Over 70 factors which have contributed to the success of Bank Transfer scams since 2019
Examined by LCC alone, over 150 cases involving more than $5,000,000 of funds stolen by scammers
Which is, in itself, a tiny portion of the more than $10 Billion dollars stolen from Australians by scammers over the same period
Greg's Take
- The riskiest payment a customer ever makes online is the first one to someone new, and that's exactly when most banks apply the least friction
- If one major bank can hold every first payment to a new payee for 24 hours, every bank can
Preamble
The single most dangerous digital payment a customer ever makes is the first one to someone new.
A short, automatic hold could stop most scams before the money leaves the bank, and at least one bank already proves it can be done at scale.
Contributing Factor
First Payment to a New Payee
Every internet bank trasnfer scam that results with stolen money paid to a scammer completes the same way: a payment to an account the customer has never paid before. That single fact, first payment, new payee, is the sharpest, simplest signal a bank has that something might be wrong.
It is available on every transaction, requires no special technology, and costs nothing to check.
At least one major Australian bank already places every first payment to a new payee on a hold, typically for a matter of hours, before it clears. Other banks apply a much shorter hold, or none at all, on the same category of payment. This is not a hypothetical ask. It is already happening, at scale, inside the Australian banking system, today.
A short hold does not stop a genuine payment from clearing. It does mean a customer who has been rushed into a scam has a small window in which the pressure can break, a family member can ask a question, or the customer's own doubt can catch up with the urgency a scammer has manufactured. Scammers rely on speed. A hold takes speed away from them without meaningfully inconveniencing anyone else.
Bank practice on this varies, and it changes, so treat the following as a snapshot rather than a permanent record. As at July 2026:
CommBank: applies a strong hold on first payments to a new payee as standard practice.
Westpac: applies a hold in some circumstances, narrower than CommBank's approach.
Bendigo: does not appear to apply a hold on first payments to a new payee.
NAB, ANZ, Macquarie and others: not confirmed at the time of writing.
A note on why this list will always say "not confirmed" for some banks: financial institutions have limited reason to publicly detail their own fraud controls, since doing so can help the very scammers those controls are meant to stop learn how to work around them. That is a genuine and reasonable tension, and this page will be updated as confirmed information becomes available, rather than guessed at.
This isn't about individual conduct, there's no staff member in a digital transaction to blame. It's a systemic control gap: where a bank has simply not applied a safeguard that's already proven to work, at scale, at another bank, that's a policy choice, not an oversight, and every first payment that clears without it is a chance handed to a scammer that a better-configured system would have closed off.
What This Means If You've Had Funds Stolen via Bank Transfer
If your first bank transfer to the new payee offered by the scammer cleared instantly with no hold at all, ask your bank directly whether it applies any hold to that category of payment, and if not, why not?
At least one major bank does this already. That is direct evidence the control is achievable, not a theoretical ask.
Feedback and Right of Reply
Questions or comments?
This page reflects patterns observed in real complaint handling. If you have questions or comments, or your own experience to add, we would like to hear from you.
Right of reply.
Where a bank or organisation named or clearly identifiable on this page believes anything stated here is inaccurate or unfair, we invite that bank or organisation to contact us directly. Any correction that is factually substantiated will be published alongside the original material, so the public record reflects both sides.
This is not a request for legal argument, it is an open invitation to correct the record.
Authorised by Greg Williams, Lincoln Computer Centre, contact details below
Greg's Take
Asking a scam target "do you recognise this as a scam" doesn't work, because recognising it is exactly what they can't do while they're under someone's control
There's a better question, and it doesn't ask the customer to diagnose anything.
Is Someone Else Telling You What to Say?
A "no" to that question proves nothing. A genuinely safe customer says no.
A customer being actively coached also says no, because they've been told to.
The question only becomes useful once you stop treating "no" as an answer that clears anything
Preamble
Most bank scam-check questions ask a customer to recognise they're being scammed.
That's the one thing a customer under active control usually can't do.
There's a better question, and it's rarely asked.
Contributing Factor
Is Someone Else Telling You What to Say?
Scam scripts routinely prepare a target for exactly the questions a bank is likely to ask. Scammers often tell their targets what to say if a teller or an app prompt raises concerns, and are often told the bank is being unhelpful, doesn't understand, or is simply an obstacle to get past. By the time someone reaches the counter or the confirmation screen, they have frequently already been coached past the obvious questions, has anyone contacted you about this, is this for cryptocurrency, because the scammer anticipated those exact questions and prepared a dismissive answer in advance.
