A cautionary tale in online scams from their latest victim - Sasha Borissenko

A scam victim reimbursement scheme can’t come fast enough, Sasha Borissenko says. Photo / 123RF

OPINION

A kitchen renovation meant a monstrously sized toaster took up much of my bench space for almost two years. It was a compromise. Finally, with my 52sq m apartment co-owner and friend leaving for Amsterdam, the time had come to rid myself of the toaster and enter the world of Facebook Marketplace.

Jenny was keen to purchase it, on the condition I send it to Bluff. There was Jeff, who would be keen in a month. Mary from Lower Hutt was keen, and while I could deliver it easily, she offered to organise a courier. I didn’t have to do anything other than plug in my details to receive payment. No drama, I thought, as hours earlier, I’d entered my PIN to receive payment from a clothing consignment store.

I received what looked like an official email from NZ Post, which would take me to a POLi-banking portal with a copycat version of Kiwibank online banking. I entered my access code and password, answered the prescribed questions, and it was as easy as that. Forty-eight hours passed, and no courier arrived, but Mary assured me they were coming. The toaster was ready for its journey in its newly sourced box, cushioning, and a thank you note.

A case for keeping cash in a mattress

Come Tuesday at 5.27pm, I missed a call from the bank saying they’d flagged suspicious activity. And just like that, my credit card, GST, provisional tax reserves, mortgage repayment, and savings had been wiped to the value of $12,500. I’d born the brunt of a phishing scam.

Sure, it could be worse, yet the panic, shame, and ringing in my ears were full-on. My friends said it was common. Kiwibank said it was common. Yet, like those who lost $198m to scams in 2023, I missed the memo.

Even if it was common knowledge, how could the fraudsters withdraw thousands in nine minutes? Swift banking transactions may be fantastic when you’re holding out for pay-day on the one hand, but it meant retrieving the cash in full was unlikely, Kiwibank said.

A spokesperson said Kiwibank took the security and protection of its customers very seriously and they were investing heavily to combat fraud and scams. A dedicated fraud team worked 24 hours a day, 365 days a year to protect its customers, they said.

No legal protections for consumers

With a shortfall of $9500, I geared myself to join the 146 scam-related cases before the Banking Ombudsman this year, up 400 per cent since 2015, according to Banking Ombudsman Nicola Sladden.

In theory, the Banking Ombudsman guidelines say banks have obligations to customers who unwittingly send funds to fraudsters if the bank has failed to provide services with reasonable care and skill, or failed to keep the way a customer banks secure.

But the New Zealand Banking Association’s (NZBA) Code of Banking Practice doesn’t require banks to reimburse customers if the customer is deemed to have been negligent, failed to comply with the bank’s terms and conditions, or didn’t take reasonable steps to protect their banking.

Did I plug in my details? Why hadn’t I noticed the scammer was, well a scammer, given the Facebook profile was in Russian (an unfortunate assumption on Kiwibank’s part, given my last name)? In other words, was I wearing lipstick, a short skirt, and walking alone after dark?

In the bank’s defence, why should they cover costs of a fraud they had no part in, especially seeing as Kiwibank is not insured to cover such loss?

Forty-odd calls and emails later (including a seven-page brief), two days worth of clown-crying, and a vow never to listen to Lorde ever again (I hope the musician receives significant royalties for the pain induced by being on hold), Kiwibank incredibly reimbursed me for the shortfall.

In my case, banks can offer a goodwill payment.

Sladden said that banks offer goodwill payments at their discretion “when the bank does not consider it is obliged to reimburse the fraud victim for their losses”.

The Kiwibank spokesperson said it deals with scams and fraud on a case-by-case basis, subject to the nature of the scam, the activities surrounding the scam, and the circumstances of each customer. They didn’t respond to my request for their goodwill policy.

But what about those who aren’t so lucky?

In April, new regulations in the UK will require banks to reimburse scammed customers despite their involvement. The UK has also established anti-scam centres (together with Singapore and Australia) that do everything from promoting prevention and recovering lost funds to prosecuting scammers.

Unlike New Zealand, the Australian Securities and Investment Commission has the power to take down scam websites and remove, or limit access to, malicious or fraudulent websites. According to Sladden, the Australian Commission has taken down more than 3500 websites since July and prevented innumerable investment scams in the process.

Following recommendations made by the finance and expenditure committee last year, commerce minister Andrew Bayly urged the banking industry in February to take immediate and concerted action to better safeguard customers.

Banks have been tasked with investigating a voluntary reimbursement scheme for scam victims and for the NZBA to progress “confirmation of payee” technology and update its Code of Banking Practice.

Should the scheme be mandatory and be completed before the September deadline? Given the lack of a robust legal framework and my toaster saga from hell, I’m inclined to say yes.