emphasises it should go without saying people should be vigilant of calls, emails and texts they are not expecting and should never release personal information, account details, passwords or provide remote access to computers or smartphones to anyone.

Businesses meanwhile need to ensure they have appropriate controls in place to detect changes in payment details and ensure segregation of duties cannot by bypassed. A common scam occurs when a business is tricked into paying into the wrong account - often after an official looking email notifying a change of payee account details.

No one is immune

Around one-third of the loss experienced by ANZ customers relates to businesses. Typically, the volumes for business are lower but the value of the losses higher - the average loss experienced by ANZ’s business customers was 10-20 times greater than individual scam victims.

Business email compromise (BEC) events can impact all businesses - from retail customers all the way through to the institutional customer base - meaning no one is immune.

The importance of appropriate business controls can’t be underestimated. In the majority of cases, the controls in place at the organisation are not sufficient to detect the scam or are easily circumvented to enable to scam to occur.

{CF_IMAGE}

Tip of the iceberg

The losses reported to banks, the ACCC and other regulators are likely to be the tip of the iceberg given there is personal embarrassment and a perceived stigma associated with falling victim to a scam. Organisations may perceive that publicity they are a victim of a scam loss will imply financial weakness and may have reputational damage.

Confusing next steps

Once an individual or business has fallen victim to a scam, there are unfortunately a confusing array of organisations the victim should contact to report the incident and request assistance:

• their bank to attempt to recover the money;
• the local police station;
• ACORN - the preferred law enforcement cybercrime reporting portal;
• the ACCC’s Scamwatch - a government body which collects statistics and raises awareness of scams; and
• IDCARE - a not-for-profit organisation helping individuals who are victims of identity fraud and scams.

The sheer number of organisations to contact often makes the process of being a scam victim even more confusing, stressful and time consuming. Individuals often feel unsupported and unsure of where to turn. The development of support structures for individuals is continuing to develop with the support of organisations such as the ACCC & IDCARE.

Daily challenges

Just because the focus of scams is shifting from banks to individuals and businesses, the industry is not washing its hands. ANZ and other banks have established Scam Assist operations teams to proactively and reactively respond to customers who experience loss or are at risk of a scam loss.

These teams face the daily challenge of proactively engaging with customers to advise they may be subject to a scam. It’s rarely welcome news.

Customers will exhibit a wide range of responses including denial, anger and complete despair. In a lot of these matters, the customers are in distress, particularly when they eventually find out they have been scammed. This can often be the result of the realisation of a significant financial loss or embarrassment and shame that they have been deceived.

The second challenge is that the banks and other organisations have sought to raise awareness of scams through education and notifications however, notwithstanding the increasing awareness, the incidents and losses continue to rise at an alarming rate.

Interrupting operations

The prevalence of both complicit and oblivious money mules, who move the proceeds of scams quickly around Australia and ultimately out of the country, and are typically only used for a short period of time, make it challenging for law enforcement and regulators to crack down and break the organised syndicates. This is evident by the unfortunately low numbers of convictions for money mule activity.

International scam networks are often complicated and well connected. It is not unusual to see recipients of scam related funds actually be victims of a scam themselves. These recipients - more often than not romance scam victims - are being directed to receive and move funds by another online actor.

This continues to allow the scammers to layer funds, decreasing the possibility of recovery, detection and subsequent law enforcement intervention. Given that these deceptions are carried out across state and International boarders, it presents further challenges in coordinating law enforcement efforts.

If you think you, a family member or friend has been scammed, report it immediately to the ACCC via the ScamWatch website. If you think you have provided your account details to a scammer, contact your bank or financial institution immediately.

Warren Brown is Manager of Financial Crime Oversight and Dylan Ryan is Fraud Risk Lead at ANZ