That's the core problem with generic scam-awareness questions. They ask the customer to recognise they're in a scam. A person being actively coached and controlled typically cannot do that, not because they're careless, but because recognising it is the very thing the control is designed to prevent.
There's a different, more useful question, one that doesn't ask anyone to self-diagnose anything: are you making this payment at someone else's request?
This works because it asks about a plain fact, not a judgement call. And here's the part that matters most: a "no" answer to this question proves nothing either way. A genuinely safe, uncoerced customer will say no, because it's true. A customer being actively directed by a scammer will also say no, because they've been told to say exactly that. The answer "no" fits both situations equally well, which means it can never, on its own, be treated as clearance to proceed.
An honest "yes" is completely different, and far more serious. Very few genuine transactions require someone else to be actively directing a customer's own payment in real time. A "yes" here is a direct disclosure of exactly the situation this question is designed to catch, and should stop the transaction immediately for a proper conversation, not simply prompt a warning.
It's worth knowing about a related control too, since it's often mistaken for something stronger than it is. Most banks now show some kind of warning if the name you've entered for a new payee doesn't quite match their records. This is a genuinely useful check against an honest mistake, a typo, a wrong account number. But it does very little against someone being actively coached in real time, because a target being directed by a scammer will simply be told to click through that warning too, the same as any other prompt. It's also worth knowing that in most cases, this check isn't comparing the name you've entered against the actual account holder's real identity. It's usually just comparing it against what other customers of your own bank have previously paid to that same account, which a freshly opened scam account can pass without any difficulty at all.
And a payee name-check will not work at all if the scammer is operating your bank account via remote access without your knowledge.
What This Means If You've Had Funds Stolen
If your bank asked whether you recognised the transaction as a scam, and you said no, that is not evidence you were properly protected, it's evidence you were asked a question a controlled target usually can't answer honestly.
If your bank never asked whether someone else was directing the payment, that's a real gap worth naming directly in your complaint.
If you were shown a payee name mismatch warning and clicked through it, that does not mean the check worked as intended, only that it wasn't strong enough to interrupt what was happening.
You can use this question yourself, right now, before making any payment that feels rushed or pressured: am I being told what to say or do here by someone else? If the honest answer is yes, stop and get a second opinion from someone not involved in the call.
Feedback and Right of Reply
Questions or comments?
This page reflects patterns observed in real complaint handling. If you have questions or comments, or your own experience to add, we would like to hear from you.
Right of reply.
Where a bank or organisation named or clearly identifiable on this page believes anything stated here is inaccurate or unfair, we invite that bank or organisation to contact us directly. Any correction that is factually substantiated will be published alongside the original material, so the public record reflects both sides.
This is not a request for legal argument, it is an open invitation to correct the record.
Authorised by Greg Williams, Lincoln Computer Centre, contact details below
Greg's Take
There are two events in every scam, and almost everyone only looks at the first one
Event 1 is the deception. The customer was tricked. That is not in dispute, and it is not where the answer lies
Event 2 is the bank moving the money. That is the event nobody asks about, and it is the one that matters
"But how is that the bank's fault?" is the wrong question. The right question is: what did the bank do when the money moved?
Preamble
When someone hears that a person had money stolen by a scammer, the first reaction is almost always the same: how did they fall for it, and how is that the bank's fault? This page is about why that question, however natural, points in the wrong direction, and what happens when you separate the one event everyone stares at from the one event everyone ignores.
How Is That the Bank's Fault?
Tell someone that a customer had forty thousand dollars stolen by a scammer, and watch the first reaction. It is nearly always some version of the same thing:
How did they fall for that?
How is that the bank's fault?
The customer handed over the code.
The customer let someone onto their computer.
The customer made the payment.
Where is the bank in any of that?
It is a fair reaction. But nobody else was there in the moment.
It is also the exact point at which most people stop thinking, and it is the reason so many people who have had funds stolen are quietly told, in effect, that they brought it on themselves. That reaction is normal because it treats a scam as one event. It is not. It is two events
Event 1 is the deception.
A criminal manipulates a person into doing something, disclosing a code, allowing remote access to a computer, believing a lie about who they are speaking to. This is real, it is where the wrong is done, and it should be said plainly: the customer was deceived. There is no point pretending otherwise, and nothing on this page depends on pretending otherwise. Event 1 belongs to the scammer. The customer's part in it is the part a skilled criminal crafted.
Event 2 is the movement of the money.
After the deception, the stolen funds have to actually leave the account and travel through the banking system to the scammer. That is not done by the customer and it is not done by the scammer. It is done by the bank, through its own payment systems, under its own controls, subject to its own monitoring. Event 2 is the bank's event.
Almost every conversation about scams stops at Event 1. How did they fall for it. How could they be so careless. And once the conversation is stuck on Event 1, the answer is always the same, because Event 1 really was the customer's moment of deception. Ask only about Event 1 and you will always arrive at "the customer's fault", every time, because that is the only place that question can lead.
The questions that actually matter are all about Event 2, and they are never asked.
When the money moved, what did the bank's systems see?
Was the payment unusual for this customer?
Did it trip any alert?
If it did, what did the bank do?
If it did not, why not?
Did the money go somewhere the bank had been warned about before?
Being deceived at Event 1 tells you nothing about how the bank handled Event 2.
They are separate events, examined separately. One belongs to the scammer. The other belongs to the bank.
Think about how we treat security everywhere else. At an airport, passengers are told not to carry prohibited items, and most people try to comply. Nobody imagines that a warning sign at the entrance is the whole of airport security. There is a screening layer, run by the airport, precisely because human beings make mistakes, get distracted, get fooled, and because the consequences of a single failure are serious enough to justify a second line that does not depend on every individual getting it right every time. The screening layer exists because relying on people to be perfect is not a security system. It is the absence of one.
Banking has the same shape. The customer is the first line, and the customer can be deceived, because customers are human. The bank's payment monitoring is the screening layer, the line that is supposed to catch what gets through, precisely because the first line is fallible. When a bank's entire answer to a scam is "the customer authorised it, the customer was careless, the customer disclosed the code", it is pointing at the failure of the first line as though the second line was never its job.
It is holding up the warning sign and saying nothing about the screening.
A great deal of scam prevention advice is built on the assumption that the customer will not be fooled. Do not disclose your code. Do not allow remote access. Do not trust callers claiming to be from your bank. This is fine advice, but it is advice to a species that does not exist, one that never gets tired, never gets frightened, never trusts the wrong voice at the wrong moment. Real people get fooled. That is not a reason to abandon them at Event 2. It is the whole reason Event 2 protections have to exist.
This is not a fringe view of how these matters should be assessed. In a published decision, AFCA case 12-24-153284, the adjudicator said it was unclear why the bank processed a $40,000 transaction while a fraud detection alert was still unresolved, and why it then waited about two hours before acting to block the customer's online banking. As it happened, the customer was already protected, because the bank could not show the customer had breached the security requirements, so the Code placed the loss on the bank. That meant the adjudicator did not have to decide the fraud alert questions. But the questions were the right ones, and they are the questions this page is about: when the money moved, what did the bank do, and why did it let it through?
So when the reaction comes, and it always comes, that "but how is that the bank's fault", the answer is not to argue that the customer was clever, or blameless, or careful. The customer was deceived, and that is Event 1, and it is conceded. The answer is to ask the question nobody asked: when the money moved, what did the bank do?
What This Means If You've Had Funds Stolen
Separate the two events in your own matter.
Event 1 is how you were deceived.
Event 2 is how the bank moved the money.
They are different events and they are judged differently.
You do not have to prove you were not deceived. You were, and that is not the question. Concede it plainly and move the focus to Event 2.
The questions that carry weight are about the bank's conduct when the money moved: what its systems saw, whether the payment was unusual, whether it tripped an alert, and what the bank did about it.
If a bank's whole response is that you authorised the payment, disclosed a code, or were careless, notice that every one of those points is about Event 1.
None of them answers what the bank did at Event 2.
Being deceived is not the same as being at fault for what the bank's systems did or failed to do afterwards.
Those are two events, and you are entitled to have the second one examined.
Feedback and Right of Reply
Questions or comments?
This page reflects patterns observed in real complaint handling. If you have questions or comments, or your own experience to add, we would like to hear from you.
Right of reply.
Where a bank or organisation named or clearly identifiable on this page believes anything stated here is inaccurate or unfair, we invite that bank or organisation to contact us directly. Any correction that is factually substantiated will be published alongside the original material, so the public record reflects both sides.
This is not a request for legal argument, it is an open invitation to correct the record.
Authorised by Greg Williams, Lincoln Computer Centre, contact details below
Greg's Take
"Insight" means an accurate, deep understanding of what's really going on beneath the surface.
Eight editions in, and this report series still hasn't surfaced the one pattern that's been sitting in plain sight the whole time
AFCA's Systemic Issue Insights Reports are the closest thing banking has to ATSB reports, and even that limited function appears to have missed one of the most obvious, most repeated control gaps there is
New payee delay protection isn't a subtle failure. It's been sitting in front of AFCA in complaint after complaint, for years, at record scam volumes
We searched four different ways to describe the same control. None of them appear, not once, across eight editions
Preamble
We searched every published edition of AFCA's Systemic Issue Insights Reports for any mention of a control that could stop most scams before the money leaves the bank, a delay on the first payment to a new payee. We searched four different ways the same control might be described. Not once, in eight editions, does it appear.
Contributing Factor
Asleep at the Control Yoke
AFCA's Systemic Issue Insights Reports exist for a specific purpose: to look across thousands of individual complaints and identify patterns that point to a wider, industry-level problem, one no single complaint could reveal on its own. It is, in effect, the nearest thing the banking sector has to an independent systemic investigator, the role this site has argued elsewhere that banking sorely lacks. So it is worth asking what that function has actually found.
We searched all eight editions of AFCA's Systemic Issue Insights Reports published to date, covering the 2021-22 financial year through to the most recent edition, for four different ways the same control might reasonably have been described:
payee
new payee
payment recipient
first-time transfer
payment friction or hold
Across all eight editions, on every one of those four terms, the result was the same. Nothing.
This is not because the reports are silent on banking generally. Each edition discusses real, specific issues, credit file data delays, unauthorised scam account tracking, debt recovery conduct during open disputes, unsuitable lending, automated system failures, hardship compliance, operational resilience. The reports are detailed and specific about a wide range of banking conduct. They simply never once mention a first payment to a new payee, or any equivalent language for the single control this site argues would prevent an enormous share of scam losses.
This matters because the absence of any mandatory delay or hold on a first payment to a new payee, discussed at length elsewhere on this site, is one of the simplest, most effective and most frequently recurring preventable gaps visible in individual scam complaints. It is not a subtle pattern requiring sophisticated analysis to detect. It is the kind of thing that should surface in a systemic report almost immediately, if the function doing the analysis is looking for it, under any of the names it might reasonably go by.
It has not surfaced. Not once, under any description, across eight consecutive editions.
We are not suggesting anyone at AFCA is acting in bad faith. Systemic issue functions, like any process, have to choose what to prioritise, and priorities can miss things even with the best of intentions. But a gap this visible, this repeated, and this simple to name, going unmentioned across eight consecutive editions and four different ways of describing it, while scam losses have run into the billions every year, is worth asking about directly.
What This Means If You've Had Funds Stolen
The absence of a first-payment hold on your account was not, apparently, something AFCA's own systemic review process had flagged before your complaint.
That does not mean your complaint is any weaker. If anything, it means individual complaints, like yours, may currently be the only place this pattern is being raised at all.
It is reasonable to ask AFCA directly how its systemic issue priorities are set, and whether a pattern this consistent, under any name, has ever been considered.
Greg's Take
If the banking industry was responsible for airline safety, we would see crashes every day
If the airline industry was responsible for banking safety, scammers would have to find another job
Preamble
Aviation safety in Australia relies on an independent, no-blame systemic investigator, the Australian Transport Safety Bureau. Scam losses have no equivalent. Why not?
Contributing Factor
The Aviation Safety Model
Australia's aviation safety record is not an accident. Every crash, near-miss and serious incident is investigated by the Australian Transport Safety Bureau, an independent body with a single job: find out what went wrong in the system, and make sure it cannot happen the same way twice. The ATSB does not exist to punish anyone. It has no power to fine a pilot or an airline. Its investigators are not looking for someone to blame. They are looking for the gap in the system that allowed the incident to occur, and once they find it, they publish what they found and track the fix until it is done. That is why flying keeps getting safer.
Now compare what happens when a bank customer has funds stolen by a scammer. The bank investigates. But the bank investigating a scam is nothing like the ATSB investigating an incident. The bank is investigating itself. It sets its own scope, uses its own undisclosed methods, and reports its own conclusion. Almost always, that conclusion is about what the customer did. Whether the bank's own authentication settings were adequate, whether its fraud detection systems should have flagged the payment, whether staff noticed anything and did nothing: none of that is examined by anyone outside the bank, and none of it is published.
The Australian Financial Complaints Authority resolves individual disputes between a customer and a bank, and since 12 March 2026 that includes the receiving bank as well as the sending bank. That expansion matters, and it is put to full use elsewhere on this site. But resolving one customer's dispute is not the same job as investigating why the loss was possible in the first place. AFCA was never built, funded or empowered to do for banking what the ATSB does for aviation. Nobody was.
So Australia ends up with two systems side by side. One treats every incident as a lesson the whole industry needs to learn, and gets safer every year because of it. The other treats every loss as a private dispute between one customer and one bank, learns nothing in public, and repeats the same pattern for the next customer. Scam losses in Australia have run to billions of dollars a year, every year, since well before this website existed. There is no independent body reading the equivalent of the black box. There is no one asking why the same failures keep recurring across different banks, different customers, different scams, with the same result each time.
This is not a rhetorical question. It is one worth putting directly to AFCA and to the regulators who oversee the banks: why does Australia run a no-blame, systemic-improvement investigation model for an industry where fatal incidents are mercifully rare, and nothing of the kind for an industry where preventable losses happen every single day?
What This Means If You've Had Funds Stolen
The investigation into your stolen funds was conducted by the bank whose systems are part of the question. Nobody independent has looked at whether those systems contributed, let alone forced a change to those systems
A finding that you were at fault is a finding about one part of the story. It says nothing about what the bank's own systems did, or failed to do, at the moment the payment went through.
Since 12 March 2026, you can pursue both the sending bank and the receiving bank, and ask each of them directly what their systems actually did.
Every complaint that forces a bank to answer for its own conduct does a small piece of the work the missing investigator should be doing.
Feedback and Right of Reply
Questions or comments?
This page reflects patterns observed in real complaint handling. If you have questions or comments, or your own experience to add, we would like to hear from you.
Right of reply.
Where a bank or organisation named or clearly identifiable on this page believes anything stated here is inaccurate or unfair, we invite that bank or organisation to contact us directly. Any correction that is factually substantiated will be published alongside the original material, so the public record reflects both sides.
This is not a request for legal argument, it is an open invitation to correct the record.
Authorised by Greg Williams, Lincoln Computer Centre, contact details below
Greg's Take
Here at LCC, for the past seven years, more than 150 matters, and not once has a receiving bank told a sending bank anything beyond "sorry, the account's empty"
The privacy of an account operated by a scammer has been protected more carefully than the funds stolen from the customer who banked with someone else
Nobody ever tested the answer because until 12 March 2026 there was nobody with standing to test it
Preamble
The question was never whether a receiving bank owed you a legal duty. It is whether the bank's conduct was fair.
AFCA can now compel a receiving bank to compensate a customer for failing to act on a fraud report, whether or not the bank owed that customer any legal duty at all.
When a bank freezes and recalls a stolen payment, the receiving bank almost always gives the same answer: the account is empty, nothing left to return.
That answer has never been checked. This page asks what happens when someone finally checks it, and shows that every question needed to check it can be asked without revealing a single private detail about anyone.
Sorry, The Account's Empty
When stolen funds land in a scammer's account and the sending bank asks for them back, the answer that comes back is almost always the same: sorry, the account's empty. For years, that has been the end of the conversation.
It has never been the end of the story. It has simply been the point at which the story stopped being told to the customer.
The receiving bank knows a great deal more than "empty." It knows exactly when it was told the money was stolen. It knows what it did, if anything, in the minutes and hours that followed. It knows what the account balance actually was at the moment it found out. It knows when the account was opened, what checks were done on the person who opened it, and whether that account has done this before. None of that has ever had to be disclosed, because the receiving bank has consistently pointed to one thing: the privacy of its account holder.
It is a strange kind of privacy. The account holder in these cases is the person who took someone else's stolen money. Their privacy has, for years, been treated as more important than the customer's right to know what happened to funds that were taken from them.
The reason the privacy answer has survived so long is not that it is a good answer. It is that, until 12 March 2026, nobody had the standing to test it. A customer who banked with the sending bank was never a customer of the receiving bank, and had no path to ask the receiving bank anything at all. An untested objection, repeated for years without challenge, starts to look like a rule. It was never a rule. It was simply never tested.
Here is the distinction that changes everything: nobody needs to know who the account holder is. The only questions that matter are about what the bank did.
When was the bank told the money had been stolen?
What did it do the moment it found out?
Was the account frozen, and if so, when, and if not, why not?
What was actually in the account at that moment?
What happened to the money after that?
Is the account still open, and if it was closed, who closed it and when?
What checks were done when the account was first opened?
Has this account been reported before?
Every one of those questions can be answered in full without naming a single person. A bank that refuses to answer them is not protecting anyone's privacy. It is declining to account for its own conduct.
Since 12 March 2026, the receiving bank can be brought into the same complaint as the sending bank, as a respondent in its own right. Its conduct is now something that can be examined, and AFCA, the Australian Financial Complaints Authority, can require the bank to produce the information that answers these questions. The privacy objection that has stood unchallenged for years is, for the first time, being tested.
We already know what the silence can cost, because it has reached AFCA once, in a case decided before the rules changed. In AFCA determination 12-00-942146, a complaint against ANZ, a customer who had funds stolen argued that more should have been recovered from the receiving bank. That argument failed for one reason only: the receiving bank would not release its records, and AFCA had no power to make it, because the receiving bank was not part of the complaint. The customer had a fair point about recovery and got nothing for it, not because the point was wrong, but because the one bank that held the answer could not be made to give it. This example happens to involve ANZ as the sending bank, but it could be any bank in either role, because the gap was structural, not particular to one institution. That gap is exactly what the 12 March 2026 change is meant to close. The receiving bank that could once stay silent is now a party that can be asked.
It's worth heading off one thing a receiving bank may say in response. AFCA's own guidance on this expanded jurisdiction notes that it does not create new legal duties owed by a bank to someone who isn't its customer. That is true, and it changes nothing about the argument here, because the argument was never that the receiving bank breached a legal duty of care. AFCA does not decide these complaints on legal duty alone. It decides what is fair in all the circumstances. And AFCA has published its own worked examples of what that means in practice: a receiving bank that ignored fraud reports about an account, or that failed to freeze funds after being put on notice, can be compelled to compensate the customer, whether or not it owed that customer any legal duty. So a bank pointing to "no new legal duties" is answering a question nobody asked. The question is whether its conduct was fair. On AFCA's own examples, doing nothing after being told an account was receiving stolen money is not.
What might that testing find? Notifications that were received and simply not acted on. Accounts left open long after the bank knew what they were being used for. Money that kept moving after the bank was on notice. Accounts opened without proper checks, then used again and again. The same account, reported by more than one victim, with no cumulative response from the bank that held it.
None of that is known yet. That is exactly the point. Seven years of "sorry, the account's empty" was never a finding. It was an answer nobody was ever required to prove.
What This Means If You've Had Funds Stolen
If your bank told the receiving bank the money was stolen, you are entitled to ask what that bank actually did in response, not just be told the account was empty.
You never need to ask who holds the account. Ask only what the bank did with the notification it received. That question cannot be refused on privacy grounds.
Since 12 March 2026, the receiving bank can be named directly in your complaint, and can be required to answer these questions rather than simply asserting the account was empty.
If a receiving bank says it owed you no legal duty because you weren't its customer, that is not the end of the matter. AFCA decides what is fair, and has said it can compel a receiving bank to compensate for failing to act on a fraud report, regardless of legal duty.
A refusal to answer these specific, person-free questions is itself worth noting. It is a refusal to account for the bank's own conduct, not a privacy protection.
Feedback and Right of Reply
Questions or comments?
This page reflects patterns observed in real complaint handling. If you have questions or comments, or your own experience to add, we would like to hear from you.
Right of reply.
Where a bank or organisation named or clearly identifiable on this page believes anything stated here is inaccurate or unfair, we invite that bank or organisation to contact us directly. Any correction that is factually substantiated will be published alongside the original material, so the public record reflects both sides.
This is not a request for legal argument, it is an open invitation to correct the record.
Authorised by Greg Williams, Lincoln Computer Centre, contact details below
Greg's Take
Businesses large and small routinely advise their customers about a change of bank details without thinking about how their emails land
Large businesses send to small businesses, small businesses then think that is a good practice, small businesses send to consumers, and consumers have the least awareness of the risk of receiving such an email
Preamble
The bigger question isn't whether one particular email is a scam. It's that legitimate organisations keep training their own customers to accept exactly the behaviour a scammer needs them to accept
Banks call customers and ask them to confirm their date of birth to "verify" who they are. Suppliers email customers new bank account details with no way to check they're real. Different industries, same training, same result
Two everyday examples, one pattern. A bank calls and asks you to confirm your date of birth. A supplier emails new bank account details with no way to check they're genuine. Both teach you, over time, that this kind of unverified request is normal.
Contributing Factor
Training the Muscle Memory
Most advice about scams focuses on the scammer: the coached script, the urgent phone call, the fake website. Less attention goes to something arguably more damaging, the way ordinary, legitimate organisations train customers, through entirely routine practice, to accept the exact behaviour a scammer relies on.
Consider two everyday examples.
The first happens on the phone. A bank calls a customer, for a completely routine reason, and asks them to "verify their identity" by confirming their date of birth, address, or other personal details. The call appears to come from the bank. The customer has no real way, in that moment, to confirm it genuinely does. Every time this happens without incident, it reinforces a simple, understandable assumption: when someone calls claiming to be my bank and asks for identifying details, that's normal, I should answer. That is precisely the assumption a scammer needs a customer to hold. The bank, through nothing more than routine and well-intentioned practice, has done the scammer's groundwork in advance.
The second happens by email. A supplier writes to its customers announcing a change of bank account details, attaching a document with full account numbers, and asking customers to update their payment records. No separate way to verify the request is offered, no login portal, no independently sourced phone number, nothing beyond the email itself. This is exactly the pattern behind a great deal of business email compromise fraud, and it makes no difference whether this particular email turns out to be genuine or not. Either it is a real compromise, or it is a legitimate business teaching its own customers that this is how bank detail changes are communicated, which then makes the next, genuinely fraudulent version of the same email far more convincing.
Neither example involves a scammer doing anything unusual. Both involve a legitimate organisation doing something entirely ordinary, and in doing so, quietly lowering the guard of everyone it deals with.
This matters more for consumers than it does for businesses. A business receiving an unverified bank-detail-change request usually has some advantages, an existing account relationship to compare against, staff who may recognise something is off, an established portal to check instead. A consumer receiving the same kind of request, particularly by phone from their own bank, typically has none of those advantages, and has often been trained by years of entirely ordinary contact with that same institution to expect exactly this kind of request as normal.
None of this requires bad intent from anyone. It requires only that organisations think about what their routine communication habits are teaching the people on the other end.
What This Means For You
If your bank calls you and asks you to confirm personal details, you are entitled to decline, hang up, and call the bank back on a number you already know is genuine, not one given to you during the call.
If you receive an email announcing a change of bank account details, from any organisation, treat it as unverified until you've confirmed it independently, through a channel you already trust, not through anything in the email itself.
A small test payment, before committing to a new account in full, is a simple and effective check, since first payments to a new payee are exactly where this kind of fraud usually succeeds.
If a bank later suggests you should have known better than to trust an unverified caller, it's fair to ask whether the bank's own routine practices have trained its customers to do exactly that.
Feedback and Right of Reply
Questions or comments?
This page reflects patterns observed in real complaint handling. If you have questions or comments, or your own experience to add, we would like to hear from you.
Right of reply.
Where a bank or organisation named or clearly identifiable on this page believes anything stated here is inaccurate or unfair, we invite that bank or organisation to contact us directly. Any correction that is factually substantiated will be published alongside the original material, so the public record reflects both sides.
This is not a request for legal argument, it is an open invitation to correct the record.
Authorised by Greg Williams, Lincoln Computer Centre, contact details below
Greg's Take
A scammer doesn't need to build a convincing website anymore.
A free host or a major cloud provider will hand them one, instantly, with a genuine security padlock, no questions asked
This isn't a small, under-resourced provider we're talking about.
We saw this served straight from Google's own infrastructure.
Google has every capability needed to check what's in that bucket. It simply doesn't
When capability isn't the problem, the absence of a check stops being an excuse and becomes a choice
Here is the fake Microsoft pop-up which prompted this analysis, noting this scam has existed with subtle changes since 2015
So I rang the number, here is the rather polite conversation which ensued to give you an idea of how scammers work, he was unsuccessful of course!
Preamble
A scam page can now be hosted, for free, on infrastructure so trusted that even security software waves it straight through.
We saw one served from Google's own storage service. Here's how that happens, and why it matters.
Contributing Factor
How Do I Know If a Website Is Real?
Free web hosting services, and the public storage systems run by major cloud providers, will hand anyone a working, secure web address in return for nothing more than an email address. No check on who's asking, no check on what they intend to put there. Whatever gets uploaded, from a family photo album to a fake bank login page, sits behind the same trusted address, the same valid security certificate, and the same reputation the provider has spent years building.
That's the whole trick. A customer looking at the address bar sees a padlock and a domain name belonging to a company they already trust. There is nothing visible that distinguishes a scam page thrown up an hour ago from a legitimate one that's been there for years, because the provider lends its trust equally to both. And in practice, hardly anyone actually reads the address bar closely enough to notice anyway, so even the small clue that is technically there rarely helps.
We recently saw this happen directly, not as a reported case, but on our own screen. The page was served from Google's own cloud storage service, complete with a valid certificate and Google's own trusted domain. It presented as a full-screen fake Microsoft support page, layered with fake security warnings claiming the computer had been locked for security reasons, and a fake support number to call. The page's actual purpose was a login box, designed to harvest a username and password the moment someone typed them in. Nothing was installed, no software, no download, it was simply a web page, and it could be closed the same way any full-screen page can, by pressing and holding the Escape key.
This is worth sitting with for a moment. This wasn't hosted by a small, under-resourced operator without the means to check what it was hosting. It was Google, one of the largest and most capable technology companies in the world, with every resource needed to verify what gets uploaded to its own storage service. It simply doesn't check. That single fact removes the usual defence, that verification is too hard or too expensive for a provider to manage. If the most capable company in the industry doesn't verify, the absence isn't a limitation. It's a choice.
There's also a technical reason this particular problem is genuinely hard to block from the customer's own device, and it's worth explaining, because it shows the fix has to happen further up the chain. The address itself, storage.googleapis.com, carries so much of the ordinary, legitimate internet that no security software could ever block it outright without breaking huge amounts of harmless traffic. And the specific part of the address that would need blocking, the exact file location, can be made deliberately long enough that it's simply impractical to track and block one by one. Both of these are things only the hosting provider itself controls. No amount of software on a customer's own computer can fix either of them.
This matters well beyond the moment someone sees a fake warning on screen. This is where a scam's credibility is built in the first place. Whatever a customer is later persuaded to type into a page like this, a password, a banking login, becomes the very thing a bank's own systems later treat as a genuine, correctly authorised instruction. The bank never sees the unverified page that made the deception possible. It only sees the result, a transaction that looks, from its side, exactly like the customer's own genuine action.
What This Means If You've Had Funds Stolen
If a scam involved a fake website, especially one you reached through a phone call, a text message, or an unexpected pop-up, that page may well have been hosted on entirely legitimate, trusted infrastructure, with nothing on the page itself to warn you.
A genuine full-screen "your computer is locked" warning is almost always just a web page. You can usually close it by pressing and holding the Escape key, it isn't actually locking anything.
If your bank has treated the resulting transaction as "authorised" because the correct login details were used, it's worth asking how those details came to be entered in the first place, and whether the page that captured them showed any sign of being untrustworthy at all.
None of this is something you could reasonably have been expected to spot. The trust being borrowed belongs to some of the largest companies in the world.
Feedback and Right of Reply
Questions or comments?
This page reflects patterns observed in real complaint handling. If you have questions or comments, or your own experience to add, we would like to hear from you.
Right of reply.
Where a bank or organisation named or clearly identifiable on this page believes anything stated here is inaccurate or unfair, we invite that bank or organisation to contact us directly. Any correction that is factually substantiated will be published alongside the original material, so the public record reflects both sides.
This is not a request for legal argument, it is an open invitation to correct the record.
Authorised by Greg Williams, Lincoln Computer Centre, contact details below
